WO2022143498A1 - 接入控制方法、装置、网络侧设备、终端及区块链节点 - Google Patents

接入控制方法、装置、网络侧设备、终端及区块链节点 Download PDF

Info

Publication number
WO2022143498A1
WO2022143498A1 PCT/CN2021/141520 CN2021141520W WO2022143498A1 WO 2022143498 A1 WO2022143498 A1 WO 2022143498A1 CN 2021141520 W CN2021141520 W CN 2021141520W WO 2022143498 A1 WO2022143498 A1 WO 2022143498A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
terminal
public key
authentication
preset
Prior art date
Application number
PCT/CN2021/141520
Other languages
English (en)
French (fr)
Inventor
阎军智
杨波
粟栗
Original Assignee
***通信有限公司研究院
***通信集团有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ***通信有限公司研究院, ***通信集团有限公司 filed Critical ***通信有限公司研究院
Priority to EP21914235.3A priority Critical patent/EP4274192A1/en
Priority to JP2023539818A priority patent/JP2024501326A/ja
Priority to US18/259,518 priority patent/US20240064021A1/en
Publication of WO2022143498A1 publication Critical patent/WO2022143498A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/121—Timestamp

Definitions

  • the present disclosure relates to the field of communication technologies, and in particular, to an access control method, an apparatus, a network side device, a terminal, and a blockchain node.
  • Access control refers to the means by which the system restricts the user's ability to use data resources on the user's identity and the policy group to which it belongs. Access control is an important basis for system confidentiality, integrity, availability, and legal use, and is one of the key strategies for network security and resource protection. Authorized access.
  • the main purpose of access control is to limit the access of the access subject to the object, so as to ensure the effective use and management of data resources within the legal scope.
  • a system administrator controls user access to network resources such as servers, directories, and files.
  • access control needs to complete two tasks: identifying and confirming the user accessing the system, and determining what type of access the user can perform to a certain system resource.
  • the access control function can be implemented in the object, or a centralized device can be deployed to implement access control.
  • the access subject initiates a request to the centralized access control system. After authentication and authorization, the access subject initiates access to the object.
  • the access control system is a centralized device; however, it is exposed to the network and is vulnerable to network attacks such as Distributed Denial of Service (DDoS). Once the controller is attacked by the network to stop the service, it may cause the whole system to fail to operate normally.
  • DDoS Distributed Denial of Service
  • the purpose of the present disclosure is to provide an access control method, device, network-side device, terminal and blockchain node, so as to solve the problem in the related art that the traditional authentication server suffers from DDoS attacks and causes a single point of failure.
  • an embodiment of the present disclosure provides an access control method, which is applied to a first network side device, including:
  • the relevant information to be verified includes the private key signature information of the terminal and the location information of the preset information in the blockchain;
  • the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
  • the relevant information to be verified corresponding to the access request sent by the receiving terminal includes:
  • the verifying the terminal according to the private key signature information and the preset information includes:
  • the attribute information of the terminal is obtained from the blockchain ledger, including:
  • the attribute information corresponding to the identification information of the third terminal is obtained from the blockchain ledger as the attribute information of the terminal.
  • the verifying the terminal according to the private key signature information and the preset information includes:
  • the first terminal identification information obtain the public key information to be verified and obtain the stored public key information of the terminal from the blockchain ledger;
  • the attribute information of the terminal is obtained from the blockchain ledger according to the preset information, including:
  • the attribute information of the terminal is obtained from the blockchain ledger according to the identification information of the first terminal.
  • the verification of the terminal according to the private key signature information and the preset information includes: :
  • the terminal is executed according to the private key signature information and the preset information.
  • Validation including:
  • the identification information of the second terminal obtain the stored public key information of the terminal from the blockchain ledger;
  • the private key signature information is verified according to the public key information to be verified; and the public key information to be verified is verified according to the acquired public key information of the terminal.
  • the attribute information of the terminal is obtained from the blockchain ledger according to the preset information, including:
  • the attribute information of the terminal is obtained from the blockchain ledger according to the identification information of the second terminal.
  • the private key signature information includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
  • the second signature information of the random number includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
  • the relevant information to be verified further includes the timestamp
  • the verifying the terminal according to the private key signature information and the preset information includes:
  • the terminal is verified according to the private key signature information and the preset information.
  • the preset information further includes validity period information of the first information; the first information includes at least one of the attribute information, the first terminal identification information and the second terminal identification information;
  • the verifying the terminal according to the private key signature information and the preset information includes:
  • the validity period information confirm whether the first information is within the validity period
  • the terminal is verified according to the private key signature information and other information in the preset information except the validity period information.
  • At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes using the first network side device. the first key encrypted by the public key;
  • the method Before feeding back a request response for access control to the terminal according to the attribute information, the method further includes:
  • the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information irrelevant to the public key of the terminal, or identification information related to the terminal.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
  • the time stamp is a time stamp obtained by signing with the private key of the terminal to obtain the first signature information
  • the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
  • the embodiments of the present disclosure also provide an access control method, which is applied to a terminal, including:
  • the relevant information to be verified includes the private key signature information of the terminal and the location information of the preset information in the blockchain;
  • the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
  • the sending the relevant information to be verified corresponding to the access request to the first network side device includes:
  • the relevant information to be verified is sent to the first network side device.
  • the private key signature information includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
  • the second signature information of the random number includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
  • the relevant information to be verified further includes the timestamp.
  • the preset information further includes validity period information of the first information; the first information includes at least one of attribute information of the terminal, identification information of the first terminal, and identification information of the second terminal. item.
  • At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes public information using the first network side device. the first key encrypted by the key;
  • the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information irrelevant to the public key of the terminal, or identification information related to the terminal.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
  • the time stamp is a time stamp obtained by signing with the private key of the terminal to obtain the first signature information
  • the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
  • the method before sending the relevant information to be verified corresponding to the access request to the first network-side device, the method further includes:
  • the to-be-authenticated information includes user credential information and/or attribute information; the user credential information includes terminal identification information.
  • Embodiments of the present disclosure also provide an access control method, which is applied to the first blockchain node, including:
  • At least one authentication information corresponding to the information to be authenticated is stored in the blockchain ledger;
  • the to-be-authenticated information includes user credential information and/or attribute information;
  • the user credential information includes terminal identification information;
  • the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, or identification information related to the terminal.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
  • the time stamp is a time stamp obtained by signing with the private key of the terminal to obtain the first signature information
  • the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
  • At least one authentication information corresponding to the to-be-authenticated information is stored in the blockchain ledger, including:
  • the at least one authentication information is encrypted using the first key and stored in the blockchain ledger.
  • the method further includes:
  • the first key is encrypted with the public key of the terminal and stored in the blockchain ledger.
  • the performing authentication on the information to be authenticated includes:
  • the first preset policy send the user credential information in the to-be-authenticated information to at least one second network-side device for authentication;
  • the first authentication result and the third signature information a first final result of whether the authentication of the user credential information is passed is obtained.
