CN107147652A - A secure fusion authentication method for user multi-modal identity based on blockchain - Google Patents

Abstract

The invention discloses a block chain-based safe fusion authentication method of user multi-modal identity, comprising the steps of: initialization, entry of identity information, identity feature extraction, and fusion feature matching. The present invention is characterized in that it provides a complete set of mechanisms to realize safe, efficient, convenient and reliable identity authentication by combining multi-form identity fusion authentication methods, block chain technology, and public key encryption system. Among them, the user can self-select the identity information to enter, and the server performs feature extraction on the entered information, and performs fusion and matching on the identity information by decrypting the records on the block chain, and finally judges whether the user is authorized to log in. The scheme proposed by the present invention can Realize safe, efficient, convenient and reliable identity authentication.

Description

A secure fusion authentication method for user multi-modal identity based on blockchain

technical field

The present invention relates to the technical field of identity recognition, in particular to a secure fusion authentication method based on block chains for user multi-modal identities.

Background technique

At present, the limitations brought by the identity authentication technology of a single security mechanism are becoming more and more obvious, and the integrated application of multiple security mechanisms is becoming a new trend. This is because the authentication technology based on a single factor (such as account password login) is prone to the risk of being counterfeited and stolen. The use of multiple security factors not only improves the security of the system, but also improves the reliability of authentication. Even if a user lacks an element of identity authentication, he can still log in with other identity information. In addition, there is currently a lack of a complete mechanism that allows users to freely choose different forms of identity information for verification, and integrate, analyze and match the above information through unified model storage and secure and intelligent algorithms. Most importantly, the current centralized storage of identity feature information in a certain center has great security risks. Once the data center is breached, user identity information will be leaked and destroyed, which is a disastrous consequence.

Blockchain is an open and transparent public consensus, co-governance and sharing new infrastructure, which has the characteristics of distributed data storage, decentralization, non-tamperable, traceable and trustworthy. Although the transparency of the blockchain conflicts with the privacy of user identity information, we can combine the public key encryption system and blockchain technology to achieve safe and reliable storage of user identity information. By encrypting user identity information and recording it in the blockchain, combined with the public key searchable encryption algorithm, we can achieve safe, efficient and reliable storage and use of user identity information.

Contents of the invention

The purpose of the present invention is to: aim at the above-mentioned existing single-factor authentication technology with a single authentication element, which is prone to counterfeiting and user information being stolen, resulting in low security and reliability in user authentication. The present invention provides a method based on A secure fusion authentication method for multi-modal identity of blockchain users.

The technical scheme that the present invention adopts is as follows:

A blockchain-based security fusion authentication method for user multi-modal identity, comprising the following steps:

(1) Initialize, generate the public key and private key of the server and trusted nodes, generate the public parameters of the server and the public algorithm of the server, where the public parameters include: the number of identities supported in different forms (m), each identity The number (n) of morphological feature components, the proportion of identity feature weights, similarity threshold, etc., the public algorithms include: hash function, matrix transformation algorithm, identity feature extraction algorithm, identity feature matching algorithm, etc. The specific meaning is described in the process is described in;

(2) The user inputs the user account and different forms of identity information to the server, and the different forms of identity information include the user's identity name;

Then the server extracts the features of different forms of identity information input by the user to obtain identity features, calculates each extracted identity feature through a public hash function to obtain a uniform length identity feature vector, and then uses the public matrix transformation algorithm Perform matrix transformation on the identity feature vector to obtain the identity feature matrix, and calculate the root of the identity feature matrix;

(3) Based on a typical public key encryption algorithm, the identity feature matrix in step (2) is encrypted to obtain the identity feature matrix ciphertext;

Based on a typical public key searchable encryption algorithm, the user identity name is used as an object, and the server's public key is used to encrypt the user identity name and obtain a searchable ciphertext;

(4) The server signs the user account, the root of the identity feature matrix, the feature matrix ciphertext, and the searchable ciphertext with a private key, and sends them to the trusted node;

