WO2022143498A1 - 接入控制方法、装置、网络侧设备、终端及区块链节点 - Google Patents
接入控制方法、装置、网络侧设备、终端及区块链节点 Download PDFInfo
- Publication number
- WO2022143498A1 WO2022143498A1 PCT/CN2021/141520 CN2021141520W WO2022143498A1 WO 2022143498 A1 WO2022143498 A1 WO 2022143498A1 CN 2021141520 W CN2021141520 W CN 2021141520W WO 2022143498 A1 WO2022143498 A1 WO 2022143498A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- information
- terminal
- public key
- authentication
- preset
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 151
- 238000012795 verification Methods 0.000 claims abstract description 84
- 230000004044 response Effects 0.000 claims abstract description 55
- 238000010586 diagram Methods 0.000 description 17
- 230000000694 effects Effects 0.000 description 16
- 238000012545 processing Methods 0.000 description 13
- 230000006870 function Effects 0.000 description 8
- 230000008569 process Effects 0.000 description 8
- 238000013475 authorization Methods 0.000 description 5
- 238000005516 engineering process Methods 0.000 description 4
- 238000004891 communication Methods 0.000 description 3
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 238000010200 validation analysis Methods 0.000 description 3
- 238000003491 array Methods 0.000 description 2
- 230000000977 initiatory effect Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- KLDZYURQCUYZBL-UHFFFAOYSA-N 2-[3-[(2-hydroxyphenyl)methylideneamino]propyliminomethyl]phenol Chemical compound OC1=CC=CC=C1C=NCCCN=CC1=CC=CC=C1O KLDZYURQCUYZBL-UHFFFAOYSA-N 0.000 description 1
- 108010001267 Protein Subunits Proteins 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 201000001098 delayed sleep phase syndrome Diseases 0.000 description 1
- 208000033921 delayed sleep phase type circadian rhythm sleep disease Diseases 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 239000000284 extract Substances 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
- H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/12—Applying verification of the received information
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1458—Denial of Service
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/10—Protocols in which an application is distributed across nodes in the network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
- H04L2463/121—Timestamp
Definitions
- the present disclosure relates to the field of communication technologies, and in particular, to an access control method, an apparatus, a network side device, a terminal, and a blockchain node.
- Access control refers to the means by which the system restricts the user's ability to use data resources on the user's identity and the policy group to which it belongs. Access control is an important basis for system confidentiality, integrity, availability, and legal use, and is one of the key strategies for network security and resource protection. Authorized access.
- the main purpose of access control is to limit the access of the access subject to the object, so as to ensure the effective use and management of data resources within the legal scope.
- a system administrator controls user access to network resources such as servers, directories, and files.
- access control needs to complete two tasks: identifying and confirming the user accessing the system, and determining what type of access the user can perform to a certain system resource.
- the access control function can be implemented in the object, or a centralized device can be deployed to implement access control.
- the access subject initiates a request to the centralized access control system. After authentication and authorization, the access subject initiates access to the object.
- the access control system is a centralized device; however, it is exposed to the network and is vulnerable to network attacks such as Distributed Denial of Service (DDoS). Once the controller is attacked by the network to stop the service, it may cause the whole system to fail to operate normally.
- DDoS Distributed Denial of Service
- the purpose of the present disclosure is to provide an access control method, device, network-side device, terminal and blockchain node, so as to solve the problem in the related art that the traditional authentication server suffers from DDoS attacks and causes a single point of failure.
- an embodiment of the present disclosure provides an access control method, which is applied to a first network side device, including:
- the relevant information to be verified includes the private key signature information of the terminal and the location information of the preset information in the blockchain;
- the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
- the relevant information to be verified corresponding to the access request sent by the receiving terminal includes:
- the verifying the terminal according to the private key signature information and the preset information includes:
- the attribute information of the terminal is obtained from the blockchain ledger, including:
- the attribute information corresponding to the identification information of the third terminal is obtained from the blockchain ledger as the attribute information of the terminal.
- the verifying the terminal according to the private key signature information and the preset information includes:
- the first terminal identification information obtain the public key information to be verified and obtain the stored public key information of the terminal from the blockchain ledger;
- the attribute information of the terminal is obtained from the blockchain ledger according to the preset information, including:
- the attribute information of the terminal is obtained from the blockchain ledger according to the identification information of the first terminal.
- the verification of the terminal according to the private key signature information and the preset information includes: :
- the terminal is executed according to the private key signature information and the preset information.
- Validation including:
- the identification information of the second terminal obtain the stored public key information of the terminal from the blockchain ledger;
- the private key signature information is verified according to the public key information to be verified; and the public key information to be verified is verified according to the acquired public key information of the terminal.
- the attribute information of the terminal is obtained from the blockchain ledger according to the preset information, including:
- the attribute information of the terminal is obtained from the blockchain ledger according to the identification information of the second terminal.
- the private key signature information includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
- the second signature information of the random number includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
- the relevant information to be verified further includes the timestamp
- the verifying the terminal according to the private key signature information and the preset information includes:
- the terminal is verified according to the private key signature information and the preset information.
- the preset information further includes validity period information of the first information; the first information includes at least one of the attribute information, the first terminal identification information and the second terminal identification information;
- the verifying the terminal according to the private key signature information and the preset information includes:
- the validity period information confirm whether the first information is within the validity period
- the terminal is verified according to the private key signature information and other information in the preset information except the validity period information.
- At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes using the first network side device. the first key encrypted by the public key;
- the method Before feeding back a request response for access control to the terminal according to the attribute information, the method further includes:
- the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information irrelevant to the public key of the terminal, or identification information related to the terminal.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
- the time stamp is a time stamp obtained by signing with the private key of the terminal to obtain the first signature information
- the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
- the embodiments of the present disclosure also provide an access control method, which is applied to a terminal, including:
- the relevant information to be verified includes the private key signature information of the terminal and the location information of the preset information in the blockchain;
- the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
- the sending the relevant information to be verified corresponding to the access request to the first network side device includes:
- the relevant information to be verified is sent to the first network side device.
- the private key signature information includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
- the second signature information of the random number includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
- the relevant information to be verified further includes the timestamp.
- the preset information further includes validity period information of the first information; the first information includes at least one of attribute information of the terminal, identification information of the first terminal, and identification information of the second terminal. item.
- At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes public information using the first network side device. the first key encrypted by the key;
- the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information irrelevant to the public key of the terminal, or identification information related to the terminal.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
- the time stamp is a time stamp obtained by signing with the private key of the terminal to obtain the first signature information
- the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
- the method before sending the relevant information to be verified corresponding to the access request to the first network-side device, the method further includes:
- the to-be-authenticated information includes user credential information and/or attribute information; the user credential information includes terminal identification information.
- Embodiments of the present disclosure also provide an access control method, which is applied to the first blockchain node, including:
- At least one authentication information corresponding to the information to be authenticated is stored in the blockchain ledger;
- the to-be-authenticated information includes user credential information and/or attribute information;
- the user credential information includes terminal identification information;
- the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, or identification information related to the terminal.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
- the time stamp is a time stamp obtained by signing with the private key of the terminal to obtain the first signature information
- the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
- At least one authentication information corresponding to the to-be-authenticated information is stored in the blockchain ledger, including:
- the at least one authentication information is encrypted using the first key and stored in the blockchain ledger.
- the method further includes:
- the first key is encrypted with the public key of the terminal and stored in the blockchain ledger.
- the performing authentication on the information to be authenticated includes:
- the first preset policy send the user credential information in the to-be-authenticated information to at least one second network-side device for authentication;
- the first authentication result and the third signature information a first final result of whether the authentication of the user credential information is passed is obtained.
- the performing authentication on the information to be authenticated includes:
- the attribute information in the information to be authenticated is sent to at least one third network-side device for authentication;
- the second authentication result and the fourth signature information a second final result of whether the attribute information is authenticated is obtained.
- the performing authentication on the to-be-authenticated information includes:
- Embodiments of the present disclosure also provide an access control method, which is applied to a second blockchain node, including:
- the user credential information includes terminal identification information.
- the embodiment of the present disclosure also provides an access control method, which is applied to the second network side device, including:
- the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node;
- the user credential information includes terminal identification information.
- the embodiments of the present disclosure also provide an access control method, which is applied to a third network side device, including:
- the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node.
- the embodiment of the present disclosure further provides an access control apparatus, which is applied to the first network side device, including:
- the first receiving module is configured to receive the relevant information to be verified corresponding to the access request sent by the terminal; wherein, the relevant information to be verified includes the private key signature information of the terminal and the location information of the preset information in the blockchain ;
- a first obtaining module configured to obtain the preset information from the blockchain according to the location information
- a first verification module configured to verify the terminal according to the private key signature information and the preset information
- the second receiving module is configured to obtain the attribute information of the terminal from the blockchain ledger according to the preset information when the verification is passed;
- a first feedback module configured to feed back a request response for access control to the terminal according to the attribute information
- the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
- the relevant information to be verified corresponding to the access request sent by the receiving terminal includes:
- the verifying the terminal according to the private key signature information and the preset information includes:
- the attribute information of the terminal is obtained from the blockchain ledger according to the preset information, including:
- the attribute information corresponding to the identification information of the third terminal is obtained from the blockchain ledger as the attribute information of the terminal.
- the verifying the terminal according to the private key signature information and the preset information includes:
- the first terminal identification information obtain the public key information to be verified and obtain the stored public key information of the terminal from the blockchain ledger;
- the attribute information of the terminal is obtained from the blockchain ledger according to the preset information, including:
- the attribute information of the terminal is obtained from the blockchain ledger according to the identification information of the first terminal.
- the verification of the terminal according to the private key signature information and the preset information includes: :
- the terminal is executed according to the private key signature information and the preset information.
- Validation including:
- the identification information of the second terminal obtain the stored public key information of the terminal from the blockchain ledger;
- the private key signature information is verified according to the public key information to be verified; and the public key information to be verified is verified according to the acquired public key information of the terminal.
- the attribute information of the terminal is obtained from the blockchain ledger according to the preset information, including:
- the attribute information of the terminal is obtained from the blockchain ledger according to the identification information of the second terminal.
- the private key signature information includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
- the second signature information of the random number includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
- the relevant information to be verified further includes the timestamp
- the verifying the terminal according to the private key signature information and the preset information includes:
- the terminal is verified according to the private key signature information and the preset information.
- the preset information further includes validity period information of the first information; the first information includes at least one of the attribute information, the first terminal identification information and the second terminal identification information;
- the verifying the terminal according to the private key signature information and the preset information includes:
- the validity period information confirm whether the first information is within the validity period
- the terminal is verified according to the private key signature information and other information in the preset information except the validity period information.
- At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes using the first network side device. the first key encrypted by the public key;
- the access control device further includes:
- a first decryption module configured to use the private key of the first network-side device to encrypt the first decryption with the public key before feeding back a request response for access control to the terminal according to the attribute information. decrypting the key to obtain the first key;
- a second decryption module configured to decrypt the encrypted information obtained from the blockchain ledger according to the first key to obtain the at least one authentication information
- the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information irrelevant to the public key of the terminal, or identification information related to the terminal.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
- the time stamp is a time stamp using the private key of the terminal to sign to obtain the first signature information
- the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
- the embodiments of the present disclosure also provide an access control apparatus, which is applied to a terminal, including:
- a first sending module configured to send the relevant information to be verified corresponding to the access request to the first network side device; wherein the relevant information to be verified includes the private key signature information of the terminal and preset information in the blockchain location information;
- a third receiving module configured to receive a request response for access control fed back by the first network-side device
- the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
- the sending the relevant information to be verified corresponding to the access request to the first network side device includes:
- the relevant information to be verified is sent to the first network side device.
- the private key signature information includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
- the second signature information of the random number includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
- the relevant information to be verified further includes the timestamp.
- the preset information further includes validity period information of the first information; the first information includes at least one of attribute information of the terminal, identification information of the first terminal, and identification information of the second terminal. item.
- At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes public information using the first network side device. the first key encrypted by the key;
- the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information irrelevant to the public key of the terminal, or identification information related to the terminal.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
- the time stamp is a time stamp obtained by signing with the private key of the terminal to obtain the first signature information
- the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
- a second sending module configured to send the to-be-authenticated information of the terminal to the first blockchain node before sending the to-be-verified related information corresponding to the access request to the first network-side device;
- the to-be-authenticated information includes user credential information and/or attribute information; the user credential information includes terminal identification information.
- Embodiments of the present disclosure also provide an access control device, which is applied to the first blockchain node, including:
- a fourth receiving module configured to receive the information to be authenticated sent by the terminal
- a first authentication module configured to authenticate the information to be authenticated
- a first storage module configured to store at least one authentication information corresponding to the information to be authenticated in the blockchain ledger when the authentication is passed;
- the to-be-authenticated information includes user credential information and/or attribute information;
- the user credential information includes terminal identification information;
- the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, or identification information related to the terminal.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
- the time stamp is a time stamp obtained by signing with the private key of the terminal to obtain the first signature information
- the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
- At least one authentication information corresponding to the to-be-authenticated information is stored in the blockchain ledger, including:
- the at least one authentication information is encrypted using the first key and stored in the blockchain ledger.
- the first processing module is configured to encrypt the first key with the public key of the terminal after randomly generating the first key for encryption, and store the first key in the blockchain ledger.