  • the performing authentication on the information to be authenticated includes:
  • the attribute information in the information to be authenticated is sent to at least one third network-side device for authentication;
  • the second authentication result and the fourth signature information a second final result of whether the attribute information is authenticated is obtained.
  • the performing authentication on the to-be-authenticated information includes:
  • Embodiments of the present disclosure also provide an access control method, which is applied to a second blockchain node, including:
  • the user credential information includes terminal identification information.
  • the embodiment of the present disclosure also provides an access control method, which is applied to the second network side device, including:
  • the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node;
  • the user credential information includes terminal identification information.
  • the embodiments of the present disclosure also provide an access control method, which is applied to a third network side device, including:
  • the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node.
  • the embodiment of the present disclosure further provides an access control apparatus, which is applied to the first network side device, including:
  • the first receiving module is configured to receive the relevant information to be verified corresponding to the access request sent by the terminal; wherein, the relevant information to be verified includes the private key signature information of the terminal and the location information of the preset information in the blockchain ;
  • a first obtaining module configured to obtain the preset information from the blockchain according to the location information
  • a first verification module configured to verify the terminal according to the private key signature information and the preset information
  • the second receiving module is configured to obtain the attribute information of the terminal from the blockchain ledger according to the preset information when the verification is passed;
  • a first feedback module configured to feed back a request response for access control to the terminal according to the attribute information
  • the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
  • the relevant information to be verified corresponding to the access request sent by the receiving terminal includes:
  • the verifying the terminal according to the private key signature information and the preset information includes:
  • the attribute information of the terminal is obtained from the blockchain ledger according to the preset information, including:
  • the attribute information corresponding to the identification information of the third terminal is obtained from the blockchain ledger as the attribute information of the terminal.
  • the verifying the terminal according to the private key signature information and the preset information includes:
  • the first terminal identification information obtain the public key information to be verified and obtain the stored public key information of the terminal from the blockchain ledger;
  • the attribute information of the terminal is obtained from the blockchain ledger according to the preset information, including:
  • the attribute information of the terminal is obtained from the blockchain ledger according to the identification information of the first terminal.
  • the verification of the terminal according to the private key signature information and the preset information includes: :
  • the terminal is executed according to the private key signature information and the preset information.
  • Validation including:
  • the identification information of the second terminal obtain the stored public key information of the terminal from the blockchain ledger;
  • the private key signature information is verified according to the public key information to be verified; and the public key information to be verified is verified according to the acquired public key information of the terminal.
  • the attribute information of the terminal is obtained from the blockchain ledger according to the preset information, including:
  • the attribute information of the terminal is obtained from the blockchain ledger according to the identification information of the second terminal.
  • the private key signature information includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
  • the second signature information of the random number includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
  • the relevant information to be verified further includes the timestamp
  • the verifying the terminal according to the private key signature information and the preset information includes:
  • the terminal is verified according to the private key signature information and the preset information.
  • the preset information further includes validity period information of the first information; the first information includes at least one of the attribute information, the first terminal identification information and the second terminal identification information;
  • the verifying the terminal according to the private key signature information and the preset information includes:
  • the validity period information confirm whether the first information is within the validity period
  • the terminal is verified according to the private key signature information and other information in the preset information except the validity period information.
  • At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes using the first network side device. the first key encrypted by the public key;
  • the access control device further includes:
  • a first decryption module configured to use the private key of the first network-side device to encrypt the first decryption with the public key before feeding back a request response for access control to the terminal according to the attribute information. decrypting the key to obtain the first key;
  • a second decryption module configured to decrypt the encrypted information obtained from the blockchain ledger according to the first key to obtain the at least one authentication information
  • the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information irrelevant to the public key of the terminal, or identification information related to the terminal.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
  • the time stamp is a time stamp using the private key of the terminal to sign to obtain the first signature information
  • the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
  • the embodiments of the present disclosure also provide an access control apparatus, which is applied to a terminal, including:
  • a first sending module configured to send the relevant information to be verified corresponding to the access request to the first network side device; wherein the relevant information to be verified includes the private key signature information of the terminal and preset information in the blockchain location information;
  • a third receiving module configured to receive a request response for access control fed back by the first network-side device
  • the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
  • the sending the relevant information to be verified corresponding to the access request to the first network side device includes:
  • the relevant information to be verified is sent to the first network side device.
  • the private key signature information includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
  • the second signature information of the random number includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
  • the relevant information to be verified further includes the timestamp.
  • the preset information further includes validity period information of the first information; the first information includes at least one of attribute information of the terminal, identification information of the first terminal, and identification information of the second terminal. item.
  • At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes public information using the first network side device. the first key encrypted by the key;
  • the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information irrelevant to the public key of the terminal, or identification information related to the terminal.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
  • the time stamp is a time stamp obtained by signing with the private key of the terminal to obtain the first signature information
  • the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
  • a second sending module configured to send the to-be-authenticated information of the terminal to the first blockchain node before sending the to-be-verified related information corresponding to the access request to the first network-side device;
  • the to-be-authenticated information includes user credential information and/or attribute information; the user credential information includes terminal identification information.
  • Embodiments of the present disclosure also provide an access control device, which is applied to the first blockchain node, including:
  • a fourth receiving module configured to receive the information to be authenticated sent by the terminal
  • a first authentication module configured to authenticate the information to be authenticated
  • a first storage module configured to store at least one authentication information corresponding to the information to be authenticated in the blockchain ledger when the authentication is passed;
  • the to-be-authenticated information includes user credential information and/or attribute information;
  • the user credential information includes terminal identification information;
  • the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, or identification information related to the terminal.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
  • the time stamp is a time stamp obtained by signing with the private key of the terminal to obtain the first signature information
  • the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
  • At least one authentication information corresponding to the to-be-authenticated information is stored in the blockchain ledger, including:
  • the at least one authentication information is encrypted using the first key and stored in the blockchain ledger.
  • the first processing module is configured to encrypt the first key with the public key of the terminal after randomly generating the first key for encryption, and store the first key in the blockchain ledger.
  • the performing authentication on the information to be authenticated includes:
  • the first preset policy send the user credential information in the to-be-authenticated information to at least one second network-side device for authentication;
  • the first authentication result and the third signature information a first final result of whether the authentication of the user credential information is passed is obtained.
  • the performing authentication on the information to be authenticated includes:
  • the attribute information in the information to be authenticated is sent to at least one third network-side device for authentication;
  • the second authentication result and the fourth signature information a second final result of whether the attribute information is authenticated is obtained.
  • the performing authentication on the information to be authenticated includes:
  • Embodiments of the present disclosure also provide an access control device, which is applied to a second blockchain node, including:
  • a fifth receiving module configured to receive the information to be authenticated of the terminal sent by the first blockchain node
  • the second processing module is configured to send the user credential information in the information to be authenticated to at least one second network side device for authentication, and receive the first authentication result fed back by the at least one second network side device and the corresponding third signature information, fed back to the first blockchain node; and/or,
  • a third processing module configured to send the attribute information in the information to be authenticated to at least one third network-side device for authentication, and receive the second authentication result fed back by the at least one third network-side device and the corresponding first authentication result.
