Disclosure of Invention
The invention provides a hierarchical authentication method and system for a power system based on blockchain and zero knowledge proof, which are used for solving the technical problems of complexity and low efficiency in the aspects of multi-level authority management and cross-trust domain authentication.
In a first aspect, the present invention provides a hierarchical authentication method for a power system based on blockchain and zero knowledge proof, including:
When the device When a communication across trust domains is required, the deviceApparatus for installingIs the first pseudo-identity of (2)Initiated request informationComposing a request across trust domainsThen the deviceWill request across trust domainsSending to a CPS (central processing system) which is according to the equipmentRequest information of (a)Selecting one and requesting informationDevices in corresponding domainsIs the second pseudo-identity of (2)Reuse of the second pseudo-identityForm a replyAnd send a replyFeeding device;
Apparatus and method for controlling the operation of a deviceAccording to the received replySecond pseudo-identity in (a)Apparatus for connectingIs the first pseudo-identity of (2)And request information to be communicatedComposing an authentication requestAnd request authenticationBy a second pseudo-identityTransmitting to a deviceApparatus and methodAccording to receiving the authentication requestFirst pseudo-identity in (a)Extracting registration tuples from corresponding nodes on a blockchainThen the deviceFor the first pseudo-identityZero knowledge proof authentication and deviceIs a first authentication key of (a)Apparatus and method for controlling the operation of a machineIs disclosed in (1)Apparatus and deviceFirst zero knowledge proof of (2)Inputting the first verification result into verification algorithm Verify, and obtaining the first verification result through the verification algorithm VerifyWhen the obtained first verification resultTime display deviceVerification is successful, in contrast, when the obtained first verification resultTime display deviceVerification fails;
Apparatus and method for controlling the operation of a device Authentication success deviceAfter that, the deviceSending a reply authentication replyFeeding deviceApparatus and methodReceipt of an authentication replyThen according to the second pseudo identityExtracting registration tuples from corresponding nodes on a blockchainThen the deviceWill be against a second pseudo-identityZero knowledge proof authentication and deviceIs a second authentication key of (2)Apparatus and method for controlling the operation of a machineSecond publication of (2)Apparatus and deviceSecond zero knowledge proof of (2)Inputting the second verification result into verification algorithm Verify, and obtaining a second verification result through the verification algorithm VerifyWhen the second verification result is obtainedTime display deviceVerification is successful, in contrast, when the second verification result is obtainedTime display deviceThe verification fails.
In a second aspect, the present invention provides a hierarchical authentication system for a power system based on blockchain and zero knowledge proof, comprising:
A processing module configured to, when the device When a communication across trust domains is required, the deviceApparatus for installingIs the first pseudo-identity of (2)Initiated request informationComposing a request across trust domainsThen the deviceWill request across trust domainsSending to a CPS (central processing system) which is according to the equipmentRequest information of (a)Selecting one and requesting informationDevices in corresponding domainsIs the second pseudo-identity of (2)Reuse of the second pseudo-identityForm a replyAnd send a replyFeeding device;
A first verification module configured as a deviceAccording to the received replySecond pseudo-identity in (a)Apparatus for connectingIs the first pseudo-identity of (2)And request information to be communicatedComposing an authentication requestAnd request authenticationBy a second pseudo-identityTransmitting to a deviceApparatus and methodAccording to receiving the authentication requestFirst pseudo-identity in (a)Extracting registration tuples from corresponding nodes on a blockchainThen the deviceFor the first pseudo-identityZero knowledge proof authentication and deviceIs a first authentication key of (a)Apparatus and method for controlling the operation of a machineIs disclosed in (1)Apparatus and deviceFirst zero knowledge proof of (2)Inputting the first verification result into verification algorithm Verify, and obtaining the first verification result through the verification algorithm VerifyWhen the obtained first verification resultTime display deviceVerification is successful, in contrast, when the obtained first verification resultTime display deviceVerification fails;
a second authentication module configured as a device Authentication success deviceAfter that, the deviceSending a reply authentication replyFeeding deviceApparatus and methodReceipt of an authentication replyThen according to the second pseudo identityExtracting registration tuples from corresponding nodes on a blockchainThen the deviceWill be against a second pseudo-identityZero knowledge proof authentication and deviceIs a second authentication key of (2)Apparatus and method for controlling the operation of a machineSecond publication of (2)Apparatus and deviceSecond zero knowledge proof of (2)Inputting the second verification result into verification algorithm Verify, and obtaining a second verification result through the verification algorithm VerifyWhen the second verification result is obtainedTime display deviceVerification is successful, in contrast, when the second verification result is obtainedTime display deviceThe verification fails.