- the performing authentication on the information to be authenticated includes:
- the first preset policy send the user credential information in the to-be-authenticated information to at least one second network-side device for authentication;
- the first authentication result and the third signature information a first final result of whether the authentication of the user credential information is passed is obtained.
- the performing authentication on the information to be authenticated includes:
- the attribute information in the information to be authenticated is sent to at least one third network-side device for authentication;
- the second authentication result and the fourth signature information a second final result of whether the attribute information is authenticated is obtained.
- the performing authentication on the information to be authenticated includes:
- Embodiments of the present disclosure also provide an access control device, which is applied to a second blockchain node, including:
- a fifth receiving module configured to receive the information to be authenticated of the terminal sent by the first blockchain node
- the second processing module is configured to send the user credential information in the information to be authenticated to at least one second network side device for authentication, and receive the first authentication result fed back by the at least one second network side device and the corresponding third signature information, fed back to the first blockchain node; and/or,
- a third processing module configured to send the attribute information in the information to be authenticated to at least one third network-side device for authentication, and receive the second authentication result fed back by the at least one third network-side device and the corresponding first authentication result.
- Four signature information which is fed back to the first blockchain node;
- the user credential information includes terminal identification information.
- An embodiment of the present disclosure further provides an access control apparatus, which is applied to a second network side device, including:
- the sixth receiving module is used to receive the user credential information of the terminal to be authenticated sent by the blockchain node;
- a fourth processing module configured to authenticate the user credential information, obtain a first authentication result, and sign with the third signature information
- a second feedback module configured to feed back the first authentication result and the third signature information to the blockchain node
- the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node;
- the user credential information includes terminal identification information.
- An embodiment of the present disclosure further provides an access control apparatus, which is applied to a third network side device, including:
- a seventh receiving module configured to receive the attribute information of the terminal to be authenticated sent by the blockchain node
- a fifth processing module configured to authenticate the attribute information, obtain a second authentication result, and use the fourth signature information to sign
- a third feedback module configured to feed back the second authentication result and the fourth signature information to the blockchain node
- the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node.
- An embodiment of the present disclosure further provides a network side device, where the network side device is a first network side device, including: a processor and a transceiver;
- the processor is configured to receive the relevant information to be verified corresponding to the access request sent by the terminal through the transceiver; wherein, the relevant information to be verified includes the private key signature information of the terminal and the preset information in the block. location information in the chain;
- the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
- the relevant information to be verified corresponding to the access request sent by the receiving terminal includes:
- the verifying the terminal according to the private key signature information and the preset information includes:
- the attribute information of the terminal is obtained from the blockchain ledger according to the preset information, including:
- the attribute information corresponding to the identification information of the third terminal is obtained from the blockchain ledger as the attribute information of the terminal.
- the verifying the terminal according to the private key signature information and the preset information includes:
- the first terminal identification information obtain the public key information to be verified and obtain the stored public key information of the terminal from the blockchain ledger;
- the attribute information of the terminal is obtained from the blockchain ledger according to the preset information, including:
- the attribute information of the terminal is obtained from the blockchain ledger according to the identification information of the first terminal.
- the verification of the terminal according to the private key signature information and the preset information includes: :
- the terminal is executed according to the private key signature information and the preset information.
- Validation including:
- the identification information of the second terminal obtain the stored public key information of the terminal from the blockchain ledger;
- the private key signature information is verified according to the public key information to be verified; and the public key information to be verified is verified according to the acquired public key information of the terminal.
- the attribute information of the terminal is obtained from the blockchain ledger according to the preset information, including:
- the attribute information of the terminal is obtained from the blockchain ledger according to the identification information of the second terminal.
- the private key signature information includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
- the second signature information of the random number includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
- the relevant information to be verified further includes the timestamp
- the verifying the terminal according to the private key signature information and the preset information includes:
- the terminal is verified according to the private key signature information and the preset information.
- the preset information further includes validity period information of the first information; the first information includes at least one of the attribute information, the first terminal identification information and the second terminal identification information;
- the verifying the terminal according to the private key signature information and the preset information includes:
- the validity period information confirm whether the first information is within the validity period
- the terminal is verified according to the private key signature information and other information in the preset information except the validity period information.
- At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes using the first network side device. the first key encrypted by the public key;
- the processor is also used to:
- the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information irrelevant to the public key of the terminal, or identification information related to the terminal.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
- the time stamp is a time stamp obtained by signing with the private key of the terminal to obtain the first signature information
- the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
- An embodiment of the present disclosure also provides a terminal, including: a processor and a transceiver;
- the processor is configured to send the relevant information to be verified corresponding to the access request to the first network side device through the transceiver; wherein the relevant information to be verified includes the private key signature information and preset information of the terminal Location information in the blockchain;
- the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
- the sending the relevant information to be verified corresponding to the access request to the first network side device includes:
- the relevant information to be verified is sent to the first network side device.
- the private key signature information includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
- the second signature information of the random number includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
- the relevant information to be verified further includes the timestamp.
- the preset information further includes validity period information of the first information; the first information includes at least one of attribute information of the terminal, identification information of the first terminal, and identification information of the second terminal. item.
- At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes public information using the first network side device. the first key encrypted by the key;
- the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information irrelevant to the public key of the terminal, or identification information related to the terminal.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
- the time stamp is a time stamp obtained by signing with the private key of the terminal to obtain the first signature information
- the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
- the processor is also used for:
- the to-be-authenticated information includes user credential information and/or attribute information; the user credential information includes terminal identification information.
- Embodiments of the present disclosure also provide a blockchain node, where the blockchain node is a first blockchain node, including: a processor and a transceiver;
- the processor configured to receive the information to be authenticated sent by the terminal through the transceiver;
- At least one authentication information corresponding to the information to be authenticated is stored in the blockchain ledger;
- the to-be-authenticated information includes user credential information and/or attribute information;
- the user credential information includes terminal identification information;
- the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, or identification information related to the terminal.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
- the time stamp is a time stamp obtained by signing with the private key of the terminal to obtain the first signature information
- the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
- At least one authentication information corresponding to the to-be-authenticated information is stored in the blockchain ledger, including:
- the at least one authentication information is encrypted using the first key and stored in the blockchain ledger.
- the processor is also used for:
- the first key for encryption is randomly generated, the first key is encrypted with the public key of the terminal and stored in the blockchain ledger.
- the performing authentication on the information to be authenticated includes:
- the first preset policy send the user credential information in the to-be-authenticated information to at least one second network-side device for authentication;
- the first authentication result and the third signature information a first final result of whether the authentication of the user credential information is passed is obtained.
- the performing authentication on the information to be authenticated includes:
- the attribute information in the information to be authenticated is sent to at least one third network-side device for authentication;
- the second authentication result and the fourth signature information a second final result of whether the attribute information is authenticated is obtained.
- the performing authentication on the information to be authenticated includes:
- Embodiments of the present disclosure also provide a blockchain node, where the blockchain node is a second blockchain node, including: a processor and a transceiver;
- the processor configured to receive the information to be authenticated of the terminal sent by the first blockchain node through the transceiver;
- the transceiver sends the user credential information in the information to be authenticated to at least one second network-side device for authentication, and receives the first authentication result and the corresponding third authentication result fed back by the at least one second network-side device.
- signature information which is fed back to the first blockchain node; and/or,
- the transceiver sends the attribute information in the information to be authenticated to at least one third network side device for authentication, and receives the second authentication result and the corresponding fourth signature fed back by the at least one third network side device information, which is fed back to the first blockchain node;
- the user credential information includes terminal identification information.
- An embodiment of the present disclosure further provides a network side device, where the network side device is a second network side device, including: a processor and a transceiver;
- the processor configured to receive, through the transceiver, the user credential information of the terminal to be authenticated sent by the blockchain node;
- the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node;
- the user credential information includes terminal identification information.
- An embodiment of the present disclosure further provides a network side device, where the network side device is a third network side device, including: a processor and a transceiver;
- the processor configured to receive, through the transceiver, attribute information of the terminal to be authenticated sent by the blockchain node;
- the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node.
- An embodiment of the present disclosure further provides a network-side device, including a memory, a processor, and a program stored in the memory and running on the processor; the processor implements the first above-mentioned first when executing the program. an access control method on the network side device side; or, when the processor executes the program, implements the above-mentioned second access control method on the network side device side; or, when the processor executes the program, implements the above-mentioned third method An access control method on the network side device side.
- An embodiment of the present disclosure further provides a terminal, including a memory, a processor, and a program stored in the memory and running on the processor; when the processor executes the program, the above-mentioned connection on the terminal side is implemented. access control method.
- Embodiments of the present disclosure further provide a blockchain node, including a memory, a processor, and a program stored on the memory and executable on the processor; when the processor executes the program, the above-mentioned first step is implemented.
- An embodiment of the present disclosure further provides a readable storage medium, on which a program is stored, and when the program is executed by a processor, implements the steps in the above-mentioned access control method on the device side of the first network side; or, the program is processed When executed by the processor, the steps in the access control method on the terminal side are implemented; or, when the program is executed by the processor, the steps in the access control method on the first blockchain node side are implemented; or, the program is executed by the processor.
- the access control method receives the relevant information to be verified corresponding to the access request sent by the terminal; wherein, the relevant information to be verified includes the private key signature information of the terminal and the preset information in the blockchain.
- the preset information is obtained from the blockchain; according to the private key signature information and the preset information, the terminal is verified; if the verification is passed , according to the preset information, obtain the attribute information of the terminal from the blockchain ledger; according to the attribute information, feed back a request response for access control to the terminal; wherein, the preset information includes all public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal and public key information of the terminal, or the The second terminal identification information and the hash value of the public key of the terminal; can support the implementation of the access control scheme using the blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid similar traditional authentication.
- the server suffers from a single point of failure caused by
- FIG. 1 is a schematic flowchart 1 of an access control method according to an embodiment of the present disclosure
- FIG. 2 is a second schematic flowchart of an access control method according to an embodiment of the present disclosure
- FIG. 3 is a third schematic flowchart of an access control method according to an embodiment of the present disclosure.
- FIG. 4 is a fourth schematic flowchart of an access control method according to an embodiment of the present disclosure.
- FIG. 5 is a fifth schematic flowchart of an access control method according to an embodiment of the present disclosure.
- FIG. 6 is a sixth schematic flowchart of an access control method according to an embodiment of the present disclosure.
- FIG. 7 is a schematic diagram of an implementation architecture of an access control method according to an embodiment of the present disclosure.
- FIG. 8a is a schematic diagram 1 of a specific implementation flow of an access control method according to an embodiment of the present disclosure
- FIG. 8b is a schematic diagram 2 of a specific implementation flow of the access control method according to the embodiment of the present disclosure.
- FIG. 9 is a schematic diagram 1 of an authentication architecture for information to be authenticated according to an embodiment of the present disclosure.
- FIG. 10 is a second schematic diagram of an authentication architecture for information to be authenticated according to an embodiment of the present disclosure
- FIG. 11 is a schematic structural diagram 1 of an access control apparatus according to an embodiment of the present disclosure.
- FIG. 12 is a second schematic structural diagram of an access control apparatus according to an embodiment of the present disclosure.
- FIG. 13 is a third schematic structural diagram of an access control apparatus according to an embodiment of the present disclosure.
- FIG. 14 is a fourth schematic structural diagram of an access control apparatus according to an embodiment of the present disclosure.
- FIG. 15 is a fifth schematic structural diagram of an access control apparatus according to an embodiment of the present disclosure.
- 16 is a sixth schematic structural diagram of an access control apparatus according to an embodiment of the present disclosure.
- FIG. 17 is a schematic structural diagram 1 of a network side device according to an embodiment of the present disclosure.
- FIG. 18 is a schematic structural diagram of a terminal according to an embodiment of the present disclosure.
- FIG. 19 is a schematic diagram 1 of a blockchain node structure according to an embodiment of the disclosure.
- FIG. 20 is a second schematic diagram of a block chain node structure according to an embodiment of the disclosure.
- FIG. 21 is a second schematic structural diagram of a network side device according to an embodiment of the present disclosure.
- FIG. 22 is a third schematic structural diagram of a network side device according to an embodiment of the present disclosure.
- the present disclosure provides an access control method, which is applied to a first network side device, as shown in FIG. 1 , including:
- Step 11 Receive the relevant information to be verified corresponding to the access request sent by the terminal; wherein, the relevant information to be verified includes the private key signature information of the terminal and the location information of the preset information in the blockchain;
- Step 12 Obtain the preset information from the blockchain according to the location information
- Step 13 Verify the terminal according to the private key signature information and the preset information
- Step 14 in the case of passing the verification, obtain the attribute information of the terminal from the blockchain ledger according to the preset information;
- Step 15 Feed back a request response for access control to the terminal according to the attribute information; wherein the preset information includes the public key information of the terminal, or the first information obtained according to the public key of the terminal.
- step 15 may be to feed back a request response for access control to the terminal according to the attribute information and the terminal identification information;
- the terminal identification information may be the above-mentioned first terminal identification information and second terminal identification information or third terminal identification information.