  • Four signature information which is fed back to the first blockchain node;
  • the user credential information includes terminal identification information.
  • An embodiment of the present disclosure further provides an access control apparatus, which is applied to a second network side device, including:
  • the sixth receiving module is used to receive the user credential information of the terminal to be authenticated sent by the blockchain node;
  • a fourth processing module configured to authenticate the user credential information, obtain a first authentication result, and sign with the third signature information
  • a second feedback module configured to feed back the first authentication result and the third signature information to the blockchain node
  • the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node;
  • the user credential information includes terminal identification information.
  • An embodiment of the present disclosure further provides an access control apparatus, which is applied to a third network side device, including:
  • a seventh receiving module configured to receive the attribute information of the terminal to be authenticated sent by the blockchain node
  • a fifth processing module configured to authenticate the attribute information, obtain a second authentication result, and use the fourth signature information to sign
  • a third feedback module configured to feed back the second authentication result and the fourth signature information to the blockchain node
  • the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node.
  • An embodiment of the present disclosure further provides a network side device, where the network side device is a first network side device, including: a processor and a transceiver;
  • the processor is configured to receive the relevant information to be verified corresponding to the access request sent by the terminal through the transceiver; wherein, the relevant information to be verified includes the private key signature information of the terminal and the preset information in the block. location information in the chain;
  • the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
  • the relevant information to be verified corresponding to the access request sent by the receiving terminal includes:
  • the verifying the terminal according to the private key signature information and the preset information includes:
  • the attribute information of the terminal is obtained from the blockchain ledger according to the preset information, including:
  • the attribute information corresponding to the identification information of the third terminal is obtained from the blockchain ledger as the attribute information of the terminal.
  • the verifying the terminal according to the private key signature information and the preset information includes:
  • the first terminal identification information obtain the public key information to be verified and obtain the stored public key information of the terminal from the blockchain ledger;
  • the attribute information of the terminal is obtained from the blockchain ledger according to the preset information, including:
  • the attribute information of the terminal is obtained from the blockchain ledger according to the identification information of the first terminal.
  • the verification of the terminal according to the private key signature information and the preset information includes: :
  • the terminal is executed according to the private key signature information and the preset information.
  • Validation including:
  • the identification information of the second terminal obtain the stored public key information of the terminal from the blockchain ledger;
  • the private key signature information is verified according to the public key information to be verified; and the public key information to be verified is verified according to the acquired public key information of the terminal.
  • the attribute information of the terminal is obtained from the blockchain ledger according to the preset information, including:
  • the attribute information of the terminal is obtained from the blockchain ledger according to the identification information of the second terminal.
  • the private key signature information includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
  • the second signature information of the random number includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
  • the relevant information to be verified further includes the timestamp
  • the verifying the terminal according to the private key signature information and the preset information includes:
  • the terminal is verified according to the private key signature information and the preset information.
  • the preset information further includes validity period information of the first information; the first information includes at least one of the attribute information, the first terminal identification information and the second terminal identification information;
  • the verifying the terminal according to the private key signature information and the preset information includes:
  • the validity period information confirm whether the first information is within the validity period
  • the terminal is verified according to the private key signature information and other information in the preset information except the validity period information.
  • At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes using the first network side device. the first key encrypted by the public key;
  • the processor is also used to:
  • the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information irrelevant to the public key of the terminal, or identification information related to the terminal.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
  • the time stamp is a time stamp obtained by signing with the private key of the terminal to obtain the first signature information
  • the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
  • An embodiment of the present disclosure also provides a terminal, including: a processor and a transceiver;
  • the processor is configured to send the relevant information to be verified corresponding to the access request to the first network side device through the transceiver; wherein the relevant information to be verified includes the private key signature information and preset information of the terminal Location information in the blockchain;
  • the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
  • the sending the relevant information to be verified corresponding to the access request to the first network side device includes:
  • the relevant information to be verified is sent to the first network side device.
  • the private key signature information includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
  • the second signature information of the random number includes the first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the first network-side device sent in response to the access request.
  • the relevant information to be verified further includes the timestamp.
  • the preset information further includes validity period information of the first information; the first information includes at least one of attribute information of the terminal, identification information of the first terminal, and identification information of the second terminal. item.
  • At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes public information using the first network side device. the first key encrypted by the key;
  • the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information irrelevant to the public key of the terminal, or identification information related to the terminal.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
  • the time stamp is a time stamp obtained by signing with the private key of the terminal to obtain the first signature information
  • the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
  • the processor is also used for:
  • the to-be-authenticated information includes user credential information and/or attribute information; the user credential information includes terminal identification information.
  • Embodiments of the present disclosure also provide a blockchain node, where the blockchain node is a first blockchain node, including: a processor and a transceiver;
  • the processor configured to receive the information to be authenticated sent by the terminal through the transceiver;
  • At least one authentication information corresponding to the information to be authenticated is stored in the blockchain ledger;
  • the to-be-authenticated information includes user credential information and/or attribute information;
  • the user credential information includes terminal identification information;
  • the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, or identification information related to the terminal.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or,
  • the time stamp is a time stamp obtained by signing with the private key of the terminal to obtain the first signature information
  • the second information includes at least one item of the attribute information, first terminal identification information, second terminal identification information, and third terminal identification information.
  • At least one authentication information corresponding to the to-be-authenticated information is stored in the blockchain ledger, including:
  • the at least one authentication information is encrypted using the first key and stored in the blockchain ledger.
  • the processor is also used for:
  • the first key for encryption is randomly generated, the first key is encrypted with the public key of the terminal and stored in the blockchain ledger.
  • the performing authentication on the information to be authenticated includes:
  • the first preset policy send the user credential information in the to-be-authenticated information to at least one second network-side device for authentication;
  • the first authentication result and the third signature information a first final result of whether the authentication of the user credential information is passed is obtained.
  • the performing authentication on the information to be authenticated includes:
  • the attribute information in the information to be authenticated is sent to at least one third network-side device for authentication;
  • the second authentication result and the fourth signature information a second final result of whether the attribute information is authenticated is obtained.
  • the performing authentication on the information to be authenticated includes:
  • Embodiments of the present disclosure also provide a blockchain node, where the blockchain node is a second blockchain node, including: a processor and a transceiver;
  • the processor configured to receive the information to be authenticated of the terminal sent by the first blockchain node through the transceiver;
  • the transceiver sends the user credential information in the information to be authenticated to at least one second network-side device for authentication, and receives the first authentication result and the corresponding third authentication result fed back by the at least one second network-side device.