In a third aspect, an electronic device is provided that includes at least one processor and a memory communicatively coupled to the at least one processor, wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the steps of the blockchain and zero knowledge proof based power system hierarchical authentication method of any embodiment of the invention.
In a fourth aspect, the present invention also provides a computer readable storage medium having stored thereon a computer program, which when executed by a processor, causes the processor to perform the steps of the blockchain and zero knowledge proof based power system hierarchical authentication method of any embodiment of the present invention.
According to the hierarchical authentication method and system for the electric power system based on the blockchain and the zero knowledge proof, a multi-level authority authentication method is designed according to the importance and authority levels of equipment and users, and the blockchain technology and the zero knowledge proof technology are introduced, so that a hierarchical authentication mechanism is realized, the problems of complexity and low efficiency of the traditional authentication method in multi-level authority management are solved, and the security and efficiency of cross-trust-domain authentication are greatly improved.
Detailed Description
For the purpose of making the objects, technical solutions and advantages of the embodiments of the present invention more apparent, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, and it is apparent that the described embodiments are some embodiments of the present invention, but not all embodiments of the present invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
Referring to fig. 1, a flowchart of a hierarchical authentication method for a power system based on blockchain and zero knowledge proof of the present application is shown.
As shown in fig. 1, the hierarchical authentication method of the power system based on blockchain and zero knowledge proof specifically comprises the following steps:
Step S101, when the device When a communication across trust domains is required, the deviceApparatus for installingIs the first pseudo-identity of (2)Initiated request informationComposing a request across trust domainsThen the deviceWill request across trust domainsSending to a CPS (central processing system) which is according to the equipmentRequest information of (a)Selecting one and requesting informationDevices in corresponding domainsIs the second pseudo-identity of (2)Reuse of the second pseudo-identityForm a replyAnd send a replyFeeding device。
Step S102, deviceAccording to the received replySecond pseudo-identity in (a)Apparatus for connectingIs the first pseudo-identity of (2)And request information to be communicatedComposing an authentication requestAnd request authenticationBy a second pseudo-identityTransmitting to a deviceApparatus and methodAccording to receiving the authentication requestFirst pseudo-identity in (a)Extracting registration tuples from corresponding nodes on a blockchainThen the deviceFor the first pseudo-identityZero knowledge proof authentication and deviceIs a first authentication key of (a)Apparatus and method for controlling the operation of a machineIs disclosed in (1)Apparatus and deviceFirst zero knowledge proof of (2)Inputting the first verification result into verification algorithm Verify, and obtaining the first verification result through the verification algorithm VerifyWhen the obtained first verification resultTime display deviceVerification is successful, in contrast, when the obtained first verification resultTime display deviceThe verification fails.
Step S103, apparatusAuthentication success deviceAfter that, the deviceSending a reply authentication replyFeeding deviceApparatus and methodReceipt of an authentication replyThen according to the second pseudo identityExtracting registration tuples from corresponding nodes on a blockchainThen the deviceWill be against a second pseudo-identityZero knowledge proof authentication and deviceIs a second authentication key of (2)Apparatus and method for controlling the operation of a machineSecond publication of (2)Apparatus and deviceSecond zero knowledge proof of (2)Inputting the second verification result into verification algorithm Verify, and obtaining a second verification result through the verification algorithm VerifyWhen the second verification result is obtainedTime display deviceVerification is successful, in contrast, when the second verification result is obtainedTime display deviceThe verification fails.