- the access control method provided by the embodiment of the present disclosure receives the relevant information to be verified corresponding to the access request sent by the terminal; wherein, the relevant information to be verified includes the private key signature information of the terminal and the preset information in the area location information in the blockchain; obtain the preset information from the blockchain according to the location information; verify the terminal according to the private key signature information and the preset information; In this case, according to the preset information, the attribute information of the terminal is obtained from the blockchain ledger; according to the attribute information, a request response for access control is fed back to the terminal; wherein the preset information It includes the public key information of the terminal, or the first terminal identification information obtained according to the public key of the terminal, or the second terminal identification information unrelated to the public key of the terminal and the public key information of the terminal, or The identification information of the second terminal and the hash value of the public key of the terminal can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid similar
- the traditional authentication server suffers from the single
- the receiving the relevant information to be verified corresponding to the access request sent by the terminal includes: receiving the access request sent by the terminal, where the access request carries the relevant information to be verified; or, receiving the access request sent by the terminal ; feeding back a random number to the terminal according to the access request; and receiving the relevant information to be verified sent by the terminal according to the random number.
- the verifying the terminal according to the private key signature information and the preset information includes: using The public key information verifies the private key signature information; in the case of passing the verification, obtaining the attribute information of the terminal from the blockchain ledger according to the preset information, including: in the case of passing the verification In the case of , obtain the corresponding third terminal identification information from the blockchain ledger according to the public key information; in the case of obtaining the third terminal identification information, obtain the third terminal identification information from the blockchain ledger
- the attribute information corresponding to the three terminal identification information is used as the attribute information of the terminal.
- the feeding back a request response for access control to the terminal according to the attribute information may include: feeding back a request response for access control to the terminal according to the third terminal identification information and attribute information .
- the verifying the terminal according to the private key signature information and the preset information includes: according to The first terminal identification information obtains the public key information to be verified and the stored public key information of the terminal from the blockchain ledger; according to the public key information of the terminal, the public key information to be verified is obtained.
- the key information and the private key signature information are verified; in the case of passing the verification, obtaining the attribute information of the terminal from the blockchain ledger according to the preset information, including: in the case of passing the verification , and obtain attribute information of the terminal from the blockchain ledger according to the first terminal identification information.
- the feeding back a request response for access control to the terminal according to the attribute information includes: feeding back a request response for access control to the terminal according to the first terminal identification information and attribute information.
- the terminal when the preset information includes the identification information of the second terminal and the public key information, the terminal is verified according to the private key signature information and the preset information. , including: using the public key information in the preset information to verify the private key signature information; and obtaining the stored public key of the terminal from the blockchain ledger according to the second terminal identification information information; verify the public key information in the preset information according to the acquired public key information of the terminal; or verify the private key signature information by using the public key information in the preset information; and obtain the stored hash value of the public key of the terminal from the blockchain ledger according to the identification information of the second terminal; obtain the hash value to be verified according to the public key information in the preset information ; Verify the hash value to be verified according to the obtained hash value of the public key of the terminal.
- the terminal is verified according to the private key signature information and the preset information
- the method includes: obtaining the stored public key information of the terminal from the blockchain ledger according to the identification information of the second terminal; obtaining the public key to be verified according to the hash value of the public key in the preset information information; verifying the private key signature information according to the public key information to be verified; and verifying the public key information to be verified according to the acquired public key information of the terminal.
- obtaining the attribute information of the terminal from the blockchain ledger according to the preset information includes: in the case of passing the verification, according to the second Terminal identification information, the attribute information of the terminal is obtained from the blockchain ledger.
- the feeding back a request response for access control to the terminal according to the attribute information includes: feeding back a request response for access control to the terminal according to the second terminal identification information and attribute information.
- the private key signature information includes first signature information using the terminal's private key to the timestamp, or, using the terminal's private key to respond to the access request for the first network-side device The second signature information of the random number sent.
- the relevant information to be verified further includes the timestamp; the The verification by the terminal includes: confirming whether the timestamp is within the validity period; and in the case that the timestamp is within the validity period, verifying the terminal according to the private key signature information and the preset information.
- whether the timestamp is within the validity period may be determined according to the timestamp itself, but it is not limited thereto.
- the preset information further includes validity period information of the first information; the first information includes at least one of the attribute information, the first terminal identification information, and the second terminal identification information item; the verifying the terminal according to the private key signature information and the preset information includes: confirming, according to the validity period information, whether the first information is within the validity period; In the case of being within the validity period, the terminal is verified according to the private key signature information and other information in the preset information except the validity period information.
- Regarding "confirming whether the first information is within the validity period according to the validity period information” may specifically be: first, according to the validity period information (the validity period information of the second information) stored in the blockchain ledger, check the validity period in the preset information information; if the verification is passed, according to the validity period information, it is confirmed whether the first information is within the validity period.
- At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes public information using the first network side device. before feeding back the request response for access control to the terminal according to the attribute information, further comprising: pairing the public key with the private key of the first network-side device Decrypt the encrypted first key to obtain the first key; according to the first key, decrypt the encrypted information obtained from the blockchain ledger to obtain the at least one Authentication information; wherein the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, or third terminal identification information corresponding to the public key of the terminal, and at least one of public key information of the terminal or a hash value of the public key of the terminal.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first information.
- a timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
- An embodiment of the present disclosure further provides an access control method, which is applied to a terminal, as shown in FIG. 2 , including:
- Step 21 Send the relevant information to be verified corresponding to the access request to the first network side device; wherein, the relevant information to be verified includes the private key signature information of the terminal and the location information of the preset information in the blockchain;
- Step 22 Receive a request response for access control fed back by the first network side device; wherein the preset information includes the public key information of the terminal, or the first terminal obtained according to the public key of the terminal identification information, or second terminal identification information unrelated to the terminal's public key and the terminal's public key information, or the second terminal identification information and a hash value of the terminal's public key.
- the access control method provided by the embodiment of the present disclosure sends the relevant information to be verified corresponding to the access request to the first network side device; wherein, the relevant information to be verified includes the private key signature information of the terminal and the preset location information of the information in the blockchain; receiving a request response for access control fed back by the first network side device; wherein the preset information includes the public key information of the terminal, or according to the public key information of the terminal.
- the first terminal identification information obtained by the public key, or the second terminal identification information unrelated to the public key of the terminal and the public key information of the terminal, or the identification information of the second terminal and the public key of the terminal.
- Hash value can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid the single point of failure problem caused by DDoS attacks on traditional authentication servers.
- the sending the relevant information to be verified corresponding to the access request to the first network-side device includes: sending an access request to the first network-side device, where the access request carries the relevant information to be verified; or, to the first network
- the side device sends an access request; receives a random number fed back by the first network-side device according to the access request; and sends the relevant information to be verified to the first network-side device according to the random number.
- the private key signature information includes first signature information using the terminal's private key to the timestamp, or, using the terminal's private key to respond to the access request for the first network-side device The second signature information of the random number sent.
- the relevant information to be verified further includes the timestamp.
- the preset information further includes validity period information of the first information; the first information includes attribute information of the terminal, identification information of the first terminal, and identification information of the second terminal. at least one.
- At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes encryption using the public key of the first network side device wherein the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or first terminal identification information unrelated to the public key of the terminal At least one of terminal identification information or third terminal identification information corresponding to the public key of the terminal, and public key information of the terminal or a hash value of the public key of the terminal.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first information.
- a timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
- the method before sending the relevant information to be verified corresponding to the access request to the first network-side device, the method further includes: sending the information to be authenticated of the terminal to the first blockchain node; wherein the to-be-authenticated information is sent to the first blockchain node.
- the information includes user credential information and/or attribute information; the user credential information includes terminal identification information.
- An embodiment of the present disclosure also provides an access control method, which is applied to the first blockchain node, as shown in FIG. 3 , including:
- Step 31 Receive the information to be authenticated sent by the terminal
- Step 32 Authenticate the information to be authenticated
- Step 33 in the case of passing the authentication, store at least one authentication information corresponding to the information to be authenticated in the blockchain ledger; wherein the information to be authenticated includes user credential information and/or attribute information; the The user credential information includes terminal identification information; the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or a second terminal independent of the public key of the terminal identification information or third terminal identification information corresponding to the public key of the terminal, and at least one of the public key information of the terminal or a hash value of the public key of the terminal.
- Step 32 may specifically be: using a consensus mechanism to authenticate the information to be authenticated.
- the access control method provided by the embodiment of the present disclosure receives the information to be authenticated sent by the terminal; authenticates the information to be authenticated; if the authentication is passed, at least one authentication information corresponding to the information to be authenticated Stored in the blockchain ledger; wherein, the information to be authenticated includes user credential information and/or attribute information; the user credential information includes terminal identification information; the at least one authentication information includes: attribute information of the terminal, The first terminal identification information obtained according to the public key of the terminal, the second terminal identification information unrelated to the public key of the terminal, or the third terminal identification information corresponding to the public key of the terminal, and the terminal At least one of the public key information of the terminal or the hash value of the public key of the terminal; it can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid Similar to the problem of single point of failure caused by DDoS attacks on traditional authentication servers.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first information.
- a timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
- storing at least one authentication information corresponding to the information to be authenticated in the blockchain ledger includes: randomly generating a first key for encryption; using the first key The key encrypts the at least one authentication information and stores it in the blockchain ledger.
- the method further includes: encrypting the first key with the public key of the terminal and then storing it in the blockchain ledger.
- the authentication of the information to be authenticated includes: according to a first preset policy, sending the user credential information in the information to be authenticated to at least one first two network-side devices perform authentication; receive the first authentication result and the corresponding third signature information fed back by the at least one second network-side device; according to the second preset policy, the first authentication result and the third signature information, Obtain the first final result of whether the user credential information is authenticated; and/or,
- the authenticating the information to be authenticated includes: according to a first preset policy, sending attribute information in the information to be authenticated to at least one third network-side device for authentication; receiving the at least one third network The second authentication result and the corresponding fourth signature information fed back by the side device; according to the third preset policy, the second authentication result and the fourth signature information, a second final result of whether the attribute information is authenticated is obtained.
- the first preset strategy, the third preset strategy and/or the third preset strategy are preset strategies or strategies agreed in the smart contract.
- the authentication of the information to be authenticated includes: sending the information to be authenticated to a second blockchain node; receiving the first authentication information The first authentication result corresponding to the user credential information in the information to be authenticated and the corresponding third signature information fed back by the second blockchain node; and according to the second preset policy, the first authentication result and the third signature information, obtain the first final result of whether the user credential information is authenticated; and/or, receive the second authentication result corresponding to the attribute information in the information to be authenticated fed back by the second blockchain node and the corresponding and obtain the second final result of whether the attribute information is authenticated according to the third preset policy, the second authentication result and the fourth signature information.
- the third preset strategy and/or the third preset strategy is a preset strategy or a strategy agreed in the smart contract.
- the embodiment of the present disclosure also provides an access control method, which is applied to the second blockchain node, as shown in FIG. 4 , including:
- Step 41 Receive the information to be authenticated of the terminal sent by the first blockchain node
- Step 42 Send the user credential information in the information to be authenticated to at least one second network side device for authentication, and receive the first authentication result and the corresponding third signature information fed back by the at least one second network side device , and feed it back to the first blockchain node; and/or, send the attribute information in the information to be authenticated to at least one third network side device for authentication, and receive feedback from the at least one third network side device
- the second authentication result and the corresponding fourth signature information are fed back to the first blockchain node; wherein, the user credential information includes terminal identification information.
- the access control method provided by the embodiment of the present disclosure receives the information to be authenticated of the terminal sent by the first blockchain node; and sends the user credential information in the information to be authenticated to at least one second network side device for authentication , and receive the first authentication result and the corresponding third signature information fed back by the at least one second network side device, and feed it back to the first blockchain node; and/or, convert the attributes in the information to be authenticated Send the information to at least one third network side device for authentication, and receive the second authentication result and the corresponding fourth signature information fed back by the at least one third network side device, and feed it back to the first blockchain node; wherein , the user credential information includes terminal identification information; it can support the implementation of the access control scheme using blockchain, and providing attribute verification services to customers in the form of blockchain can avoid similar traditional authentication servers suffering from DDoS attacks. The single point of failure problem.
- An embodiment of the present disclosure further provides an access control method, which is applied to a second network side device, as shown in FIG. 5 , including:
- Step 51 Receive the user credential information of the terminal to be authenticated sent by the blockchain node;
- Step 52 Authenticate the user credential information, obtain a first authentication result, and sign with the third signature information;
- Step 53 Feed back the first authentication result and the third signature information to the blockchain node; wherein the blockchain node is the first blockchain node or communicates with the first blockchain node The second blockchain node; the user credential information includes terminal identification information.
- the access control method provided by the embodiment of the present disclosure receives the user credential information of the terminal to be authenticated sent by the blockchain node; authenticates the user credential information, obtains a first authentication result, and uses the third signature information Signing; feeding back the first authentication result and the third signature information to the blockchain node; wherein the blockchain node is the first blockchain node or communicates with the first blockchain node
- the user credential information includes terminal identification information; it can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid similar traditional
- the authentication server suffers from a single point of failure caused by a DDoS attack.
- An embodiment of the present disclosure further provides an access control method, which is applied to a third network-side device, as shown in FIG. 6 , including:
- Step 61 Receive the attribute information of the terminal to be authenticated sent by the blockchain node;
- Step 62 Authenticate the attribute information, obtain a second authentication result, and use the fourth signature information to sign;
- Step 63 Feed back the second authentication result and the fourth signature information to the blockchain node; wherein, the blockchain node is the first blockchain node or communicates with the first blockchain node The second blockchain node of .