  • signature information which is fed back to the first blockchain node; and/or,
  • the transceiver sends the attribute information in the information to be authenticated to at least one third network side device for authentication, and receives the second authentication result and the corresponding fourth signature fed back by the at least one third network side device information, which is fed back to the first blockchain node;
  • the user credential information includes terminal identification information.
  • An embodiment of the present disclosure further provides a network side device, where the network side device is a second network side device, including: a processor and a transceiver;
  • the processor configured to receive, through the transceiver, the user credential information of the terminal to be authenticated sent by the blockchain node;
  • the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node;
  • the user credential information includes terminal identification information.
  • An embodiment of the present disclosure further provides a network side device, where the network side device is a third network side device, including: a processor and a transceiver;
  • the processor configured to receive, through the transceiver, attribute information of the terminal to be authenticated sent by the blockchain node;
  • the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node.
  • An embodiment of the present disclosure further provides a network-side device, including a memory, a processor, and a program stored in the memory and running on the processor; the processor implements the first above-mentioned first when executing the program. an access control method on the network side device side; or, when the processor executes the program, implements the above-mentioned second access control method on the network side device side; or, when the processor executes the program, implements the above-mentioned third method An access control method on the network side device side.
  • An embodiment of the present disclosure further provides a terminal, including a memory, a processor, and a program stored in the memory and running on the processor; when the processor executes the program, the above-mentioned connection on the terminal side is implemented. access control method.
  • Embodiments of the present disclosure further provide a blockchain node, including a memory, a processor, and a program stored on the memory and executable on the processor; when the processor executes the program, the above-mentioned first step is implemented.
  • An embodiment of the present disclosure further provides a readable storage medium, on which a program is stored, and when the program is executed by a processor, implements the steps in the above-mentioned access control method on the device side of the first network side; or, the program is processed When executed by the processor, the steps in the access control method on the terminal side are implemented; or, when the program is executed by the processor, the steps in the access control method on the first blockchain node side are implemented; or, the program is executed by the processor.
  • the access control method receives the relevant information to be verified corresponding to the access request sent by the terminal; wherein, the relevant information to be verified includes the private key signature information of the terminal and the preset information in the blockchain.
  • the preset information is obtained from the blockchain; according to the private key signature information and the preset information, the terminal is verified; if the verification is passed , according to the preset information, obtain the attribute information of the terminal from the blockchain ledger; according to the attribute information, feed back a request response for access control to the terminal; wherein, the preset information includes all public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal and public key information of the terminal, or the The second terminal identification information and the hash value of the public key of the terminal; can support the implementation of the access control scheme using the blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid similar traditional authentication.
  • the server suffers from a single point of failure caused by
  • FIG. 1 is a schematic flowchart 1 of an access control method according to an embodiment of the present disclosure
  • FIG. 2 is a second schematic flowchart of an access control method according to an embodiment of the present disclosure
  • FIG. 3 is a third schematic flowchart of an access control method according to an embodiment of the present disclosure.
  • FIG. 4 is a fourth schematic flowchart of an access control method according to an embodiment of the present disclosure.
  • FIG. 5 is a fifth schematic flowchart of an access control method according to an embodiment of the present disclosure.
  • FIG. 6 is a sixth schematic flowchart of an access control method according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic diagram of an implementation architecture of an access control method according to an embodiment of the present disclosure.
  • FIG. 8a is a schematic diagram 1 of a specific implementation flow of an access control method according to an embodiment of the present disclosure
  • FIG. 8b is a schematic diagram 2 of a specific implementation flow of the access control method according to the embodiment of the present disclosure.
  • FIG. 9 is a schematic diagram 1 of an authentication architecture for information to be authenticated according to an embodiment of the present disclosure.
  • FIG. 10 is a second schematic diagram of an authentication architecture for information to be authenticated according to an embodiment of the present disclosure
  • FIG. 11 is a schematic structural diagram 1 of an access control apparatus according to an embodiment of the present disclosure.
  • FIG. 12 is a second schematic structural diagram of an access control apparatus according to an embodiment of the present disclosure.
  • FIG. 13 is a third schematic structural diagram of an access control apparatus according to an embodiment of the present disclosure.
  • FIG. 14 is a fourth schematic structural diagram of an access control apparatus according to an embodiment of the present disclosure.
  • FIG. 15 is a fifth schematic structural diagram of an access control apparatus according to an embodiment of the present disclosure.
  • 16 is a sixth schematic structural diagram of an access control apparatus according to an embodiment of the present disclosure.
  • FIG. 17 is a schematic structural diagram 1 of a network side device according to an embodiment of the present disclosure.
  • FIG. 18 is a schematic structural diagram of a terminal according to an embodiment of the present disclosure.
  • FIG. 19 is a schematic diagram 1 of a blockchain node structure according to an embodiment of the disclosure.
  • FIG. 20 is a second schematic diagram of a block chain node structure according to an embodiment of the disclosure.
  • FIG. 21 is a second schematic structural diagram of a network side device according to an embodiment of the present disclosure.
  • FIG. 22 is a third schematic structural diagram of a network side device according to an embodiment of the present disclosure.
  • the present disclosure provides an access control method, which is applied to a first network side device, as shown in FIG. 1 , including:
  • Step 11 Receive the relevant information to be verified corresponding to the access request sent by the terminal; wherein, the relevant information to be verified includes the private key signature information of the terminal and the location information of the preset information in the blockchain;
  • Step 12 Obtain the preset information from the blockchain according to the location information
  • Step 13 Verify the terminal according to the private key signature information and the preset information
  • Step 14 in the case of passing the verification, obtain the attribute information of the terminal from the blockchain ledger according to the preset information;
  • Step 15 Feed back a request response for access control to the terminal according to the attribute information; wherein the preset information includes the public key information of the terminal, or the first information obtained according to the public key of the terminal.
  • step 15 may be to feed back a request response for access control to the terminal according to the attribute information and the terminal identification information;
  • the terminal identification information may be the above-mentioned first terminal identification information and second terminal identification information or third terminal identification information.
  • the access control method provided by the embodiment of the present disclosure receives the relevant information to be verified corresponding to the access request sent by the terminal; wherein, the relevant information to be verified includes the private key signature information of the terminal and the preset information in the area location information in the blockchain; obtain the preset information from the blockchain according to the location information; verify the terminal according to the private key signature information and the preset information; In this case, according to the preset information, the attribute information of the terminal is obtained from the blockchain ledger; according to the attribute information, a request response for access control is fed back to the terminal; wherein the preset information It includes the public key information of the terminal, or the first terminal identification information obtained according to the public key of the terminal, or the second terminal identification information unrelated to the public key of the terminal and the public key information of the terminal, or The identification information of the second terminal and the hash value of the public key of the terminal can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid similar
  • the traditional authentication server suffers from the single
  • the receiving the relevant information to be verified corresponding to the access request sent by the terminal includes: receiving the access request sent by the terminal, where the access request carries the relevant information to be verified; or, receiving the access request sent by the terminal ; feeding back a random number to the terminal according to the access request; and receiving the relevant information to be verified sent by the terminal according to the random number.