(5) The trusted node searches the blockchain according to the user account. If the user logs in for the first time, the trusted node will issue a public key for the user, create a creation block to record the user's identity information in different forms and store the user account, user public key, The time stamp, the root of the feature matrix, the ciphertext of the feature matrix and the searchable ciphertext are written into the founding block and broadcast in the network; the identity information of different forms of the first login user is the original identity information, and the original identity information is transformed to obtain the original Identity feature matrix, the ciphertext of the original identity feature matrix is the original identity feature matrix ciphertext; otherwise, perform step (6);

(6) Perform fusion feature matching and similarity judgment on different forms of identity information of users.

In the described security fusion authentication method based on blockchain-based user multi-modal identity, in step (1), the public parameters generated include: identity feature weight ratio, similarity threshold, different forms of identity supported by the server The number of features, the number of feature components of each identity form, and the public algorithms generated include: public hash algorithms, identity feature extraction algorithms, and identity feature matching algorithms.

Described a kind of security fusion authentication method based on block chain user's polymorphic identity, in step (2), feature extraction and feature transformation specific steps are:

(21) The server extracts identity features according to the public algorithm generated in step (1) for different forms of identity information input by the user, and uses the public hash algorithm to calculate each extracted identity feature to obtain the calculated identity feature The corresponding eigenvector, the eigenvector corresponding to the calculated identity feature consists of n components;

(22) The server forms the feature vectors in the unified format obtained in step (21) into a feature matrix according to the disclosed matrix transformation algorithm.

Described a kind of safe fusion authentication method based on block chain user's polymorphic identity, the specific steps of step (6) are:

(61) The trusted node sends the original identity feature matrix ciphertext to the server, and the server decrypts it with its own private key to obtain the user's original identity feature matrix, and extracts the user's original identity feature matrix from the user's original identity feature matrix one by one Vectors A ₁ ,..., A _m ; among them, m represents the number of user identity information in different forms;

(62) The server extracts identity feature vectors A' ₁ , ..., A' _m from the identity information entered by the user, where m represents the number of different forms of identity information of the user;

(63) The server compares the similarity of each identity feature in step (62) and step (63) according to the public feature matching algorithm Match(), and obtains the comparison similarity of each identity feature, and the comparison similarity of each identity feature The formula for calculating similarity is:

r ₁ =Match(A ₁ ,A' ₁ ),...,r _m =Match(A _m ,A' _m );

Where r ₁ ... r _m is the comparison similarity of each identity feature;

(64) The server calculates the fusion and matching similarity of all identity features, and the calculation formula for the fusion matching similarity is:

R＝ω ₁ r ₁ +…+ω _n r _m ,

Among them, ω ₁ ,...,ω _n represent the weight ratio of different morphological identity features;

(65) The server compares R with a given similarity threshold V. If R>V, the authentication is successful and the login is authorized. Otherwise, the failure identifier is returned and the end is completed.

In summary, owing to adopting above-mentioned technical scheme, the beneficial effect of the present invention is:

1. In the solution of the present invention, a new type of infrastructure based on open and transparent public consensus, co-governance and sharing based on blockchain has the characteristics of distributed data storage, decentralization, non-tamperable, traceable, and trustworthy, etc., through The user identity information is encrypted and recorded in the blockchain, and combined with the public key searchable encryption algorithm, the user identity information is stored and used safely, efficiently and reliably.

2. Since various forms of identity information are used to authenticate customers, there is no need to worry about the problem of inability to authenticate due to the lack of certain identity information.

3. In this scheme, multiple different forms of identity information of the same user can be recorded in the blockchain, so users can freely choose different forms of identity information for verification, and store and secure and intelligent through a unified model The algorithm integrates, analyzes and matches the above information.