In the apparatusApparatus and deviceAfter mutual authentication is successful, the equipment is startedIs the first pseudo-identity of (2)Apparatus and deviceIs the second pseudo-identity of (2)Composing a session key generation requestAnd requests the session key generationThe session key is sent to the CPS, and the CPS receives the session key generation requestThen generating a random number n, and then according to the random number n and the first pseudo identitySecond pseudo identityGenerating deviceApparatus and deviceSession key betweenCPS device for central processing systemPublic key of (a)Session key by encryption algorithm EEncryption is carried out to obtain an encrypted session keyThe CPS will then encrypt the session keyTransmitting to a deviceApparatus and methodBy means of devicesPrivate key of (a)Obtaining the second session key after the decryption algorithm D is solvedSimultaneous apparatusSecond session keyCorresponding second pseudo-identityRecord to local storage and then deviceBy means of devicesPublic key of (a)Session key by encryption algorithm EEncrypting to obtain a second encrypted session keyAfter which the deviceEncrypting the second encrypted session keyTransmitting to a deviceApparatus and methodReceiving a second encrypted session keyBack-use devicePrivate key of (a)Obtaining the second session key after the decryption algorithm D is solvedLast deviceSecond session keyCorresponding first pseudo-identityRecorded into a local store.
By establishing the hierarchical trust domain, the method of the embodiment can distribute the device to different security levels according to the authority and the sensitivity of the device, and effectively isolate potential security risks. And a cross-trust domain authentication method is designed to further ensure safe data exchange between devices, and high security and privacy can be maintained even among different trust levels. The non-tamper-proof and zero-knowledge proof privacy protection characteristic of the blockchain technology ensures the transparency and the non-tamper-proof property of all transactions and operations, and provides a safe, reliable and privacy protection mechanism for the power system. The zero knowledge proof method enables the device to prove its identity and authority without revealing any sensitive information. In conclusion, the hierarchical authentication method based on the blockchain and the zero knowledge proof provides a new solution for the power system, and can effectively improve the safety and efficiency of the equipment authentication of the modern power system.
In a specific embodiment, the power device registration is specifically:
Apparatus and method for controlling the operation of a device Note that the device is provided before sending registration request to the CPSIs converted into an arithmetic circuit C, and then the arithmetic circuit C and the security parameters are used for the authenticationInput into Setup operation Setup to generate certification keyAuthentication keyThen the identification key of the identity to be authenticated is verifiedStatement of disclosureAnd witnessing personInput into a proof operation to generate a zero knowledge proof, wherein,Is a unitary representation, is used to convey information about the security parameters,It means that the certification key and the verification key for the zero knowledge certification process are generated based on the security parameters and the arithmetic circuit by the Setup operation.
Apparatus and method for controlling the operation of a deviceApparatus for installingIs the first pseudo-identity of (2)Public keyAnd zero knowledge proofForming a registration tupleApparatus and methodSending registration tuples to CPSTo generate a registration request, the CPS receives the registration tupleAfter that, the received first pseudo identity is verifiedWhether or not to repeat if the first pseudo identityRejecting the registration request if repeated;
CPS verification is successful and then the CPS verification is used as equipment on the blockchain Establish a target node and register the tupleStored in the target node while the device is being movedIs the first pseudo-identity of (2)Associated with the account address of the target node, and finally, the CPS returns a replyFeeding deviceTo inform the device ofRegistration is completed.