  • the verifying the terminal according to the private key signature information and the preset information includes: using The public key information verifies the private key signature information; in the case of passing the verification, obtaining the attribute information of the terminal from the blockchain ledger according to the preset information, including: in the case of passing the verification In the case of , obtain the corresponding third terminal identification information from the blockchain ledger according to the public key information; in the case of obtaining the third terminal identification information, obtain the third terminal identification information from the blockchain ledger
  • the attribute information corresponding to the three terminal identification information is used as the attribute information of the terminal.
  • the feeding back a request response for access control to the terminal according to the attribute information may include: feeding back a request response for access control to the terminal according to the third terminal identification information and attribute information .
  • the verifying the terminal according to the private key signature information and the preset information includes: according to The first terminal identification information obtains the public key information to be verified and the stored public key information of the terminal from the blockchain ledger; according to the public key information of the terminal, the public key information to be verified is obtained.
  • the key information and the private key signature information are verified; in the case of passing the verification, obtaining the attribute information of the terminal from the blockchain ledger according to the preset information, including: in the case of passing the verification , and obtain attribute information of the terminal from the blockchain ledger according to the first terminal identification information.
  • the feeding back a request response for access control to the terminal according to the attribute information includes: feeding back a request response for access control to the terminal according to the first terminal identification information and attribute information.
  • the terminal when the preset information includes the identification information of the second terminal and the public key information, the terminal is verified according to the private key signature information and the preset information. , including: using the public key information in the preset information to verify the private key signature information; and obtaining the stored public key of the terminal from the blockchain ledger according to the second terminal identification information information; verify the public key information in the preset information according to the acquired public key information of the terminal; or verify the private key signature information by using the public key information in the preset information; and obtain the stored hash value of the public key of the terminal from the blockchain ledger according to the identification information of the second terminal; obtain the hash value to be verified according to the public key information in the preset information ; Verify the hash value to be verified according to the obtained hash value of the public key of the terminal.
  • the terminal is verified according to the private key signature information and the preset information
  • the method includes: obtaining the stored public key information of the terminal from the blockchain ledger according to the identification information of the second terminal; obtaining the public key to be verified according to the hash value of the public key in the preset information information; verifying the private key signature information according to the public key information to be verified; and verifying the public key information to be verified according to the acquired public key information of the terminal.
  • obtaining the attribute information of the terminal from the blockchain ledger according to the preset information includes: in the case of passing the verification, according to the second Terminal identification information, the attribute information of the terminal is obtained from the blockchain ledger.
  • the feeding back a request response for access control to the terminal according to the attribute information includes: feeding back a request response for access control to the terminal according to the second terminal identification information and attribute information.
  • the private key signature information includes first signature information using the terminal's private key to the timestamp, or, using the terminal's private key to respond to the access request for the first network-side device The second signature information of the random number sent.
  • the relevant information to be verified further includes the timestamp; the The verification by the terminal includes: confirming whether the timestamp is within the validity period; and in the case that the timestamp is within the validity period, verifying the terminal according to the private key signature information and the preset information.
  • whether the timestamp is within the validity period may be determined according to the timestamp itself, but it is not limited thereto.
  • the preset information further includes validity period information of the first information; the first information includes at least one of the attribute information, the first terminal identification information, and the second terminal identification information item; the verifying the terminal according to the private key signature information and the preset information includes: confirming, according to the validity period information, whether the first information is within the validity period; In the case of being within the validity period, the terminal is verified according to the private key signature information and other information in the preset information except the validity period information.
  • Regarding "confirming whether the first information is within the validity period according to the validity period information” may specifically be: first, according to the validity period information (the validity period information of the second information) stored in the blockchain ledger, check the validity period in the preset information information; if the verification is passed, according to the validity period information, it is confirmed whether the first information is within the validity period.
  • At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes public information using the first network side device. before feeding back the request response for access control to the terminal according to the attribute information, further comprising: pairing the public key with the private key of the first network-side device Decrypt the encrypted first key to obtain the first key; according to the first key, decrypt the encrypted information obtained from the blockchain ledger to obtain the at least one Authentication information; wherein the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, or third terminal identification information corresponding to the public key of the terminal, and at least one of public key information of the terminal or a hash value of the public key of the terminal.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first information.
  • a timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
  • An embodiment of the present disclosure further provides an access control method, which is applied to a terminal, as shown in FIG. 2 , including:
  • Step 21 Send the relevant information to be verified corresponding to the access request to the first network side device; wherein, the relevant information to be verified includes the private key signature information of the terminal and the location information of the preset information in the blockchain;
  • Step 22 Receive a request response for access control fed back by the first network side device; wherein the preset information includes the public key information of the terminal, or the first terminal obtained according to the public key of the terminal identification information, or second terminal identification information unrelated to the terminal's public key and the terminal's public key information, or the second terminal identification information and a hash value of the terminal's public key.
  • the access control method provided by the embodiment of the present disclosure sends the relevant information to be verified corresponding to the access request to the first network side device; wherein, the relevant information to be verified includes the private key signature information of the terminal and the preset location information of the information in the blockchain; receiving a request response for access control fed back by the first network side device; wherein the preset information includes the public key information of the terminal, or according to the public key information of the terminal.
  • the first terminal identification information obtained by the public key, or the second terminal identification information unrelated to the public key of the terminal and the public key information of the terminal, or the identification information of the second terminal and the public key of the terminal.
  • Hash value can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid the single point of failure problem caused by DDoS attacks on traditional authentication servers.
  • the sending the relevant information to be verified corresponding to the access request to the first network-side device includes: sending an access request to the first network-side device, where the access request carries the relevant information to be verified; or, to the first network
  • the side device sends an access request; receives a random number fed back by the first network-side device according to the access request; and sends the relevant information to be verified to the first network-side device according to the random number.
  • the private key signature information includes first signature information using the terminal's private key to the timestamp, or, using the terminal's private key to respond to the access request for the first network-side device The second signature information of the random number sent.
  • the relevant information to be verified further includes the timestamp.
  • the preset information further includes validity period information of the first information; the first information includes attribute information of the terminal, identification information of the first terminal, and identification information of the second terminal. at least one.
  • At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes encryption using the public key of the first network side device wherein the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or first terminal identification information unrelated to the public key of the terminal At least one of terminal identification information or third terminal identification information corresponding to the public key of the terminal, and public key information of the terminal or a hash value of the public key of the terminal.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first information.
  • a timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
  • the method before sending the relevant information to be verified corresponding to the access request to the first network-side device, the method further includes: sending the information to be authenticated of the terminal to the first blockchain node; wherein the to-be-authenticated information is sent to the first blockchain node.
  • the information includes user credential information and/or attribute information; the user credential information includes terminal identification information.