Description of drawings

Fig. 1 is a flow chart of a security fusion authentication method based on blockchain-based user multi-modal identity in the present invention;

Fig. 2 is an explanatory diagram for identity feature extraction and feature matrix in the present invention;

Fig. 3 is a blockchain structure diagram for recording identity feature information in this invention;

detailed description

All the features disclosed in this specification, except mutually exclusive features and/or steps, can be combined in any way.

The present invention will be described in detail below in conjunction with FIG. 1 , FIG. 2 and FIG. 3 .

A blockchain-based security fusion authentication method for user multi-modal identity, comprising the following steps:

Initialize, generate the public key and private key of the server and trusted nodes, generate the public parameters of the server and the public algorithm of the server, where the public parameters include: the proportion of identity feature weight, similarity threshold, and the number of different forms of identities supported , The number of feature components of each identity form, and the generated public algorithms include: public hash algorithm, identity feature extraction algorithm, and identity feature matching algorithm. The similarity threshold is used to determine the similarity threshold that needs to be achieved for the user to log in successfully. Among them, the identity feature weight ratio is the percentage of different forms of identity information in the verification process, which can be freely set according to the actual application environment;

The user enters the user account and (one or more forms) user identity information into the server through a secure way (including: secure channel, secure equipment, such as: POS machine, etc.), user identity information includes but not limited to: password, Fingerprint, iris, face, sound source.

For different forms of identity information input by the user, the server extracts the identity features of different forms of identity information according to the corresponding public algorithms, and unifies the identity features extracted from each different form of identity information according to the public hash algorithm Calculate to obtain an identity feature vector composed of n feature components; different forms of identity information include user identity names;

For example, for the identity information of the face image, record the coordinates of the distribution of the face organs, and calculate the identity feature vector composed of n components, such as: A ₁ ={a _1,1 ,...,a _1,n }, here, a _{1, i} represents a feature component in a face feature vector;

For example, for conventional passwords, according to the public hash algorithm, a hash feature vector composed of n password components is obtained, such as: A ₂ ={a _2,1 ,...,a _2,n }, in addition, for other different forms of Identity information, such as iris, fingerprints, etc., the method is similar;

The server uses these feature vectors to obtain the identity feature matrix according to the public matrix transformation algorithm, and calculates the root of the current identity feature matrix. The identity feature matrix is a matrix composed of multiple identity feature vectors of the user;

It should be pointed out that we pre-set the user to have m different forms of identities through public parameters in the initialization process, and each form of identity is composed of an identity feature vector with n feature components. We can simply think of it as: identity feature matrix is an m×n matrix, where each element represents a feature component corresponding to a form of identity information;

Then, based on the public key encryption algorithm, the server encrypts the user identity feature matrix with its own public key to obtain the identity feature matrix ciphertext; the public key encryption algorithm includes but is not limited to the well-known RSA public key encryption algorithm. The characteristics of the RSA public key encryption algorithm are: the sender uses the receiver's public key to encrypt, the ciphertext is transmitted in the public channel, and the receiver uses his own key to decrypt the ciphertext after receiving it.

Based on the public key searchable encryption algorithm, the server uses the user's identity name as a keyword, encrypts it with its own public key and obtains the keyword searchable ciphertext; the public key searchable encryption algorithm includes but is not limited to Boneh et al. The PEKS public key searchable encryption algorithm. The PEKS public key searchable encryption algorithm takes the user identity name as an object, encrypts the user identity name with its own public key and obtains searchable ciphertext; here, the characteristics of the public key searchable encryption algorithm are: the keyword is used to accept The recipient's public key is encrypted and sent to the server together with the ciphertext for storage. The recipient uses his own public key and keyword to generate a trapdoor and sends it to the server. The server matches the ciphertext containing the keyword through the trapdoor and sends back the acceptance By;

The server respectively signs the user account, the root of the current identity feature matrix, the ciphertext of the identity feature matrix and the searchable ciphertext to the trusted node, and the trusted node is responsible for recording it into the blockchain;