In another specific embodiment, the power devices in the same trust domain mutually authenticate, specifically:
When the device When in-domain authentication is needed, equipmentApparatus for installingIs the first pseudo-identity of (2)Form authentication request to CPS;
CPS receives the authentication requestThereafter, according to the first pseudo-identityExtracting registration tuples from corresponding nodes on a blockchainThe CPS then processes the first pseudo-identityPerforming zero knowledge proof authentication and authenticating the first verification keyStatement of first publicationAnd a first zero knowledge proofInputting the first verification result into verification algorithm Verify, and obtaining the first verification result through the verification algorithm VerifyWhen the obtained first verification resultTime display deviceVerification is successful, in contrast, when the obtained first verification resultTime display deviceVerification fails;
Apparatus and method for controlling the operation of a device After authentication is successful, CPS follows the first pseudo identityIs of importance to the deviceAssigning permission levelsAfter the allocation is completed, the first pseudo identityAnd authority levelRecord in local store, and finally CPS sends reply authentication replyFeeding device。
Specifically, the CPS is classified by authority levelDefining trust domains as 3 levels, i.e., high-level trust domainsMiddle level trust domainLow-level trust domain。
The method of the application can realize the following technical effects:
(1) The method is suitable for a multi-level cross-trust domain scene, wherein devices are distributed into different trust domains (high-level trust domain, medium-level trust domain and low-level trust domain) according to the authority level of the devices, and each trust domain has unique security requirements and access authority settings. In this way, devices of different levels can operate securely within respective trust domains. When the device needs to request across the trust domain, the validity and the security of the request across the trust domain are ensured by exchanging zero knowledge proof and a bidirectional authentication process.
(2) The device can rapidly perform identity authentication through the pre-generated certification key and verification key in the registration and authentication process, thereby reducing manual intervention and improving authentication efficiency. After the cross-trust domain authentication is successful, the central processing system generates a session key, and the session key is transmitted through the public key encryption of the equipment, so that the safe transmission and storage of the session key are ensured. The use of session keys ensures the efficiency and security of inter-device communication.
(3) The invention stores the registration information of the equipment on the blockchain by utilizing the blockchain technology, so that any blockchain node can quickly access and verify the registration information of the equipment. The decentralised storage mode eliminates the risk of single-point faults and improves the reliability and efficiency of authentication. Through the zero knowledge proof technology, the equipment can quickly generate and verify the identity proof without transmitting sensitive information, and communication overhead and delay in the authentication process are reduced.
(4) And after the equipment is successfully authenticated, different authority levels are allocated, and the resource access control is performed according to the authority levels. Higher level trust domain devices may access more sensitive and important resources while access rights of lower level trust domain devices are severely restricted. When in cross-trust domain communication, the enhanced cross-trust domain authentication process ensures that each communication is carried out under the premise of being controllable and conforming to policies, thereby further ensuring the security of the resources.
(5) The security of the system is ensured, namely, the identity verification is carried out under the condition of not revealing sensitive information of the equipment by a zero knowledge proof technology, so that the privacy protection level of the equipment is greatly improved, and information disclosure and identity forging are prevented.
Referring to fig. 2, a block diagram of a hierarchical authentication system for a power system based on blockchain and zero knowledge proof of the present application is shown.
As shown in fig. 2, the power system hierarchical authentication system 200 includes a processing module 210, a first verification module 220, and a second verification module 230.
Wherein the processing module 210 is configured to, when the deviceWhen a communication across trust domains is required, the deviceApparatus for installingIs the first pseudo-identity of (2)Initiated request informationComposing a request across trust domainsThen the deviceWill request across trust domainsSending to a CPS (central processing system) which is according to the equipmentRequest information of (a)Selecting one and requesting informationDevices in corresponding domainsIs the second pseudo-identity of (2)Reuse of the second pseudo-identityForm a replyAnd send a replyFeeding device;
A first authentication module 220 configured as a deviceAccording to the received replySecond pseudo-identity in (a)Apparatus for connectingIs the first pseudo-identity of (2)And request information to be communicatedComposing an authentication requestAnd request authenticationBy a second pseudo-identityTransmitting to a deviceApparatus and methodAccording to receiving the authentication requestFirst pseudo-identity in (a)Extracting registration tuples from corresponding nodes on a blockchainThen the deviceFor the first pseudo-identityZero knowledge proof authentication and deviceIs a first authentication key of (a)Apparatus and method for controlling the operation of a machineIs disclosed in (1)Apparatus and deviceFirst zero knowledge proof of (2)Inputting the first verification result into verification algorithm Verify, and obtaining the first verification result through the verification algorithm VerifyWhen the obtained first verification resultTime display deviceVerification is successful, in contrast, when the obtained first verification resultTime display deviceVerification fails;
a second authentication module 230 configured as a device Authentication success deviceAfter that, the deviceSending a reply authentication replyFeeding deviceApparatus and methodReceipt of an authentication replyThen according to the second pseudo identityExtracting registration tuples from corresponding nodes on a blockchainThen the deviceWill be against a second pseudo-identityZero knowledge proof authentication and deviceIs a second authentication key of (2)Apparatus and method for controlling the operation of a machineSecond publication of (2)Apparatus and deviceSecond zero knowledge proof of (2)Inputting the second verification result into verification algorithm Verify, and obtaining a second verification result through the verification algorithm VerifyWhen the second verification result is obtainedTime display deviceVerification is successful, in contrast, when the second verification result is obtainedTime display deviceThe verification fails.