  • An embodiment of the present disclosure also provides an access control method, which is applied to the first blockchain node, as shown in FIG. 3 , including:
  • Step 31 Receive the information to be authenticated sent by the terminal
  • Step 32 Authenticate the information to be authenticated
  • Step 33 in the case of passing the authentication, store at least one authentication information corresponding to the information to be authenticated in the blockchain ledger; wherein the information to be authenticated includes user credential information and/or attribute information; the The user credential information includes terminal identification information; the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or a second terminal independent of the public key of the terminal identification information or third terminal identification information corresponding to the public key of the terminal, and at least one of the public key information of the terminal or a hash value of the public key of the terminal.
  • Step 32 may specifically be: using a consensus mechanism to authenticate the information to be authenticated.
  • the access control method provided by the embodiment of the present disclosure receives the information to be authenticated sent by the terminal; authenticates the information to be authenticated; if the authentication is passed, at least one authentication information corresponding to the information to be authenticated Stored in the blockchain ledger; wherein, the information to be authenticated includes user credential information and/or attribute information; the user credential information includes terminal identification information; the at least one authentication information includes: attribute information of the terminal, The first terminal identification information obtained according to the public key of the terminal, the second terminal identification information unrelated to the public key of the terminal, or the third terminal identification information corresponding to the public key of the terminal, and the terminal At least one of the public key information of the terminal or the hash value of the public key of the terminal; it can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid Similar to the problem of single point of failure caused by DDoS attacks on traditional authentication servers.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first information.
  • a timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
  • storing at least one authentication information corresponding to the information to be authenticated in the blockchain ledger includes: randomly generating a first key for encryption; using the first key The key encrypts the at least one authentication information and stores it in the blockchain ledger.
  • the method further includes: encrypting the first key with the public key of the terminal and then storing it in the blockchain ledger.
  • the authentication of the information to be authenticated includes: according to a first preset policy, sending the user credential information in the information to be authenticated to at least one first two network-side devices perform authentication; receive the first authentication result and the corresponding third signature information fed back by the at least one second network-side device; according to the second preset policy, the first authentication result and the third signature information, Obtain the first final result of whether the user credential information is authenticated; and/or,
  • the authenticating the information to be authenticated includes: according to a first preset policy, sending attribute information in the information to be authenticated to at least one third network-side device for authentication; receiving the at least one third network The second authentication result and the corresponding fourth signature information fed back by the side device; according to the third preset policy, the second authentication result and the fourth signature information, a second final result of whether the attribute information is authenticated is obtained.
  • the first preset strategy, the third preset strategy and/or the third preset strategy are preset strategies or strategies agreed in the smart contract.
  • the authentication of the information to be authenticated includes: sending the information to be authenticated to a second blockchain node; receiving the first authentication information The first authentication result corresponding to the user credential information in the information to be authenticated and the corresponding third signature information fed back by the second blockchain node; and according to the second preset policy, the first authentication result and the third signature information, obtain the first final result of whether the user credential information is authenticated; and/or, receive the second authentication result corresponding to the attribute information in the information to be authenticated fed back by the second blockchain node and the corresponding and obtain the second final result of whether the attribute information is authenticated according to the third preset policy, the second authentication result and the fourth signature information.
  • the third preset strategy and/or the third preset strategy is a preset strategy or a strategy agreed in the smart contract.
  • the embodiment of the present disclosure also provides an access control method, which is applied to the second blockchain node, as shown in FIG. 4 , including:
  • Step 41 Receive the information to be authenticated of the terminal sent by the first blockchain node
  • Step 42 Send the user credential information in the information to be authenticated to at least one second network side device for authentication, and receive the first authentication result and the corresponding third signature information fed back by the at least one second network side device , and feed it back to the first blockchain node; and/or, send the attribute information in the information to be authenticated to at least one third network side device for authentication, and receive feedback from the at least one third network side device
  • the second authentication result and the corresponding fourth signature information are fed back to the first blockchain node; wherein, the user credential information includes terminal identification information.
  • the access control method provided by the embodiment of the present disclosure receives the information to be authenticated of the terminal sent by the first blockchain node; and sends the user credential information in the information to be authenticated to at least one second network side device for authentication , and receive the first authentication result and the corresponding third signature information fed back by the at least one second network side device, and feed it back to the first blockchain node; and/or, convert the attributes in the information to be authenticated Send the information to at least one third network side device for authentication, and receive the second authentication result and the corresponding fourth signature information fed back by the at least one third network side device, and feed it back to the first blockchain node; wherein , the user credential information includes terminal identification information; it can support the implementation of the access control scheme using blockchain, and providing attribute verification services to customers in the form of blockchain can avoid similar traditional authentication servers suffering from DDoS attacks. The single point of failure problem.
  • An embodiment of the present disclosure further provides an access control method, which is applied to a second network side device, as shown in FIG. 5 , including:
  • Step 51 Receive the user credential information of the terminal to be authenticated sent by the blockchain node;
  • Step 52 Authenticate the user credential information, obtain a first authentication result, and sign with the third signature information;
  • Step 53 Feed back the first authentication result and the third signature information to the blockchain node; wherein the blockchain node is the first blockchain node or communicates with the first blockchain node The second blockchain node; the user credential information includes terminal identification information.
  • the access control method provided by the embodiment of the present disclosure receives the user credential information of the terminal to be authenticated sent by the blockchain node; authenticates the user credential information, obtains a first authentication result, and uses the third signature information Signing; feeding back the first authentication result and the third signature information to the blockchain node; wherein the blockchain node is the first blockchain node or communicates with the first blockchain node
  • the user credential information includes terminal identification information; it can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid similar traditional
  • the authentication server suffers from a single point of failure caused by a DDoS attack.
  • An embodiment of the present disclosure further provides an access control method, which is applied to a third network-side device, as shown in FIG. 6 , including:
  • Step 61 Receive the attribute information of the terminal to be authenticated sent by the blockchain node;
  • Step 62 Authenticate the attribute information, obtain a second authentication result, and use the fourth signature information to sign;
  • Step 63 Feed back the second authentication result and the fourth signature information to the blockchain node; wherein, the blockchain node is the first blockchain node or communicates with the first blockchain node The second blockchain node of .
  • the access control method provided by the embodiment of the present disclosure receives the attribute information of the terminal to be authenticated sent by the blockchain node; authenticates the attribute information, obtains a second authentication result, and uses the fourth signature information to sign ; Feed back the second authentication result and the fourth signature information to the block chain node; wherein, the block chain node is the first block chain node or the first block chain node that communicates with the first block chain node.
  • Two blockchain nodes can support the solution of using blockchain for access control, and provide attribute verification services to customers in the form of blockchain, which can avoid the single point of failure caused by DDoS attacks on traditional authentication servers. .
  • the access control method provided by the embodiments of the present disclosure is described below in combination with multiple sides such as a first network side device, a second network side device, a third network side device, a terminal, a first blockchain node, and a second blockchain node. for further explanation.
  • the embodiments of the present disclosure provide an access control method, which can be specifically implemented as a method for implementing access control by using a blockchain, which involves providing authentication and verification services to customers in a blockchain manner, so that the Avoid the single point of failure caused by DDoS attacks on traditional authentication servers.