- the access control method provided by the embodiment of the present disclosure receives the attribute information of the terminal to be authenticated sent by the blockchain node; authenticates the attribute information, obtains a second authentication result, and uses the fourth signature information to sign ; Feed back the second authentication result and the fourth signature information to the block chain node; wherein, the block chain node is the first block chain node or the first block chain node that communicates with the first block chain node.
- Two blockchain nodes can support the solution of using blockchain for access control, and provide attribute verification services to customers in the form of blockchain, which can avoid the single point of failure caused by DDoS attacks on traditional authentication servers. .
- the access control method provided by the embodiments of the present disclosure is described below in combination with multiple sides such as a first network side device, a second network side device, a third network side device, a terminal, a first blockchain node, and a second blockchain node. for further explanation.
- the embodiments of the present disclosure provide an access control method, which can be specifically implemented as a method for implementing access control by using a blockchain, which involves providing authentication and verification services to customers in a blockchain manner, so that the Avoid the single point of failure caused by DDoS attacks on traditional authentication servers.
- FIG. 7 The implementation architecture of the access control method provided by the embodiment of the present disclosure is specifically shown in FIG. 7 , which involves: a user (corresponding to the above-mentioned terminal), a blockchain system (corresponding to the above-mentioned blockchain, including the first blockchain node and the second blockchain node) and application (corresponding to the above-mentioned first network side device);
- the blockchain network node in the specific blockchain system is composed of multiple authentication nodes, wherein the authentication node is mainly responsible for user identity verification (corresponding to the above-mentioned user credential information) is authenticated, and the attributes of the user (corresponding to the above-mentioned attribute information) are authenticated, and the authenticated result is recorded in the blockchain ledger;
- the user is accessing the business system (corresponding to the above-mentioned first A network side device), the business system queries the user identity and attribute information in the blockchain.
- Both the user (client) and the business system specifically, the application (server) in the system) have their own public and private keys.
- the user first submits an authentication request (corresponding to the above-mentioned information to be authenticated) to the blockchain system, including identity authentication information (corresponding to the above-mentioned user credential information) and attribute information.
- the authentication node authenticates the identity authentication information and attribute information respectively, and records the authenticated and consensus information to the blockchain ledger.
- the main process is as follows:
- Operation 1 The user (client) submits identity authentication information and/or attribute information to the blockchain system;
- the blockchain node (that is, the above-mentioned first blockchain node) authenticates the above-mentioned information (identity authentication information and/or attribute information) (specifically, it can authenticate the correctness of these information);
- the blockchain node converts the user ID (corresponding to the above-mentioned user credential information, which may specifically correspond to the above-mentioned first terminal identification information, second terminal identification information or third terminal identification information). Identification information) and/or user public key hash value and/or user public key, user attribute information (that is, the attribute information of the above-mentioned terminal), validity period (that is, the above-mentioned validity period information), etc. are recorded in the blockchain ledger;
- the data may be encrypted and stored.
- the plaintext of the data to be recorded is info
- the ciphertext recorded in the blockchain ledger is:
- E represents encryption
- subscript of E represents the key used
- brackets represent data
- K is the first key randomly generated by the blockchain node.
- Operation 4 The user initiates an access request to the application server (corresponding to the above-mentioned first network side device):
- Mode 1 timestamp signature: which includes the timestamp, the signature of the user's private key to the timestamp (that is, the above-mentioned first signature information), the user ID and/or the hash value of the user's public key and/or the user's public key, The location of the user attribute information, validity period and other information in the blockchain (that is, the above location information). If the user public key is not recorded in operation 3 (but the hash value is recorded), the user public key must also be carried in this operation.
- Method 2 (random number signature): The request does not carry user information, the application server returns a random number, the user signs the random number using the private key (ie the above-mentioned second signature information), and sends the signature along with the user ID and/or user ID. The location of the public key hash value and/or the user public key, user attribute information, validity period and other information in the blockchain is sent to the application server. If the user public key is not recorded in operation 3, the user public key must also be included in this operation. .
- the access request should also include a decryption key (that is, the above-mentioned first key encrypted with the public key of the first network-side device):
- the application server queries the relevant information in the blockchain ledger to verify the user (client):
- Method 1 Use the user's public key to verify whether the signature on the timestamp is correct, whether the timestamp is within the validity period, and verify whether the user's public key or hash value is consistent (or matched) with the record in the ledger. If the verification is successful, it means that the user is the user in the account book, the attribute information recorded in the account book is the attribute of the user, and the application server can further use the attribute and the user ID to perform access authorization (control access).
- Method 2 Use the user's public key to verify whether the signature on the random number is correct, and verify whether the user's public key or hash value is consistent (or matched) with the record in the ledger. If the verification is successful, it means that the user is the user in the ledger, the attribute information recorded in the ledger is the attribute of the user, and the application server can further use the attribute and the user ID for access authorization.
- the application server should also use the server's private key to decrypt to obtain K, and further decrypt the ciphertext in the ledger:
- DK(Ek(info)) get info, namely user information (user ID) and attribute information, where D represents decryption.
- the access control method provided by the embodiments of the present disclosure may be shown in FIG. 8a (the first network side device is an application server (gateway) as an example), including:
- Step 81 The user (client) sends an authentication request (corresponding to the above-mentioned information to be authenticated) to the blockchain node (that is, the above-mentioned first blockchain node);
- Step 82 The blockchain node performs an authentication operation
- Step 83 The authentication is passed and recorded in the blockchain ledger (user ID and/or public key, attribute information);
- Step 84 The blockchain node feeds back an authentication response to the user (client);
- Step 85 The user (client) sends an access request to the application server (gateway);
- Step 86 The application server (gateway) queries the blockchain ledger for user authentication information and attribute information;
- Step 87 The application server (gateway) verifies the user (client) according to the queried information;
- Step 88 The application server (gateway) feeds back the request response to the user (client).
- the access control method of the embodiment of the present disclosure can also be applied to a software defined boundary (Software Defined Perimeter, SDP) scenario, and the specific implementation process can refer to FIG. Accepting SDP Hosts, AH) as an example), the method includes:
- Step 810 the SDP connection initiating host (Initiating SDP Hosts, IH) sends an authentication request (corresponding to the above-mentioned information to be authenticated) to the blockchain node (that is, the above-mentioned first blockchain node);
- Step 820 the blockchain node performs an authentication operation
- Step 830 The authentication is passed, and recorded in the blockchain ledger (ID and/or public key of the IH, attribute information);
- Step 840 The blockchain node feeds back an authentication response to the IH;
- Step 850 the IH sends an access request to the AH
- Step 860 AH queries the blockchain ledger for IH authentication information and attribute information
- Step 870 AH verifies the IH according to the queried information
- Step 880 The AH feeds back the request response to the IH.
- Method 1 this method needs to formulate an authentication strategy (including the above-mentioned first preset strategy, second preset strategy and third preset strategy) for authentication information (namely identity authentication information) and attribute information, and the strategy should include an information forwarding strategy (that is, the above-mentioned first preset strategy), as shown in Figure 9:
- an authentication strategy including the above-mentioned first preset strategy, second preset strategy and third preset strategy
- authentication information namely identity authentication information
- attribute information namely identity authentication information
- the strategy should include an information forwarding strategy (that is, the above-mentioned first preset strategy), as shown in Figure 9:
- the blockchain node After receiving the identity authentication information and attribute information, the blockchain node forwards the authentication information and attribute information to the corresponding authentication node according to the policy (corresponding to the above-mentioned sending the user credential information in the information to be authenticated to At least one second network side device performs authentication, and sends the attribute information in the information to be authenticated to at least one third network side device for authentication); different authentication nodes can authenticate different authentication information or attribute information, such as attribute authentication Node 1 authenticates attribute 1, and attribute authentication node 2 authenticates attribute 2, which is not limited here.
- the authentication information authentication node and the attribute authentication node respectively authenticate the above information, and sign the authentication result;
- the authentication information authentication node may be an authentication server; for example, if the user submits the user name and password authentication information, the blockchain node forwards the authentication information to the authentication information authentication node, and the authentication information authentication node authenticates the user name and password.
- the authentication information authentication nodes 1 and 2 can be compared to WeChat and Alipay, whichever password the user submits, the blockchain node submits the authentication information to the corresponding authentication information authentication node.
- the authentication information authentication node and the attribute authentication node return the verification result (corresponding to the above-mentioned first authentication result and second authentication result) and its signature to the result (corresponding to the above-mentioned third signature information and fourth signature information);
- the blockchain node determines the final authentication result (corresponding to the above-mentioned first final result and second final result) according to the received authentication result and signature.
- Method 2 this method requires the use of an intermediate node (that is, the above-mentioned second blockchain node), as shown in Figure 10:
- the blockchain node (that is, the above-mentioned first blockchain node) forwards the authentication information and attribute information to the intermediate node after receiving the identity authentication information and attribute information;
- the intermediate node forwards the authentication information and attribute information to the corresponding authentication node (corresponding to the above-mentioned sending the user credential information in the to-be-authenticated information to at least one second network-side device for authentication, and the to-be-authenticated information in the
- the attribute information is sent to at least one third network side device for authentication); different authentication nodes can authenticate different authentication information or attribute information, for example, attribute authentication node 1 authenticates attribute 1, attribute authentication node 2 authenticates attribute 2, which is not performed here. limited.
- the authentication information authentication node may be an authentication server; for example, if the user submits the user name and password authentication information, the blockchain node forwards the authentication information to the authentication information authentication node, and the authentication information authentication node authenticates the user name and password.
- the authentication information authentication nodes 1 and 2 can be analogized to WeChat and Alipay, whichever password the user submits, the blockchain node submits the authentication information to the corresponding authentication information authentication node.
- the authentication information authentication node and the attribute authentication node send the authentication result (corresponding to the above-mentioned first authentication result and the second authentication result) and its signature to the result (corresponding to the above-mentioned third signature information and fourth signature information) to the intermediate node;
- the blockchain node obtains the authentication result and the signature from the intermediate node, and determines the final authentication result (corresponding to the above-mentioned first final result and second final result).
- Example 1 Unified authentication (another implementation is provided for the above operation 5 in this example);
- the blockchain acts as a unified authentication platform
- the user submits an authentication request to the blockchain system
- the blockchain node (corresponding to the first blockchain node above) authenticates the user
- the user information, public The key information and attribute information are recorded in the blockchain ledger.
- the application system needs to verify the user's signature to ensure the correctness of the user's public key, and then query the user information and attribute information in the blockchain based on the public key to authenticate the user.
- the user initiates an authentication request to the blockchain, carrying the information to be authenticated;
- the blockchain system authenticates the information to be authenticated provided by the user, and after the authentication is passed, the user's identity or attribute information is recorded in the blockchain ledger;
- the user initiates an access request to the application system, which carries the signature of the user's private key to the timestamp, or the application system sends a random number to the user, and the user signs the random number with the private key and sends it to the application system.
- the request can also carry the location where the user identity or attribute information is recorded in the blockchain.
- the application system can directly verify the user's signature with the public key. If the signature is correct, the public key can be used to query the user's identity (user ID) and attribute information in the blockchain.
- the application system can further use this attribute and the user's identity to perform access authorization.
- Example 2 Two-factor authentication (corresponding to the authentication methods in Figure 9 and Figure 10 above);
- the user has the authentication information of two authentication platforms (such as WeChat platform and Alipay platform), and the user submits an authentication request to the blockchain system, and the request may include multiple authentication platforms (such as WeChat platform and Alipay platform)
- the blockchain node extracts the user authentication data, and sends the user authentication data to the corresponding authentication platform for authentication in the manner shown in Figure 9 or Figure 10.
- the authentication platform authenticates the user according to the user's authentication data. And return the authentication result to the blockchain node.
- the blockchain node uses the preset strategy or the strategy agreed in the smart contract to process the authentication result. Since the authentication node can obtain the authentication results of the user by the above two authentication platforms, double authentication of the user's identity can be realized.
- a user submits an authentication request to the blockchain system; Authentication, and record the authenticated and consensus information to the blockchain ledger; when a user accesses the business system, the business system queries the user's identity and attribute information on the blockchain.
- the user may submit an authentication request to the blockchain system, including authentication information and attribute information; the blockchain node sends an authentication request to the corresponding authentication information authentication node and attribute information authentication node; corresponding The authentication information authentication node and attribute information authentication node authentication request, and feedback the authentication result; the blockchain node processes the authentication result.
- the solutions provided by the embodiments of the present disclosure can avoid the single point of failure problem; and use smart contracts to implement authentication and authorization, and the nodes will not affect normal business if they are tampered with.