It should be noted that we use the public key algorithm to encrypt the user identity feature matrix and record it on the blockchain, in order to protect the various forms of user identity information from being leaked, and the use of the public key searchable encryption algorithm is to The ciphertext of the identity name is used as the identifier of the ciphertext of the user feature matrix for easy query. Obviously, recording the plaintext of the user identity name on the blockchain is easy to leak privacy, and using the public key searchable encryption algorithm can make the Trust nodes and all other users can safely and efficiently query and transmit the identity information recorded on the blockchain without knowing what the plaintext of the user identity name is. Privacy-preserving, yet easily retrievable;

Then, according to the identity feature matrix ciphertext sent by the server, the trusted node performs the following according to different situations of the user:

The trusted node searches the blockchain according to the user account. If the user logs in for the first time, that is, there is no blockchain recording the user's identity characteristics, the trusted node first issues a public key to the user and creates a genesis block ( The first block) is used to record initial information such as user account number and creation time. Then, the trusted node records the multi-modal identity information of the user in a block chain in turn, and records the user account number, user public key, feature The root of the matrix, timestamp, feature matrix ciphertext and searchable ciphertext are written into the founding block and broadcast in the network; the identity information of different forms of the first login user is the original identity information, and the original identity information is transformed to obtain the original identity Feature matrix, the ciphertext of the original identity feature matrix is the ciphertext of the original identity feature matrix;

If the user is already registered, there is already a blockchain recording his identity. Based on the public key searchable encryption algorithm, the server uses its own private key and user identity name to generate a searchable trapdoor and send it to the trusted node. The trusted node searches according to the trapdoor. If the user’s identity name is a block, create a block, and write the user account, user public key, the root of the latest feature matrix, timestamp, the latest feature matrix ciphertext, and the searchable ciphertext of the identity name into the new in the block and broadcast in the network;

Otherwise, the trusted node retrieves the block containing the user's identity name information, and returns the latest identity feature matrix ciphertext recorded on the block to the server, and the server uses its own private key to decrypt the matrix ciphertext, and from it Extract the original identity feature vectors of different forms of the user: A ₁ , ..., A _m , where the original identity features are the identity features entered by the user when logging in for the first time;

The server extracts the identity feature vectors A′ ₁ ,…, A′ _m from the identity information entered by the user, and the server inputs the extracted identity feature vectors A′ ₁ ,…, A′ _m respectively according to the public feature matching algorithm Match() and the original identity vectors A ₁ , ..., A _m , where m represents the number of identities in different forms, and finally calculate the comparison similarity of each identity feature. The similarity calculation formula of each identity feature is as follows:

r ₁ =Match(A ₁ ,A' ₁ ),...,r _m =Match(A _m ,A ' _m );

Among them, r ₁ ... r _m is the comparison similarity of each identity feature.

Finally, the server compares the identity features sent back by the user and the decrypted trusted node according to the public feature matching algorithm, and calculates the matching similarity:

R＝ω ₁ r ₁ +…+ω _n r _n ,

Among them, ω ₁ ,…,ω _n represent the weight ratio of the corresponding identity features (ω ₁ ,…,ω _n are set according to public parameters), the server compares R with the similarity threshold V, if R>V, then If the authentication is successful, the login is authorized, otherwise, return the failure identifier and end.

Through the fusion authentication method of multi-modal identity, blockchain technology and public key encryption algorithm, we have designed a complete system to achieve safe, efficient, convenient and reliable user identity authentication.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention are all Should be covered within the protection scope of the present invention.