  • FIG. 7 The implementation architecture of the access control method provided by the embodiment of the present disclosure is specifically shown in FIG. 7 , which involves: a user (corresponding to the above-mentioned terminal), a blockchain system (corresponding to the above-mentioned blockchain, including the first blockchain node and the second blockchain node) and application (corresponding to the above-mentioned first network side device);
  • the blockchain network node in the specific blockchain system is composed of multiple authentication nodes, wherein the authentication node is mainly responsible for user identity verification (corresponding to the above-mentioned user credential information) is authenticated, and the attributes of the user (corresponding to the above-mentioned attribute information) are authenticated, and the authenticated result is recorded in the blockchain ledger;
  • the user is accessing the business system (corresponding to the above-mentioned first A network side device), the business system queries the user identity and attribute information in the blockchain.
  • Both the user (client) and the business system specifically, the application (server) in the system) have their own public and private keys.
  • the user first submits an authentication request (corresponding to the above-mentioned information to be authenticated) to the blockchain system, including identity authentication information (corresponding to the above-mentioned user credential information) and attribute information.
  • the authentication node authenticates the identity authentication information and attribute information respectively, and records the authenticated and consensus information to the blockchain ledger.
  • the main process is as follows:
  • Operation 1 The user (client) submits identity authentication information and/or attribute information to the blockchain system;
  • the blockchain node (that is, the above-mentioned first blockchain node) authenticates the above-mentioned information (identity authentication information and/or attribute information) (specifically, it can authenticate the correctness of these information);
  • the blockchain node converts the user ID (corresponding to the above-mentioned user credential information, which may specifically correspond to the above-mentioned first terminal identification information, second terminal identification information or third terminal identification information). Identification information) and/or user public key hash value and/or user public key, user attribute information (that is, the attribute information of the above-mentioned terminal), validity period (that is, the above-mentioned validity period information), etc. are recorded in the blockchain ledger;
  • the data may be encrypted and stored.
  • the plaintext of the data to be recorded is info
  • the ciphertext recorded in the blockchain ledger is:
  • E represents encryption
  • subscript of E represents the key used
  • brackets represent data
  • K is the first key randomly generated by the blockchain node.
  • Operation 4 The user initiates an access request to the application server (corresponding to the above-mentioned first network side device):
  • Mode 1 timestamp signature: which includes the timestamp, the signature of the user's private key to the timestamp (that is, the above-mentioned first signature information), the user ID and/or the hash value of the user's public key and/or the user's public key, The location of the user attribute information, validity period and other information in the blockchain (that is, the above location information). If the user public key is not recorded in operation 3 (but the hash value is recorded), the user public key must also be carried in this operation.
  • Method 2 (random number signature): The request does not carry user information, the application server returns a random number, the user signs the random number using the private key (ie the above-mentioned second signature information), and sends the signature along with the user ID and/or user ID. The location of the public key hash value and/or the user public key, user attribute information, validity period and other information in the blockchain is sent to the application server. If the user public key is not recorded in operation 3, the user public key must also be included in this operation. .
  • the access request should also include a decryption key (that is, the above-mentioned first key encrypted with the public key of the first network-side device):
  • the application server queries the relevant information in the blockchain ledger to verify the user (client):
  • Method 1 Use the user's public key to verify whether the signature on the timestamp is correct, whether the timestamp is within the validity period, and verify whether the user's public key or hash value is consistent (or matched) with the record in the ledger. If the verification is successful, it means that the user is the user in the account book, the attribute information recorded in the account book is the attribute of the user, and the application server can further use the attribute and the user ID to perform access authorization (control access).
  • Method 2 Use the user's public key to verify whether the signature on the random number is correct, and verify whether the user's public key or hash value is consistent (or matched) with the record in the ledger. If the verification is successful, it means that the user is the user in the ledger, the attribute information recorded in the ledger is the attribute of the user, and the application server can further use the attribute and the user ID for access authorization.
  • the application server should also use the server's private key to decrypt to obtain K, and further decrypt the ciphertext in the ledger:
  • DK(Ek(info)) get info, namely user information (user ID) and attribute information, where D represents decryption.
  • the access control method provided by the embodiments of the present disclosure may be shown in FIG. 8a (the first network side device is an application server (gateway) as an example), including:
  • Step 81 The user (client) sends an authentication request (corresponding to the above-mentioned information to be authenticated) to the blockchain node (that is, the above-mentioned first blockchain node);
  • Step 82 The blockchain node performs an authentication operation
  • Step 83 The authentication is passed and recorded in the blockchain ledger (user ID and/or public key, attribute information);
  • Step 84 The blockchain node feeds back an authentication response to the user (client);
  • Step 85 The user (client) sends an access request to the application server (gateway);
  • Step 86 The application server (gateway) queries the blockchain ledger for user authentication information and attribute information;
  • Step 87 The application server (gateway) verifies the user (client) according to the queried information;
  • Step 88 The application server (gateway) feeds back the request response to the user (client).
  • the access control method of the embodiment of the present disclosure can also be applied to a software defined boundary (Software Defined Perimeter, SDP) scenario, and the specific implementation process can refer to FIG. Accepting SDP Hosts, AH) as an example), the method includes:
  • Step 810 the SDP connection initiating host (Initiating SDP Hosts, IH) sends an authentication request (corresponding to the above-mentioned information to be authenticated) to the blockchain node (that is, the above-mentioned first blockchain node);
  • Step 820 the blockchain node performs an authentication operation
  • Step 830 The authentication is passed, and recorded in the blockchain ledger (ID and/or public key of the IH, attribute information);
  • Step 840 The blockchain node feeds back an authentication response to the IH;
  • Step 850 the IH sends an access request to the AH
  • Step 860 AH queries the blockchain ledger for IH authentication information and attribute information
  • Step 870 AH verifies the IH according to the queried information
  • Step 880 The AH feeds back the request response to the IH.
  • Method 1 this method needs to formulate an authentication strategy (including the above-mentioned first preset strategy, second preset strategy and third preset strategy) for authentication information (namely identity authentication information) and attribute information, and the strategy should include an information forwarding strategy (that is, the above-mentioned first preset strategy), as shown in Figure 9:
  • an authentication strategy including the above-mentioned first preset strategy, second preset strategy and third preset strategy
  • authentication information namely identity authentication information
  • attribute information namely identity authentication information
  • the strategy should include an information forwarding strategy (that is, the above-mentioned first preset strategy), as shown in Figure 9:
  • the blockchain node After receiving the identity authentication information and attribute information, the blockchain node forwards the authentication information and attribute information to the corresponding authentication node according to the policy (corresponding to the above-mentioned sending the user credential information in the information to be authenticated to At least one second network side device performs authentication, and sends the attribute information in the information to be authenticated to at least one third network side device for authentication); different authentication nodes can authenticate different authentication information or attribute information, such as attribute authentication Node 1 authenticates attribute 1, and attribute authentication node 2 authenticates attribute 2, which is not limited here.