- An embodiment of the present disclosure further provides an access control apparatus, which is applied to the first network side device, as shown in FIG. 11 , including:
- the first receiving module 111 is configured to receive the relevant information to be verified corresponding to the access request sent by the terminal; wherein, the relevant information to be verified includes the private key signature information of the terminal and the position of the preset information in the blockchain information;
- a first obtaining module 112 configured to obtain the preset information from the blockchain according to the location information
- a first verification module 113 configured to verify the terminal according to the private key signature information and the preset information
- the second receiving module 114 is configured to obtain the attribute information of the terminal from the blockchain ledger according to the preset information when the verification is passed;
- a first feedback module 115 configured to feed back a request response for access control to the terminal according to the attribute information
- the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
- the access control apparatus receives the relevant information to be verified corresponding to the access request sent by the terminal; wherein, the relevant information to be verified includes the private key signature information of the terminal and the preset information in the area location information in the blockchain; obtain the preset information from the blockchain according to the location information; verify the terminal according to the private key signature information and the preset information; In this case, according to the preset information, the attribute information of the terminal is obtained from the blockchain ledger; according to the attribute information, a request response for access control is fed back to the terminal; wherein the preset information It includes the public key information of the terminal, or the first terminal identification information obtained according to the public key of the terminal, or the second terminal identification information unrelated to the public key of the terminal and the public key information of the terminal, or The identification information of the second terminal and the hash value of the public key of the terminal can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid similar
- the traditional authentication server suffers from the single point of failure
- the receiving the relevant information to be verified corresponding to the access request sent by the terminal includes: receiving the access request sent by the terminal, where the access request carries the relevant information to be verified; or, receiving the access request sent by the terminal ; feeding back a random number to the terminal according to the access request; and receiving the relevant information to be verified sent by the terminal according to the random number.
- the verifying the terminal according to the private key signature information and the preset information includes: using The public key information verifies the private key signature information; in the case of passing the verification, obtaining the attribute information of the terminal from the blockchain ledger according to the preset information, including: in the case of passing the verification In the case of , obtain the corresponding third terminal identification information from the blockchain ledger according to the public key information; in the case of obtaining the third terminal identification information, obtain the third terminal identification information from the blockchain ledger
- the attribute information corresponding to the three terminal identification information is used as the attribute information of the terminal.
- the verifying the terminal according to the private key signature information and the preset information includes: according to the first terminal identification information, obtain the public key information to be verified and obtain the stored public key information of the terminal from the blockchain ledger; according to the public key information of the terminal, the public key information to be verified and all The private key signature information is verified; in the case of passing the verification, obtaining the attribute information of the terminal from the blockchain ledger according to the preset information, including: in the case of passing the verification, according to the For the first terminal identification information, attribute information of the terminal is obtained from the blockchain ledger.
- the terminal when the preset information includes the identification information of the second terminal and the public key information, the terminal is verified according to the private key signature information and the preset information. , including: using the public key information in the preset information to verify the private key signature information; and obtaining the stored public key of the terminal from the blockchain ledger according to the second terminal identification information information; verify the public key information in the preset information according to the acquired public key information of the terminal; or verify the private key signature information by using the public key information in the preset information; and obtain the stored hash value of the public key of the terminal from the blockchain ledger according to the identification information of the second terminal; obtain the hash value to be verified according to the public key information in the preset information ; Verify the hash value to be verified according to the obtained hash value of the public key of the terminal.
- the terminal is verified according to the private key signature information and the preset information
- the method includes: obtaining the stored public key information of the terminal from the blockchain ledger according to the identification information of the second terminal; obtaining the public key to be verified according to the hash value of the public key in the preset information information; verifying the private key signature information according to the public key information to be verified; and verifying the public key information to be verified according to the acquired public key information of the terminal.
- obtaining the attribute information of the terminal from the blockchain ledger according to the preset information includes: in the case of passing the verification, according to the second Terminal identification information, the attribute information of the terminal is obtained from the blockchain ledger.
- the private key signature information includes first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the random number sent by the first network-side device in response to the access request the second signature information.
- the relevant information to be verified further includes the timestamp; the signature information according to the private key and the preset information , verifying the terminal, including: confirming whether the time stamp is within the validity period; if the time stamp is within the validity period, verifying the terminal according to the private key signature information and the preset information authenticating.
- the preset information further includes validity period information of the first information; the first information includes at least one of the attribute information, the first terminal identification information and the second terminal identification information; the Verifying the terminal according to the private key signature information and the preset information includes: confirming, according to the validity period information, whether the first information is within the validity period; if the first information is within the validity period In this case, the terminal is verified according to the private key signature information and other information in the preset information except the validity period information.
- At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes using the first network the first key encrypted by the public key of the side device; the access control apparatus further includes: a first decryption module, configured to, before feeding back a request response for access control to the terminal according to the attribute information , use the private key of the first network side device to decrypt the first key encrypted by the public key to obtain the first key; a second decryption module is used to decrypt the first key according to the first key , decrypt the encrypted information obtained from the blockchain ledger to obtain the at least one authentication information; wherein, the at least one authentication information includes: attribute information of the terminal, according to the public information of the terminal the first terminal identification information obtained from the key, or the second terminal identification information unrelated to the public key of the terminal, or the third terminal identification information corresponding to the public key of the terminal, and the public key information of the terminal or all at least one of the hash values
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first information.
- a timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
- An embodiment of the present disclosure further provides an access control apparatus, which is applied to a terminal, as shown in FIG. 12 , including:
- the first sending module 121 is configured to send the relevant information to be verified corresponding to the access request to the first network side device; wherein, the relevant information to be verified includes the private key signature information of the terminal and preset information in the blockchain location information in ;
- a third receiving module 122 configured to receive a request response for access control fed back by the first network-side device
- the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
- the access control apparatus sends the relevant information to be verified corresponding to the access request to the first network side device; wherein, the relevant information to be verified includes the private key signature information of the terminal and the preset location information of the information in the blockchain; receiving a request response for access control fed back by the first network side device; wherein the preset information includes the public key information of the terminal, or according to the public key information of the terminal.
- the first terminal identification information obtained by the public key, or the second terminal identification information unrelated to the public key of the terminal and the public key information of the terminal, or the identification information of the second terminal and the public key of the terminal.
- Hash value can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid the single point of failure problem caused by DDoS attacks on traditional authentication servers.
- the sending the relevant information to be verified corresponding to the access request to the first network-side device includes: sending an access request to the first network-side device, where the access request carries the relevant information to be verified; or, to the first network
- the side device sends an access request; receives a random number fed back by the first network-side device according to the access request; and sends the relevant information to be verified to the first network-side device according to the random number.
- the private key signature information includes first signature information using the terminal's private key to the timestamp, or, using the terminal's private key to respond to the access request for the first network-side device The second signature information of the random number sent.
- the relevant information to be verified further includes the timestamp.
- the preset information further includes validity period information of the first information; the first information includes at least one of attribute information of the terminal, identification information of the first terminal and identification information of the second terminal .
- At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes encryption using the public key of the first network side device wherein the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or first terminal identification information unrelated to the public key of the terminal At least one of terminal identification information or third terminal identification information corresponding to the public key of the terminal, and public key information of the terminal or a hash value of the public key of the terminal.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first information.
- a timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
- the access control apparatus further includes: a second sending module, configured to send the first block chain node before sending the relevant information to be verified corresponding to the access request to the first network side device.
- Information to be authenticated of the terminal wherein the information to be authenticated includes user credential information and/or attribute information; the user credential information includes terminal identification information.
- the above implementation embodiments of the access control method on the terminal side are all applicable to the embodiments of the access control apparatus, and can also achieve the same technical effect.
- An embodiment of the present disclosure further provides an access control apparatus, which is applied to the first blockchain node, as shown in FIG. 13 , including:
- the fourth receiving module 131 is configured to receive the information to be authenticated sent by the terminal;
- a first authentication module 132 configured to authenticate the information to be authenticated
- the first storage module 133 is configured to store at least one piece of authentication information corresponding to the information to be authenticated in the blockchain ledger when the authentication is passed;
- the to-be-authenticated information includes user credential information and/or attribute information;
- the user credential information includes terminal identification information;
- the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, or identification information related to the terminal.
- the access control device receives the information to be authenticated sent by the terminal; authenticates the information to be authenticated; in the case of passing the authentication, at least one authentication information corresponding to the information to be authenticated Stored in the blockchain ledger; wherein, the information to be authenticated includes user credential information and/or attribute information; the user credential information includes terminal identification information; the at least one authentication information includes: attribute information of the terminal, The first terminal identification information obtained according to the public key of the terminal, the second terminal identification information unrelated to the public key of the terminal, or the third terminal identification information corresponding to the public key of the terminal, and the terminal At least one of the public key information of the terminal or the hash value of the public key of the terminal; it can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid Similar to the problem of single point of failure caused by DDoS attacks on traditional authentication servers.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first information.
- a timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
- storing at least one authentication information corresponding to the information to be authenticated in the blockchain ledger includes: randomly generating a first key for encryption; using the first key The key encrypts the at least one authentication information and stores it in the blockchain ledger.
- the access control device further includes: a first processing module, configured to use the public key of the terminal to encrypt the first key after randomly generating the first key for encryption Stored in the blockchain ledger.
- the authenticating the information to be authenticated includes: according to a first preset policy, sending the user credential information in the information to be authenticated to at least one second network-side device for authentication; receiving the at least one The first authentication result and the corresponding third signature information fed back by the second network-side device; according to the second preset policy, the first authentication result and the third signature information, the first authentication result of whether the user credential information is authenticated is obtained. Final result.
- the authenticating the information to be authenticated includes: according to a first preset policy, sending attribute information in the information to be authenticated to at least one third network-side device for authentication; the second authentication result and the corresponding fourth signature information fed back by the at least one third network-side device; according to the third preset policy, the second authentication result and the fourth signature information, obtain whether the attribute information is authenticated or not. Second final result.
- the authenticating the information to be authenticated includes: sending the information to be authenticated to a second blockchain node; receiving feedback from the second blockchain node and the user in the information to be authenticated The first authentication result corresponding to the credential information and the corresponding third signature information; and according to the second preset policy, the first authentication result and the third signature information, the first final result of whether the authentication of the user credential information is passed is obtained. and/or, receive the second authentication result corresponding to the attribute information in the information to be authenticated and the corresponding fourth signature information fed back by the second blockchain node; and according to the third preset strategy, the The second authentication result and the fourth signature information are used to obtain a second final result of whether the attribute information is authenticated.
- the above-mentioned implementation embodiments of the access control method on the first blockchain node side are all applicable to the embodiments of the access control apparatus, and can also achieve the same technical effect.
- An embodiment of the present disclosure also provides an access control device, which is applied to a second blockchain node, as shown in FIG. 14 , including:
- the fifth receiving module 141 is configured to receive the information to be authenticated of the terminal sent by the first blockchain node;
- the second processing module 142 is configured to send the user credential information in the information to be authenticated to at least one second network side device for authentication, and receive the first authentication result fed back by the at least one second network side device and the corresponding
- the third signature information is fed back to the first blockchain node; and/or,
- the third processing module 143 is configured to send the attribute information in the information to be authenticated to at least one third network side device for authentication, and receive the second authentication result fed back by the at least one third network side device and the corresponding fourth signature information, which is fed back to the first blockchain node;
- the user credential information includes terminal identification information.
- the access control apparatus receives the information to be authenticated of the terminal sent by the first blockchain node; and sends the user credential information in the information to be authenticated to at least one second network side device for authentication , and receive the first authentication result and the corresponding third signature information fed back by the at least one second network side device, and feed it back to the first blockchain node; and/or, convert the attributes in the information to be authenticated Send the information to at least one third network side device for authentication, and receive the second authentication result and the corresponding fourth signature information fed back by the at least one third network side device, and feed it back to the first blockchain node; wherein , the user credential information includes terminal identification information; it can support the implementation of the access control scheme using blockchain, and providing attribute verification services to customers in the form of blockchain can avoid similar traditional authentication servers suffering from DDoS attacks. The single point of failure problem.
- An embodiment of the present disclosure further provides an access control apparatus, which is applied to a second network-side device, as shown in FIG. 15 , including:
- the sixth receiving module 151 is used to receive the user credential information of the terminal to be authenticated sent by the blockchain node;
- a fourth processing module 152 configured to authenticate the user credential information, obtain a first authentication result, and use the third signature information to sign;
- the second feedback module 153 is configured to feed back the first authentication result and the third signature information to the blockchain node;
- the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node;
- the user credential information includes terminal identification information.
- the access control device receives the user credential information of the terminal to be authenticated sent by the blockchain node; authenticates the user credential information, obtains a first authentication result, and uses the third signature information Signing; feeding back the first authentication result and the third signature information to the blockchain node; wherein the blockchain node is the first blockchain node or communicates with the first blockchain node
- the user credential information includes terminal identification information; it can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid similar traditional
- the authentication server suffers from a single point of failure caused by a DDoS attack.
- the above-mentioned implementation embodiments of the access control method on the device side of the second network side are all applicable to the embodiments of the access control apparatus, and can also achieve the same technical effect.
- An embodiment of the present disclosure further provides an access control apparatus, which is applied to a third network-side device, as shown in FIG. 16 , including:
- the seventh receiving module 161 is configured to receive the attribute information of the terminal to be authenticated sent by the blockchain node;
- a fifth processing module 162 configured to authenticate the attribute information, obtain a second authentication result, and use the fourth signature information to sign;
- the third feedback module 163 is used to feed back the second authentication result and the fourth signature information to the blockchain node;
- the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node.