Claims (4)

1. the safety fusion authentication method of the polymorphic identity of a kind of user based on block chain, it is characterised in that including following step Suddenly：

(1) initialize, the public key and private key of generation server and trusted node, generate the open parameter and server of server Public algorithm；

(2) identity information of user account and different shape is inputted with user orientation server, the identity information of different shape includes User identity title；

Then the identity information for the different shape that server is inputted to user carries out feature extraction respectively, obtains identity characteristic, will The each identity characteristic extracted calculates the identity characteristic vector for obtaining uniform length by disclosed hash function, then passes through public affairs The matrixing algorithm opened carries out matrixing to identity characteristic vector, obtains identity characteristic matrix, calculates identity characteristic matrix Root；

(3) typical public key encryption algorithm is based on, the identity characteristic matrix in step (2) is encrypted, identity characteristic is obtained Matrix ciphertext；

AES can search for based on typical public key, by user identity name be referred to as object, using server public key to Family identity name is encrypted and obtains searchable cryptograph；

(4) server is respectively to user account, the root of identity characteristic matrix, eigenmatrix ciphertext and searchable cryptograph with carrying out private Key is signed, and is sent to trusted node；

(5) trusted node is retrieved according to user account on block chain, if user first logs into, trusted node is issued for user Public key, creates the identity information of original block record user's different shape and by user account, client public key, timestamp, feature Root, eigenmatrix ciphertext and the original block of searchable cryptograph write-in of matrix, and broadcast in a network；First log into user's The identity information of different shape is original identity information, and original identity characteristic matrix is obtained after original identity information conversion, original The ciphertext of identity characteristic matrix is original identity characteristic matrix ciphertext；Otherwise, step (6) is performed；

(6) fusion feature matching is carried out to the identity information of user's different shape and similarity judges.

2. a kind of safety fusion authentication method of the polymorphic identity of user based on block chain according to claim 1, its It is characterised by, in step (1), the open parameter of generation includes：Identity characteristic weights accounting, similarity threshold, server are propped up The quantity of the different shape identity held, the quantity of the characteristic component of each identity form, the public algorithm of generation includes：It is public Hash algorithm, identity characteristic extraction algorithm, the identity characteristic matching algorithm opened.

3. a kind of safety fusion authentication method of the polymorphic identity of user based on block chain as claimed in claim 2, it is special Levy and be, in step (2), feature extraction and eigentransformation are concretely comprised the following steps：

(21) identity information for the different shape that server is inputted for user, the public algorithm generated according to step (1) is extracted Go out identity characteristic, each identity characteristic extracted is calculated using disclosed hash algorithm, calculated identity characteristic is obtained Corresponding characteristic vector, the corresponding characteristic vector of identity characteristic calculated is made up of n component；

(22) characteristic vector for the unified form that server obtains step (21) constitutes special according to disclosed matrixing algorithm Levy matrix.

4. a kind of safety fusion authentication method of the polymorphic identity of user based on block chain as claimed in claim 1, it is special Levy and be, step (6) are concretely comprised the following steps：

(61) original identity characteristic matrix ciphertext is sent to server by trusted node, after server is decrypted with the private key of oneself The original identity characteristic matrix of user is obtained, and it is special to extract from the original identity characteristic matrix of user the original identity of user one by one Levy vectorial A₁、…、A_m；Wherein, m represents the quantity of user's different shape identity information；

(62) server extracts identity characteristic vector A ' from the identity information of user's typing₁、…、A′_m, wherein, m represents user The quantity of different shape identity information；

(63) server compares each identity in step (62), step (63) according to disclosed Feature Correspondence Algorithm Match () The similarity of feature, obtains the alignment similarity of each identity characteristic, and the alignment similarity of each identity characteristic calculates public Formula is：

r₁=Match (A₁、A′₁)、…、r_m=Match (A_m、A′_m)；

Wherein r₁…r_mFor the alignment similarity of each identity characteristic；

(64) server calculates all identity characteristic fusion matching similarities, and fusion feature matching similarity calculation formula is：

R=ω₁r₁+…+ω_nr_m,

Wherein, ω₁,…,ω_nRepresent the weights accounting of different shape identity characteristic；

(65) server is compared R with given similarity threshold V, if R>V, then certification success, authorizes and logs in, otherwise, returns Failure identifier simultaneously terminates.