It should be understood that the modules depicted in fig. 2 correspond to the various steps in the method described with reference to fig. 1. Thus, the operations and features described above for the method and the corresponding technical effects are equally applicable to the modules in fig. 2, and are not described here again.
In other embodiments, embodiments of the present invention further provide a computer readable storage medium having stored thereon a computer program, the program instructions, when executed by a processor, cause the processor to perform the blockchain and zero knowledge proof based power system hierarchical authentication method of any of the method embodiments described above;
As one embodiment, the computer-readable storage medium of the present invention stores computer-executable instructions configured to:
When the device When a communication across trust domains is required, the deviceApparatus for installingIs the first pseudo-identity of (2)Initiated request informationComposing a request across trust domainsThen the deviceWill request across trust domainsSending to a CPS (central processing system) which is according to the equipmentRequest information of (a)Selecting one and requesting informationDevices in corresponding domainsIs the second pseudo-identity of (2)Reuse of the second pseudo-identityForm a replyAnd send a replyFeeding device;
Apparatus and method for controlling the operation of a deviceAccording to the received replySecond pseudo-identity in (a)Apparatus for connectingIs the first pseudo-identity of (2)And request information to be communicatedComposing an authentication requestAnd request authenticationBy a second pseudo-identityTransmitting to a deviceApparatus and methodAccording to receiving the authentication requestFirst pseudo-identity in (a)Extracting registration tuples from corresponding nodes on a blockchainThen the deviceFor the first pseudo-identityZero knowledge proof authentication and deviceIs a first authentication key of (a)Apparatus and method for controlling the operation of a machineIs disclosed in (1)Apparatus and deviceFirst zero knowledge proof of (2)Inputting the first verification result into verification algorithm Verify, and obtaining the first verification result through the verification algorithm VerifyWhen the obtained first verification resultTime display deviceVerification is successful, in contrast, when the obtained first verification resultTime display deviceVerification fails;
Apparatus and method for controlling the operation of a device Authentication success deviceAfter that, the deviceSending a reply authentication replyFeeding deviceApparatus and methodReceipt of an authentication replyThen according to the second pseudo identityExtracting registration tuples from corresponding nodes on a blockchainThen the deviceWill be against a second pseudo-identityZero knowledge proof authentication and deviceIs a second authentication key of (2)Apparatus and method for controlling the operation of a machineSecond publication of (2)Apparatus and deviceSecond zero knowledge proof of (2)Inputting the second verification result into verification algorithm Verify, and obtaining a second verification result through the verification algorithm VerifyWhen the second verification result is obtainedTime display deviceVerification is successful, in contrast, when the second verification result is obtainedTime display deviceThe verification fails.
The computer readable storage medium may include a storage program area that may store an operating system, an application required for at least one function, and a storage data area that may store data created from use of a power system hierarchical authentication system based on blockchain and zero knowledge proof, etc. In addition, the computer-readable storage medium may include high-speed random access memory, and may also include memory, such as at least one magnetic disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, the computer readable storage medium optionally includes a memory remotely located with respect to the processor, the remote memory connectable over a network to a power system hierarchical authentication system based on blockchain and zero knowledge proof. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.