- the access control device receives the attribute information of the terminal to be authenticated sent by the blockchain node; authenticates the attribute information, obtains a second authentication result, and uses the fourth signature information to sign ; Feed back the second authentication result and the fourth signature information to the block chain node; wherein, the block chain node is the first block chain node or the first block chain node that communicates with the first block chain node.
- Two blockchain nodes it can support the solution of using blockchain for access control, and provide attribute verification services to customers in the form of blockchain, which can avoid the single point of failure caused by DDoS attacks on traditional authentication servers. .
- the above-mentioned implementation embodiments of the access control method on the device side of the third network side are all applicable to the embodiments of the access control apparatus, and can also achieve the same technical effect.
- An embodiment of the present disclosure further provides a network-side device, where the network-side device is a first network-side device, as shown in FIG. 17 , including: a processor 171 and a transceiver 172;
- the processor 171 is configured to receive, through the transceiver 172, the relevant information to be verified corresponding to the access request sent by the terminal; wherein the relevant information to be verified includes the private key signature information of the terminal and the preset information in Location information in the blockchain;
- the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
- the network-side device receives the relevant information to be verified corresponding to the access request sent by the terminal; wherein, the relevant information to be verified includes the private key signature information of the terminal and the preset information in the block position information in the chain; obtain the preset information from the blockchain according to the position information; verify the terminal according to the private key signature information and the preset information; if the verification is passed.n, according to the preset information, the attribute information of the terminal is obtained from the blockchain ledger; according to the attribute information, a request response for access control is fed back to the terminal; wherein the preset information includes The public key information of the terminal, or the first terminal identification information obtained according to the public key of the terminal, or the second terminal identification information unrelated to the public key of the terminal and the public key information of the terminal, or all The identification information of the second terminal and the hash value of the public key of the terminal; can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid similar traditional The authentication server suffer
- the receiving the relevant information to be verified corresponding to the access request sent by the terminal includes: receiving the access request sent by the terminal, where the access request carries the relevant information to be verified; or, receiving the access request sent by the terminal ; feeding back a random number to the terminal according to the access request; and receiving the relevant information to be verified sent by the terminal according to the random number.
- the verifying the terminal according to the private key signature information and the preset information includes: using The public key information verifies the private key signature information; in the case of passing the verification, obtaining the attribute information of the terminal from the blockchain ledger according to the preset information, including: in the case of passing the verification In the case of , obtain the corresponding third terminal identification information from the blockchain ledger according to the public key information; in the case of obtaining the third terminal identification information, obtain the third terminal identification information from the blockchain ledger
- the attribute information corresponding to the three terminal identification information is used as the attribute information of the terminal.
- the verifying the terminal according to the private key signature information and the preset information includes: according to the first terminal identification information, obtain the public key information to be verified and obtain the stored public key information of the terminal from the blockchain ledger; according to the public key information of the terminal, the public key information to be verified and all The private key signature information is verified; in the case of passing the verification, obtaining the attribute information of the terminal from the blockchain ledger according to the preset information, including: in the case of passing the verification, according to the For the first terminal identification information, attribute information of the terminal is obtained from the blockchain ledger.
- the terminal when the preset information includes the identification information of the second terminal and the public key information, the terminal is verified according to the private key signature information and the preset information. , including: using the public key information in the preset information to verify the private key signature information; and obtaining the stored public key of the terminal from the blockchain ledger according to the second terminal identification information information; verify the public key information in the preset information according to the acquired public key information of the terminal; or verify the private key signature information by using the public key information in the preset information; and obtain the stored hash value of the public key of the terminal from the blockchain ledger according to the identification information of the second terminal; obtain the hash value to be verified according to the public key information in the preset information ; Verify the hash value to be verified according to the obtained hash value of the public key of the terminal.
- the terminal is verified according to the private key signature information and the preset information
- the method includes: obtaining the stored public key information of the terminal from the blockchain ledger according to the identification information of the second terminal; obtaining the public key to be verified according to the hash value of the public key in the preset information information; verifying the private key signature information according to the public key information to be verified; and verifying the public key information to be verified according to the acquired public key information of the terminal.
- obtaining the attribute information of the terminal from the blockchain ledger according to the preset information includes: in the case of passing the verification, according to the second Terminal identification information, the attribute information of the terminal is obtained from the blockchain ledger.
- the private key signature information includes first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the random number sent by the first network-side device in response to the access request the second signature information.
- the relevant information to be verified further includes the timestamp; the signature information according to the private key and the preset information , verifying the terminal, including: confirming whether the time stamp is within the validity period; if the time stamp is within the validity period, verifying the terminal according to the private key signature information and the preset information authenticating.
- the preset information further includes validity period information of the first information; the first information includes at least one of the attribute information, the first terminal identification information and the second terminal identification information; the Verifying the terminal according to the private key signature information and the preset information includes: confirming, according to the validity period information, whether the first information is within the validity period; if the first information is within the validity period In this case, the terminal is verified according to the private key signature information and other information in the preset information except the validity period information.
- At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes using the first network the first key encrypted by the public key of the side device; the processor is further configured to: use the first network side before feeding back a request response for access control to the terminal according to the attribute information
- the private key of the device decrypts the first key encrypted by the public key to obtain the first key; according to the first key, for the encrypted data obtained from the blockchain ledger information is decrypted to obtain the at least one authentication information;
- the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or public identification information with the terminal.
- key-independent second terminal identification information or third terminal identification information corresponding to the public key of the terminal, and at least one of the public key information of the terminal or a hash value of the public key of the terminal.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first information.
- a timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
- An embodiment of the present disclosure also provides a terminal, as shown in FIG. 18 , including: a processor 181 and a transceiver 182;
- the processor 181 is configured to send the relevant information to be verified corresponding to the access request to the first network side device through the transceiver 182; wherein, the relevant information to be verified includes the private key signature information of the terminal and the predetermined information. Set the location information of the information in the blockchain;
- the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
- the terminal provided by the embodiment of the present disclosure sends the relevant information to be verified corresponding to the access request to the first network-side device; wherein, the relevant information to be verified includes the private key signature information of the terminal and the preset information in the area location information in the blockchain; receiving a request response for access control fed back by the first network-side device; wherein the preset information includes the public key information of the terminal, or is obtained according to the public key of the terminal the first terminal identification information, or the second terminal identification information unrelated to the public key of the terminal and the public key information of the terminal, or the second terminal identification information and the hash value of the public key of the terminal ; It can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid the single point of failure caused by DDoS attacks on traditional authentication servers.
- the sending the relevant information to be verified corresponding to the access request to the first network-side device includes: sending an access request to the first network-side device, where the access request carries the relevant information to be verified; or, Sending an access request to the first network-side device; receiving a random number fed back by the first network-side device according to the access request; and sending the relevant information to be verified to the first network-side device according to the random number.
- the private key signature information includes first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the random number sent by the first network-side device in response to the access request the second signature information.
- the relevant information to be verified further includes the timestamp.
- the preset information further includes validity period information of the first information; the first information includes at least one item of attribute information of the terminal, identification information of the first terminal and identification information of the second terminal.
- At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes using the first network side device The first key encrypted by the public key of the terminal; wherein, the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or a public key with the terminal. key-independent second terminal identification information or third terminal identification information corresponding to the public key of the terminal, and at least one of the public key information of the terminal or a hash value of the public key of the terminal.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first information.
- a timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
- the processor is further configured to: before sending the relevant information to be verified corresponding to the access request to the first network-side device, send the information of the terminal to the first blockchain node through the transceiver.
- Information to be authenticated wherein, the information to be authenticated includes user credential information and/or attribute information; the user credential information includes terminal identification information.
- An embodiment of the present disclosure further provides a blockchain node, where the blockchain node is a first blockchain node, as shown in FIG. 19 , including: a processor 191 and a transceiver 192;
- the processor 191 is configured to receive the information to be authenticated sent by the terminal through the transceiver 192;
- At least one authentication information corresponding to the information to be authenticated is stored in the blockchain ledger;
- the to-be-authenticated information includes user credential information and/or attribute information;
- the user credential information includes terminal identification information;
- the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, or identification information related to the terminal.
- the blockchain node receives the information to be authenticated sent by the terminal; authenticates the information to be authenticated; if the authentication is passed, at least one authentication information corresponding to the information to be authenticated Stored in the blockchain ledger; wherein, the information to be authenticated includes user credential information and/or attribute information; the user credential information includes terminal identification information; the at least one authentication information includes: attribute information of the terminal, The first terminal identification information obtained according to the public key of the terminal, the second terminal identification information unrelated to the public key of the terminal, or the third terminal identification information corresponding to the public key of the terminal, and the terminal At least one of the public key information of the terminal or the hash value of the public key of the terminal; it can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid Similar to the problem of single point of failure caused by DDoS attacks on traditional authentication servers.
- the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
- storing at least one authentication information corresponding to the information to be authenticated in the blockchain ledger includes: randomly generating a first key for encryption; using The first key encrypts the at least one authentication information and stores it in the blockchain ledger.
- the processor is further configured to: after randomly generating the first key for encryption, encrypt the first key with the public key of the terminal and store the first key in the blockchain ledger.
- the authenticating the information to be authenticated includes: according to a first preset policy, sending the user credential information in the information to be authenticated to at least one second network-side device for authentication; receiving The first authentication result and the corresponding third signature information fed back by the at least one second network side device; according to the second preset policy, the first authentication result and the third signature information, obtain whether the user credential information is authenticated The first final result passed.
- the authenticating the information to be authenticated includes: according to a first preset policy, sending attribute information in the information to be authenticated to at least one third network-side device for authentication; receiving the at least one first 3.
- the authentication of the information to be authenticated includes: sending the information to be authenticated to a second blockchain node; receiving feedback from the second blockchain node with the information to be authenticated The first authentication result corresponding to the user credential information in the information and the corresponding third signature information; and according to the second preset policy, the first authentication result and the third signature information, obtain whether the user credential information is authenticated or not. the first final result; and/or, receiving the second authentication result corresponding to the attribute information in the information to be authenticated and the corresponding fourth signature information fed back by the second blockchain node; and according to the third preset The policy, the second authentication result and the fourth signature information are used to obtain the second final result of whether the attribute information is authenticated.
- the above-mentioned implementation embodiments of the access control method on the side of the first blockchain node are all applicable to the embodiments of the blockchain node, and can also achieve the same technical effect.
- An embodiment of the present disclosure further provides a blockchain node, where the blockchain node is a second blockchain node, as shown in FIG. 20 , including: a processor 201 and a transceiver 202;
- the processor 201 is configured to receive the information to be authenticated of the terminal sent by the first blockchain node through the transceiver 202;
- the transceiver 202 sends the user credential information in the information to be authenticated to at least one second network side device for authentication, and receives the first authentication result and the corresponding first authentication result fed back by the at least one second network side device.
- the transceiver 202 sends the attribute information in the information to be authenticated to at least one third network-side device for authentication, and receives the second authentication result and the corresponding fourth authentication result fed back by the at least one third network-side device.
- the signature information is fed back to the first blockchain node;
- the user credential information includes terminal identification information.
- the blockchain node receives the information to be authenticated of the terminal sent by the first blockchain node, and sends the user credential information in the information to be authenticated to at least one second network side device for authentication , and receive the first authentication result and the corresponding third signature information fed back by the at least one second network side device, and feed it back to the first blockchain node; and/or, convert the attributes in the information to be authenticated Send the information to at least one third network side device for authentication, and receive the second authentication result and the corresponding fourth signature information fed back by the at least one third network side device, and feed it back to the first blockchain node; wherein , the user credential information includes terminal identification information; it can support the implementation of the access control scheme using blockchain, and providing attribute verification services to customers in the form of blockchain can avoid similar traditional authentication servers suffering from DDoS attacks. The single point of failure problem.
- An embodiment of the present disclosure further provides a network-side device, where the network-side device is a second network-side device, as shown in FIG. 21 , including: a processor 211 and a transceiver 212;
- the processor 211 is configured to receive, through the transceiver 212, the user credential information of the terminal to be authenticated sent by the blockchain node;
- the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node;
- the user credential information includes terminal identification information.
- the network-side device receives the user credential information of the terminal to be authenticated sent by the blockchain node; authenticates the user credential information, obtains a first authentication result, and uses the third signature information to perform authentication signature; feedback the first authentication result and the third signature information to the blockchain node; wherein, the blockchain node is the first blockchain node or a device that communicates with the first blockchain node
- the blockchain node is the first blockchain node or a device that communicates with the first blockchain node
- the second block chain node; the user credential information includes terminal identification information; it can support the implementation of the access control scheme using block chain, and provide attribute verification services to customers in the form of block chain, which can avoid similar traditional authentication
- the server suffers from a single point of failure caused by a DDoS attack.
- An embodiment of the present disclosure further provides a network-side device, where the network-side device is a third network-side device, as shown in FIG. 22 , including: a processor 221 and a transceiver 222;
- the processor 221 is configured to receive, through the transceiver 222, the attribute information of the terminal to be authenticated sent by the blockchain node;
- the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node.
- the network side device receives the attribute information of the terminal to be authenticated sent by the blockchain node; authenticates the attribute information, obtains a second authentication result, and uses the fourth signature information to sign; Feeding back the second authentication result and the fourth signature information to the blockchain node; wherein the blockchain node is the first blockchain node or the second blockchain node that communicates with the first blockchain node Blockchain node; can support the implementation of access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid the problem of single point of failure caused by DDoS attacks similar to traditional authentication servers.
- the above-mentioned implementation embodiments of the access control method on the device side of the third network side are all applicable to the embodiments of the network side device, and can also achieve the same technical effect.
- An embodiment of the present disclosure further provides a network-side device, including a memory, a processor, and a program stored in the memory and running on the processor; the processor implements the first above-mentioned first when executing the program. an access control method on the network side device side; or, when the processor executes the program, implements the above-mentioned second access control method on the network side device side; or, when the processor executes the program, implements the above-mentioned third method An access control method on the network side device side.
- the above-mentioned implementation embodiments of the access control method on the first network side device side, the second network side device side or the third network side device side are all applicable to the embodiments of the network side device, and can also achieve the corresponding The same technical effect.
- An embodiment of the present disclosure further provides a terminal, including a memory, a processor, and a program stored in the memory and running on the processor; when the processor executes the program, the above-mentioned connection on the terminal side is implemented. access control method.
- Embodiments of the present disclosure further provide a blockchain node, including a memory, a processor, and a program stored on the memory and executable on the processor; when the processor executes the program, the above-mentioned first step is implemented.
- the above-mentioned implementation embodiments of the access control method on the first blockchain node side or the second blockchain node side are all applicable to the embodiments of the blockchain node, and can also achieve the same technical effect. .
- An embodiment of the present disclosure further provides a readable storage medium, on which a program is stored, and when the program is executed by a processor, implements the steps in the above-mentioned access control method on the device side of the first network side; or, the program is processed When executed by the processor, the steps in the access control method on the terminal side are implemented; or, when the program is executed by the processor, the steps in the access control method on the first blockchain node side are implemented; or, the program is executed by the processor.
- the access control method on the first network side device side, the terminal side, the first blockchain node side, the second blockchain node side, the second network side device side or the third network side device side mentioned above The implementation embodiments are all applicable to the embodiments of the readable storage medium, and the corresponding same technical effects can also be achieved.
- the modules may be implemented in software so as to be executed by various types of processors.
- an identified executable code module may comprise one or more physical or logical blocks of computer instructions, which may be structured as objects, procedures, or functions, for example. Nonetheless, the executable code of the identified module need not be physically located together, but may include different instructions stored in different bits that, when logically combined, constitute the module and implement the specification of the module Purpose.
- an executable code module may be a single instruction or many instructions, and may even be distributed over multiple different code segments, among different programs, and across multiple memory devices.
- operational data may be identified within modules, and may be implemented in any suitable form and organized within any suitable type of data structure. The operational data may be collected as a single data set, or may be distributed over different locations (including over different storage devices), and may exist at least in part only as electronic signals on a system or network.
- a module When a module can be implemented by software, considering the level of existing hardware technology, a module that can be implemented by software, regardless of cost, can build corresponding hardware circuits to implement corresponding functions.
- the hardware circuits include conventional very large scale integration (VLSI) circuits or gate arrays as well as off-the-shelf semiconductors such as logic chips, transistors, or other discrete components.
- VLSI very large scale integration
- a module may also be implemented in programmable hardware devices, such as field programmable gate arrays, programmable array logic, programmable logic devices, and the like.
- the disclosed apparatus and method may be implemented in other manners.
- the apparatus embodiments described above are only illustrative.
- the division of the units is only a logical function division. In actual implementation, there may be other division methods.
- multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
- the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
- the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solutions of the embodiments of the present disclosure.
- each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
- the functions, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer-readable storage medium. Based on such understanding, the technical solutions of the present disclosure can be embodied in the form of software products in essence, or the parts that contribute to the prior art or the parts of the technical solutions.
- the computer software products are stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present disclosure.
- the aforementioned storage medium includes: a U disk, a removable hard disk, a ROM, a RAM, a magnetic disk, or an optical disk and other mediums that can store program codes.
- modules, units, sub-modules, sub-units, etc. can be implemented in one or more Application Specific Integrated Circuits (ASIC), Digital Signal Processing (DSP), digital signal processing equipment ( DSP Device, DSPD), Programmable Logic Device (Programmable Logic Device, PLD), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA), general-purpose processor, controller, microcontroller, microprocessor, for in other electronic units or combinations thereof that perform the functions described in this disclosure.
- ASIC Application Specific Integrated Circuits
- DSP Digital Signal Processing
- DSP Device digital signal processing equipment
- PLD Programmable Logic Device
- Field-Programmable Gate Array Field-Programmable Gate Array
- FPGA Field-Programmable Gate Array
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Power Engineering (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
- Telephonic Communication Services (AREA)
- Storage Device Security (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
Description
Claims (34)
- 一种接入控制方法,应用于第一网络侧设备,其中,所述方法包括:接收终端发送的对应于访问请求的待验证相关信息;其中,所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息;根据所述位置信息,从区块链中获取所述预设信息;根据所述私钥签名信息以及所述预设信息,对所述终端进行验证;在验证通过的情况下,根据所述预设信息,从区块链账本中获取所述终端的属性信息;根据所述属性信息,向所述终端反馈针对接入控制的请求响应;其中,所述预设信息包括所述终端的公钥信息,或者根据所述终端的公钥得到的第一终端标识信息,或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息,或者所述第二终端标识信息以及所述终端的公钥的散列值。
- 根据权利要求1所述的接入控制方法,其中,所述接收终端发送的对应于访问请求的待验证相关信息,包括:接收所述终端发送的访问请求,所述访问请求中携带有待验证相关信息;或者,接收所述终端发送的访问请求;根据所述访问请求,向所述终端反馈随机数;接收所述终端根据所述随机数发送的待验证相关信息。
- 根据权利要求1所述的接入控制方法,其中,在所述预设信息包括所述终端的公钥信息的情况下,所述根据所述私钥签名信息以及所述预设信息,对所述终端进行验证,包括:利用所述公钥信息对所述私钥签名信息进行验证;所述在验证通过的情况下,根据所述预设信息,从区块链账本中获取所述终端的属性信息,包括:在验证通过的情况下,根据所述公钥信息,从区块链账本中获取对应的第三终端标识信息;在获取到所述第三终端标识信息的情况下,从区块链账本中获取所述第三终端标识信息对应的属性信息作为所述终端的属性信息。
- 根据权利要求1所述的接入控制方法,其中,在所述预设信息包括所述第一终端标识信息的情况下,所述根据所述私钥签名信息以及所述预设信息,对所述终端进行验证,包括:根据所述第一终端标识信息,得到待验证的公钥信息以及从区块链账本中获取已存储的所述终端的公钥信息;根据所述终端的公钥信息,对所述待验证的公钥信息以及所述私钥签名信息进行验证;所述在验证通过的情况下,根据所述预设信息,从区块链账本中获取所述终端的属性信息,包括:在验证通过的情况下,根据所述第一终端标识信息,从区块链账本中获取所述终端的属性信息。
- 根据权利要求1所述的接入控制方法,其中,在所述预设信息包括所述第二终端标识信息以及公钥信息的情况下,所述根据所述私钥签名信息以及所述预设信息,对所述终端进行验证,包括:利用所述预设信息中的公钥信息对所述私钥签名信息进行验证;并根据所述第二终端标识信息,从区块链账本中获取已存储的所述终端的公钥信息;根据获取的所述终端的公钥信息,对所述预设信息中的公钥信息进行验证;或者,利用所述预设信息中的公钥信息对所述私钥签名信息进行验证;并根据所述第二终端标识信息,从区块链账本中获取已存储的所述终端的公钥的散列值;根据所述预设信息中的公钥信息,得到待验证的散列值;根据获取的所述终端的公钥的散列值,对所述待验证的散列值进行验证。
- 根据权利要求1所述的接入控制方法,其中,在所述预设信息包括所述第二终端标识信息以及公钥的散列值的情况下,所述根据所述私钥签名信息以及所述预设信息,对所述终端进行验证,包括:根据所述第二终端标识信息,从区块链账本中获取已存储的所述终端的公钥信息;根据所述预设信息中的公钥的散列值,得到待验证的公钥信息;根据所述待验证的公钥信息,对所述私钥签名信息进行验证;并根据获取的所述终端的公钥信息,对所述待验证的公钥信息进行验证。
- 根据权利要求1或2所述的接入控制方法,其中,所述私钥签名信息包括采用所述终端的私钥对时间戳的第一签名信息,或者,采用所述终端的私钥对所述第一网络侧设备响应于访问请求发送的随机数的第二签名信息;在所述私钥签名信息包括第一签名信息的情况下,所述待验证相关信息还包括所述时间戳;所述根据所述私钥签名信息以及所述预设信息,对所述终端进行验证,包括:确认所述时间戳是否处于有效期内;在所述时间戳处于有效期内的情况下,根据所述私钥签名信息以及所述预设信息,对所述终端进行验证。
- 根据权利要求1所述的接入控制方法,其中,所述预设信息还包括第一信息的有效期信息;所述第一信息包括所述属性信息、所述第一终端标识信息以及所述第二终端标识信息中的至少一项;所述根据所述私钥签名信息以及所述预设信息,对所述终端进行验证,包括:根据所述有效期信息,确认所述第一信息是否处于有效期内;在所述第一信息处于有效期内的情况下,根据所述私钥签名信息以及所述预设信息中除所述有效期信息外的其他信息,对所述终端进行验证。
- 根据权利要求1所述的接入控制方法,其中,与所述终端相关的至少一个认证信息在所述区块链账本中存储为采用第一密钥加密的加密信息;所述待验证相关信息还包括使用所述第一网络侧设备的公钥加密的所述第一密钥;在根据所述属性信息,向所述终端反馈针对接入控制的请求响应之前,还包括:使用所述第一网络侧设备的私钥对所述公钥加密的所述第一密钥进行解密,得到所述第一密钥;根据所述第一密钥,针对从所述区块链账本中获取的所述加密信息进行解密,得到所述至少一个认证信息;其中,所述至少一个认证信息包括:所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息,以及,所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
- 根据权利要求9所述的接入控制方法,其中,所述至少一个认证信息还包括:所述终端对应的时间戳;和/或,第二信息的有效期信息;其中,所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳;所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
- 一种接入控制方法,应用于终端,其中,所述方法包括:向第一网络侧设备发送对应于访问请求的待验证相关信息;其中,所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息;接收所述第一网络侧设备反馈的针对接入控制的请求响应;其中,所述预设信息包括所述终端的公钥信息,或者根据所述终端的公钥得到的第一终端标识信息,或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息,或者所述第二终端标识信息以及所述终端的公钥的散列值。
- 根据权利要求11所述的接入控制方法,其中,所述向第一网络侧设备发送对应于访问请求的待验证相关信息,包括:向第一网络侧设备发送访问请求,所述访问请求中携带有待验证相关信息;或者,向第一网络侧设备发送访问请求;接收所述第一网络侧设备根据所述访问请求反馈的随机数;根据所述随机数,向所述第一网络侧设备发送待验证相关信息。