Fig. 3 is a schematic structural diagram of an electronic device according to an embodiment of the present invention, and as shown in fig. 3, the device includes a processor 310 and a memory 320. The electronic device may further comprise input means 330 and output means 340. The processor 310, memory 320, input device 330, and output device 340 may be connected by a bus or other means, for example in fig. 3. Memory 320 is the computer-readable storage medium described above. The processor 310 executes various functional applications of the server and data processing by running non-volatile software programs, instructions and modules stored in the memory 320, i.e., implements the blockchain and zero knowledge proof-based power system hierarchical authentication method of the above-described method embodiments. The input device 330 may receive input numeric or character information and generate key signal inputs related to user settings and function control of the power system hierarchical authentication system based on blockchain and zero knowledge proof. The output device 340 may include a display device such as a display screen.
The electronic equipment can execute the method provided by the embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method. Technical details not described in detail in this embodiment may be found in the methods provided in the embodiments of the present invention.
As one embodiment, the electronic device is applied to a hierarchical authentication system of a power system based on blockchain and zero knowledge proof and used for a client, and comprises at least one processor and a memory in communication connection with the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to:
When the device When a communication across trust domains is required, the deviceApparatus for installingIs the first pseudo-identity of (2)Initiated request informationComposing a request across trust domainsThen the deviceWill request across trust domainsSending to a CPS (central processing system) which is according to the equipmentRequest information of (a)Selecting one and requesting informationDevices in corresponding domainsIs the second pseudo-identity of (2)Reuse of the second pseudo-identityForm a replyAnd send a replyFeeding device;
Apparatus and method for controlling the operation of a deviceAccording to the received replySecond pseudo-identity in (a)Apparatus for connectingIs the first pseudo-identity of (2)And request information to be communicatedComposing an authentication requestAnd request authenticationBy a second pseudo-identityTransmitting to a deviceApparatus and methodAccording to receiving the authentication requestFirst pseudo-identity in (a)Extracting registration tuples from corresponding nodes on a blockchainThen the deviceFor the first pseudo-identityZero knowledge proof authentication and deviceIs a first authentication key of (a)Apparatus and method for controlling the operation of a machineIs disclosed in (1)Apparatus and deviceFirst zero knowledge proof of (2)Inputting the first verification result into verification algorithm Verify, and obtaining the first verification result through the verification algorithm VerifyWhen the obtained first verification resultTime display deviceVerification is successful, in contrast, when the obtained first verification resultTime display deviceVerification fails;
Apparatus and method for controlling the operation of a device Authentication success deviceAfter that, the deviceSending a reply authentication replyFeeding deviceApparatus and methodReceipt of an authentication replyThen according to the second pseudo identityExtracting registration tuples from corresponding nodes on a blockchainThen the deviceWill be against a second pseudo-identityZero knowledge proof authentication and deviceIs a second authentication key of (2)Apparatus and method for controlling the operation of a machineSecond publication of (2)Apparatus and deviceSecond zero knowledge proof of (2)Inputting the second verification result into verification algorithm Verify, and obtaining a second verification result through the verification algorithm VerifyWhen the second verification result is obtainedTime display deviceVerification is successful, in contrast, when the second verification result is obtainedTime display deviceThe verification fails.
From the above description of the embodiments, it will be apparent to those skilled in the art that the embodiments may be implemented by means of software plus necessary general hardware platforms, or of course may be implemented by means of hardware. Based on such understanding, the foregoing technical solutions may be embodied essentially or in part in the form of a software product, which may be stored in a computer-readable storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the various embodiments or methods of some parts of the embodiments.
It should be noted that the above-mentioned embodiments are merely for illustrating the technical solution of the present invention, and not for limiting the same, and although the present invention has been described in detail with reference to the above-mentioned embodiments, it should be understood by those skilled in the art that the technical solution described in the above-mentioned embodiments may be modified or some technical features may be equivalently replaced, and these modifications or substitutions do not make the essence of the corresponding technical solution deviate from the spirit and scope of the technical solution of the embodiments of the present invention.