- 根据权利要求11或12所述的接入控制方法,其中,所述私钥签名信息包括采用所述终端的私钥对时间戳的第一签名信息,或者,采用所述终端的私钥对所述第一网络侧设备响应于访问请求发送的随机数的第二签名信息;在所述私钥签名信息包括第一签名信息的情况下,所述待验证相关信息还包括所述时间戳。
- 根据权利要求11所述的接入控制方法,其中,所述预设信息还包括第一信息的有效期信息;所述第一信息包括所述终端的属性信息、所述第一终端标识信息以及所述第二终端标识信息中的至少一项。
- 根据权利要求11所述的接入控制方法,其中,与所述终端相关的至少一个认证信息在区块链账本中存储为采用第一密钥加密的加密信息;所述待验证相关信息还包括使用所述第一网络侧设备的公钥加密的所述第一密钥;其中,所述至少一个认证信息包括:所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息,以及,所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
- 根据权利要求15所述的接入控制方法,其中,所述至少一个认证信息还包括:所述终端对应的时间戳;和/或,第二信息的有效期信息;其中,所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳;所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
- 根据权利要求11所述的接入控制方法,其中,在向第一网络侧设备发送对应于访问请求的待验证相关信息之前,还包括:向第一区块链节点发送所述终端的待认证信息;其中,所述待认证信息包括用户凭证信息和/或属性信息;所述用户凭证信息包括终端标识信息。
- 一种接入控制方法,应用于第一区块链节点,其中,所述方法包括:接收终端发送的待认证信息;对所述待认证信息进行认证;在认证通过的情况下,将与所述待认证信息对应的至少一个认证信息存储在区块链账本中;其中,所述待认证信息包括用户凭证信息和/或属性信息;所述用户凭证信息包括终端标识信息;所述至少一个认证信息包括:所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息,以及,所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
- 根据权利要求18所述的接入控制方法,其中,所述至少一个认证信息还包括:所述终端对应的时间戳;和/或,第二信息的有效期信息;其中,所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳;所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
- 根据权利要求18所述的接入控制方法,其中,所述在认证通过的情况下,将与所述待认证信息对应的至少一个认证信息存储在区块链账本中,包括:随机生成用于加密的第一密钥;使用所述第一密钥对所述至少一个认证信息进行加密后存储在区块链账本中。
- 根据权利要求20所述的接入控制方法,其中,在随机生成用于加密的第一密钥之后,还包括:使用所述终端的公钥对所述第一密钥加密后存储在区块链账本中。
- 根据权利要求18所述的接入控制方法,其中,所述对所述待认证信息进行认证,包括:根据第一预设策略,将所述待认证信息中的用户凭证信息发送给至少一 个第二网络侧设备进行认证;接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息;根据第二预设策略、所述第一认证结果以及第三签名信息,得到所述用户凭证信息是否认证通过的第一最终结果。
- 根据权利要求18所述的接入控制方法,其中,所述对所述待认证信息进行认证,包括:根据第一预设策略,将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证;接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息;根据第三预设策略、所述第二认证结果以及第四签名信息,得到所述属性信息是否认证通过的第二最终结果。
- 根据权利要求18所述的接入控制方法,其中,所述对所述待认证信息进行认证,包括:将所述待认证信息发送给第二区块链节点;接收所述第二区块链节点反馈的与所述待认证信息中的用户凭证信息对应的第一认证结果以及对应的第三签名信息;并根据第二预设策略、所述第一认证结果以及第三签名信息,得到所述用户凭证信息是否认证通过的第一最终结果;和/或,接收所述第二区块链节点反馈的与所述待认证信息中的属性信息对应的第二认证结果以及对应的第四签名信息;并根据第三预设策略、所述第二认证结果以及第四签名信息,得到所述属性信息是否认证通过的第二最终结果。
- 一种接入控制装置,应用于第一网络侧设备,其中,所述接入控制装置包括:第一接收模块,用于接收终端发送的对应于访问请求的待验证相关信息;其中,所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息;第一获取模块,用于根据所述位置信息,从区块链中获取所述预设信息;第一验证模块,用于根据所述私钥签名信息以及所述预设信息,对所述终端进行验证;第二接收模块,用于在验证通过的情况下,根据所述预设信息,从区块链账本中获取所述终端的属性信息;第一反馈模块,用于根据所述属性信息,向所述终端反馈针对接入控制的请求响应;其中,所述预设信息包括所述终端的公钥信息,或者根据所述终端的公钥得到的第一终端标识信息,或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息,或者所述第二终端标识信息以及所述终端的公钥的散列值。
- 一种接入控制装置,应用于终端,其中,所述接入控制装置包括:第一发送模块,用于向第一网络侧设备发送对应于访问请求的待验证相关信息;其中,所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息;第三接收模块,用于接收所述第一网络侧设备反馈的针对接入控制的请求响应;其中,所述预设信息包括所述终端的公钥信息,或者根据所述终端的公钥得到的第一终端标识信息,或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息,或者所述第二终端标识信息以及所述终端的公钥的散列值。
- 一种接入控制装置,应用于第一区块链节点,其中,所述接入控制装置包括:第四接收模块,用于接收终端发送的待认证信息;第一认证模块,用于对所述待认证信息进行认证;第一存储模块,用于在认证通过的情况下,将与所述待认证信息对应的至少一个认证信息存储在区块链账本中;其中,所述待认证信息包括用户凭证信息和/或属性信息;所述用户凭证信息包括终端标识信息;所述至少一个认证信息包括:所述终端的属性信息、根据所述终端的公 钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息,以及,所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
- 一种网络侧设备,所述网络侧设备为第一网络侧设备,包括:处理器和收发机;所述处理器,用于通过所述收发机接收终端发送的对应于访问请求的待验证相关信息;其中,所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息;根据所述位置信息,从区块链中获取所述预设信息;根据所述私钥签名信息以及所述预设信息,对所述终端进行验证;在验证通过的情况下,根据所述预设信息,从区块链账本中获取所述终端的属性信息;根据所述属性信息,通过所述收发机向所述终端反馈针对接入控制的请求响应;其中,所述预设信息包括所述终端的公钥信息,或者根据所述终端的公钥得到的第一终端标识信息,或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息,或者所述第二终端标识信息以及所述终端的公钥的散列值。
- 一种终端,包括:处理器和收发机;所述处理器,用于通过所述收发机向第一网络侧设备发送对应于访问请求的待验证相关信息;其中,所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息;通过所述收发机接收所述第一网络侧设备反馈的针对接入控制的请求响应;其中,所述预设信息包括所述终端的公钥信息,或者根据所述终端的公钥得到的第一终端标识信息,或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息,或者所述第二终端标识信息以及所述终端的公钥的散列值。
- 一种区块链节点,所述区块链节点为第一区块链节点,包括:处理 器和收发机;所述处理器,用于通过所述收发机接收终端发送的待认证信息;对所述待认证信息进行认证;在认证通过的情况下,将与所述待认证信息对应的至少一个认证信息存储在区块链账本中;其中,所述待认证信息包括用户凭证信息和/或属性信息;所述用户凭证信息包括终端标识信息;所述至少一个认证信息包括:所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息,以及,所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
- 一种网络侧设备,包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序;其中,所述处理器执行所述程序时实现如权利要求1至10中任一项所述的接入控制方法。
- 一种终端,包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序;其中,所述处理器执行所述程序时实现如权利要求11至17中任一项所述的接入控制方法。
- 一种区块链节点,包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序;其中,所述处理器执行所述程序时实现如权利要求18至24中任一项所述的接入控制方法。
- 一种可读存储介质,其上存储有程序,其中,该程序被处理器执行时实现如权利要求1至10中任一项所述的接入控制方法中的步骤;或者,该程序被处理器执行时实现如权利要求11至17中任一项所述的接入控制方法中的步骤;或者,该程序被处理器执行时实现如权利要求18至24中任一项所述的接入控制方法中的步骤。
Priority Applications (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP21914235.3A EP4274192A1 (en) | 2020-12-29 | 2021-12-27 | Access control method and apparatus, and network-side device, terminal and blockchain node |
JP2023539818A JP2024501326A (ja) | 2020-12-29 | 2021-12-27 | アクセス制御方法、装置、ネットワーク側機器、端末及びブロックチェーンノード |
US18/259,518 US20240064021A1 (en) | 2020-12-29 | 2021-12-27 | Access control method, apparatus, network side device, terminal and blockchain node |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202011591112.0 | 2020-12-29 | ||
CN202011591112.0A CN114697061B (zh) | 2020-12-29 | 2020-12-29 | 接入控制方法、装置、网络侧设备、终端及区块链节点 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2022143498A1 true WO2022143498A1 (zh) | 2022-07-07 |
Family
ID=82132066
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2021/141520 WO2022143498A1 (zh) | 2020-12-29 | 2021-12-27 | 接入控制方法、装置、网络侧设备、终端及区块链节点 |
Country Status (5)
Country | Link |
---|---|
US (1) | US20240064021A1 (zh) |
EP (1) | EP4274192A1 (zh) |
JP (1) | JP2024501326A (zh) |
CN (1) | CN114697061B (zh) |
WO (1) | WO2022143498A1 (zh) |
Families Citing this family (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN115277021A (zh) * | 2022-07-29 | 2022-11-01 | 蚂蚁区块链科技(上海)有限公司 | 一种防范网络攻击的方法及装置 |
CN116032591B (zh) * | 2022-12-23 | 2024-07-19 | 迈普通信技术股份有限公司 | 一种哑终端仿冒识别方法及*** |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN108702622A (zh) * | 2017-11-30 | 2018-10-23 | 深圳前海达闼云端智能科技有限公司 | 移动网络接入认证方法、装置、存储介质及区块链节点 |
CN109495516A (zh) * | 2019-01-07 | 2019-03-19 | 国网江苏省电力有限公司无锡供电分公司 | 基于区块链的电力物联网终端接入方法 |
WO2020141783A1 (ko) * | 2018-12-31 | 2020-07-09 | 주식회사 코인플러그 | 블록체인 네트워크를 이용하여 사용자의 아이덴티티를 관리하는 방법 및 서버, 그리고, 블록체인 네트워크 기반의 사용자 아이덴티티를 이용하여 사용자를 인증하는 방법 및 단말 |
CN111601280A (zh) * | 2020-05-14 | 2020-08-28 | 中国联合网络通信集团有限公司 | 一种接入验证方法及装置 |
Family Cites Families (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
KR101919586B1 (ko) * | 2017-05-10 | 2018-11-16 | 주식회사 코인플러그 | 블록체인 기반의 사물 인터넷 기기에 대한 비용을 결제하는 방법, 이를 이용한 서버, 서비스 제공 단말, 및 사용자 전자 지갑 |
WO2018214133A1 (zh) * | 2017-05-25 | 2018-11-29 | 深圳前海达闼云端智能科技有限公司 | 基于区块链的fido认证方法、装置及*** |
KR102254499B1 (ko) * | 2018-03-30 | 2021-05-21 | 주식회사 코인플러그 | 블록체인 기반의 권한 인증 방법, 단말 및 이를 이용한 서버 |
CN110493007B (zh) * | 2019-09-06 | 2021-07-13 | 腾讯科技(深圳)有限公司 | 一种基于区块链的信息验证方法、装置、设备及存储介质 |
CN111949953B (zh) * | 2020-06-23 | 2021-10-22 | 卓尔智联(武汉)研究院有限公司 | 基于区块链的身份认证方法、***、装置和计算机设备 |
CN112039872B (zh) * | 2020-08-28 | 2022-07-05 | 武汉见邦融智科技有限公司 | 基于区块链的跨域匿名认证方法及*** |
-
2020
- 2020-12-29 CN CN202011591112.0A patent/CN114697061B/zh active Active
-
2021
- 2021-12-27 JP JP2023539818A patent/JP2024501326A/ja active Pending
- 2021-12-27 US US18/259,518 patent/US20240064021A1/en active Pending
- 2021-12-27 EP EP21914235.3A patent/EP4274192A1/en active Pending
- 2021-12-27 WO PCT/CN2021/141520 patent/WO2022143498A1/zh active Application Filing
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN108702622A (zh) * | 2017-11-30 | 2018-10-23 | 深圳前海达闼云端智能科技有限公司 | 移动网络接入认证方法、装置、存储介质及区块链节点 |
WO2020141783A1 (ko) * | 2018-12-31 | 2020-07-09 | 주식회사 코인플러그 | 블록체인 네트워크를 이용하여 사용자의 아이덴티티를 관리하는 방법 및 서버, 그리고, 블록체인 네트워크 기반의 사용자 아이덴티티를 이용하여 사용자를 인증하는 방법 및 단말 |
CN109495516A (zh) * | 2019-01-07 | 2019-03-19 | 国网江苏省电力有限公司无锡供电分公司 | 基于区块链的电力物联网终端接入方法 |
CN111601280A (zh) * | 2020-05-14 | 2020-08-28 | 中国联合网络通信集团有限公司 | 一种接入验证方法及装置 |
Also Published As
Publication number | Publication date |
---|---|
EP4274192A1 (en) | 2023-11-08 |
JP2024501326A (ja) | 2024-01-11 |
CN114697061B (zh) | 2023-05-09 |
US20240064021A1 (en) | 2024-02-22 |
CN114697061A (zh) | 2022-07-01 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
JP6941146B2 (ja) | データセキュリティサービス | |
CN110537346B (zh) | 安全去中心化域名*** | |
US8196186B2 (en) | Security architecture for peer-to-peer storage system | |
US20130145447A1 (en) | Cloud-based data backup and sync with secure local storage of access keys | |
US20100250921A1 (en) | Authorizing a Login Request of a Remote Device | |
TW201918049A (zh) | 可信遠端證明方法、裝置和系統 | |
CN108173827B (zh) | 基于区块链思维的分布式sdn控制平面安全认证方法 | |
CN101588245A (zh) | 一种身份认证的方法、***及存储设备 | |
WO2022143498A1 (zh) | 接入控制方法、装置、网络侧设备、终端及区块链节点 | |
US11218317B1 (en) | Secure enclave implementation of proxied cryptographic keys | |
US11418329B1 (en) | Shared secret implementation of proxied cryptographic keys | |
CN112733129B (zh) | 一种服务器带外管理的可信接入方法 | |
US11804957B2 (en) | Exporting remote cryptographic keys | |
JP2001186122A (ja) | 認証システム及び認証方法 | |
CN114175574A (zh) | 无线安全协议 | |
CN113557689A (zh) | 用管理器设备初始化数据存储设备 | |
WO2022143935A1 (zh) | 基于区块链的sdp访问控制方法及*** | |
JP2022534677A (ja) | ブロックチェーンを使用するオンラインアプリケーションおよびウェブページの保護 | |
Khan et al. | A brief review on cloud computing authentication frameworks | |
JP6266170B2 (ja) | 3層セキュリティおよび算出アーキテクチャ | |
WO2022143898A1 (zh) | 基于区块链的sdp访问控制方法及装置 | |
Tan et al. | A universal decentralized authentication and authorization protocol based on blockchain | |
CN114039748A (zh) | 身份验证方法、***、计算机设备和存储介质 | |
TW202116038A (zh) | 電子裝置之認證方法及系統 | |
Chen et al. | SSL/TLS session-aware user authentication using a gaa bootstrapped key |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 21914235 Country of ref document: EP Kind code of ref document: A1 |
|
WWE | Wipo information: entry into national phase |
Ref document number: 18259518 Country of ref document: US |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2023539818 Country of ref document: JP |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
ENP | Entry into the national phase |
Ref document number: 2021914235 Country of ref document: EP Effective date: 20230731 |