  • the authentication information authentication node and the attribute authentication node respectively authenticate the above information, and sign the authentication result;
  • the authentication information authentication node may be an authentication server; for example, if the user submits the user name and password authentication information, the blockchain node forwards the authentication information to the authentication information authentication node, and the authentication information authentication node authenticates the user name and password.
  • the authentication information authentication nodes 1 and 2 can be compared to WeChat and Alipay, whichever password the user submits, the blockchain node submits the authentication information to the corresponding authentication information authentication node.
  • the authentication information authentication node and the attribute authentication node return the verification result (corresponding to the above-mentioned first authentication result and second authentication result) and its signature to the result (corresponding to the above-mentioned third signature information and fourth signature information);
  • the blockchain node determines the final authentication result (corresponding to the above-mentioned first final result and second final result) according to the received authentication result and signature.
  • Method 2 this method requires the use of an intermediate node (that is, the above-mentioned second blockchain node), as shown in Figure 10:
  • the blockchain node (that is, the above-mentioned first blockchain node) forwards the authentication information and attribute information to the intermediate node after receiving the identity authentication information and attribute information;
  • the intermediate node forwards the authentication information and attribute information to the corresponding authentication node (corresponding to the above-mentioned sending the user credential information in the to-be-authenticated information to at least one second network-side device for authentication, and the to-be-authenticated information in the
  • the attribute information is sent to at least one third network side device for authentication); different authentication nodes can authenticate different authentication information or attribute information, for example, attribute authentication node 1 authenticates attribute 1, attribute authentication node 2 authenticates attribute 2, which is not performed here. limited.
  • the authentication information authentication node may be an authentication server; for example, if the user submits the user name and password authentication information, the blockchain node forwards the authentication information to the authentication information authentication node, and the authentication information authentication node authenticates the user name and password.
  • the authentication information authentication nodes 1 and 2 can be analogized to WeChat and Alipay, whichever password the user submits, the blockchain node submits the authentication information to the corresponding authentication information authentication node.
  • the authentication information authentication node and the attribute authentication node send the authentication result (corresponding to the above-mentioned first authentication result and the second authentication result) and its signature to the result (corresponding to the above-mentioned third signature information and fourth signature information) to the intermediate node;
  • the blockchain node obtains the authentication result and the signature from the intermediate node, and determines the final authentication result (corresponding to the above-mentioned first final result and second final result).
  • Example 1 Unified authentication (another implementation is provided for the above operation 5 in this example);
  • the blockchain acts as a unified authentication platform
  • the user submits an authentication request to the blockchain system
  • the blockchain node (corresponding to the first blockchain node above) authenticates the user
  • the user information, public The key information and attribute information are recorded in the blockchain ledger.
  • the application system needs to verify the user's signature to ensure the correctness of the user's public key, and then query the user information and attribute information in the blockchain based on the public key to authenticate the user.
  • the user initiates an authentication request to the blockchain, carrying the information to be authenticated;
  • the blockchain system authenticates the information to be authenticated provided by the user, and after the authentication is passed, the user's identity or attribute information is recorded in the blockchain ledger;
  • the user initiates an access request to the application system, which carries the signature of the user's private key to the timestamp, or the application system sends a random number to the user, and the user signs the random number with the private key and sends it to the application system.
  • the request can also carry the location where the user identity or attribute information is recorded in the blockchain.
  • the application system can directly verify the user's signature with the public key. If the signature is correct, the public key can be used to query the user's identity (user ID) and attribute information in the blockchain.
  • the application system can further use this attribute and the user's identity to perform access authorization.
  • Example 2 Two-factor authentication (corresponding to the authentication methods in Figure 9 and Figure 10 above);
  • the user has the authentication information of two authentication platforms (such as WeChat platform and Alipay platform), and the user submits an authentication request to the blockchain system, and the request may include multiple authentication platforms (such as WeChat platform and Alipay platform)
  • the blockchain node extracts the user authentication data, and sends the user authentication data to the corresponding authentication platform for authentication in the manner shown in Figure 9 or Figure 10.
  • the authentication platform authenticates the user according to the user's authentication data. And return the authentication result to the blockchain node.
  • the blockchain node uses the preset strategy or the strategy agreed in the smart contract to process the authentication result. Since the authentication node can obtain the authentication results of the user by the above two authentication platforms, double authentication of the user's identity can be realized.
  • a user submits an authentication request to the blockchain system; Authentication, and record the authenticated and consensus information to the blockchain ledger; when a user accesses the business system, the business system queries the user's identity and attribute information on the blockchain.
  • the user may submit an authentication request to the blockchain system, including authentication information and attribute information; the blockchain node sends an authentication request to the corresponding authentication information authentication node and attribute information authentication node; corresponding The authentication information authentication node and attribute information authentication node authentication request, and feedback the authentication result; the blockchain node processes the authentication result.
  • the solutions provided by the embodiments of the present disclosure can avoid the single point of failure problem; and use smart contracts to implement authentication and authorization, and the nodes will not affect normal business if they are tampered with.
  • An embodiment of the present disclosure further provides an access control apparatus, which is applied to the first network side device, as shown in FIG. 11 , including:
  • the first receiving module 111 is configured to receive the relevant information to be verified corresponding to the access request sent by the terminal; wherein, the relevant information to be verified includes the private key signature information of the terminal and the position of the preset information in the blockchain information;
  • a first obtaining module 112 configured to obtain the preset information from the blockchain according to the location information
  • a first verification module 113 configured to verify the terminal according to the private key signature information and the preset information
  • the second receiving module 114 is configured to obtain the attribute information of the terminal from the blockchain ledger according to the preset information when the verification is passed;
  • a first feedback module 115 configured to feed back a request response for access control to the terminal according to the attribute information
  • the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
  • the access control apparatus receives the relevant information to be verified corresponding to the access request sent by the terminal; wherein, the relevant information to be verified includes the private key signature information of the terminal and the preset information in the area location information in the blockchain; obtain the preset information from the blockchain according to the location information; verify the terminal according to the private key signature information and the preset information; In this case, according to the preset information, the attribute information of the terminal is obtained from the blockchain ledger; according to the attribute information, a request response for access control is fed back to the terminal; wherein the preset information It includes the public key information of the terminal, or the first terminal identification information obtained according to the public key of the terminal, or the second terminal identification information unrelated to the public key of the terminal and the public key information of the terminal, or The identification information of the second terminal and the hash value of the public key of the terminal can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid similar
  • the traditional authentication server suffers from the single point of failure
  • the receiving the relevant information to be verified corresponding to the access request sent by the terminal includes: receiving the access request sent by the terminal, where the access request carries the relevant information to be verified; or, receiving the access request sent by the terminal ; feeding back a random number to the terminal according to the access request; and receiving the relevant information to be verified sent by the terminal according to the random number.
  • the verifying the terminal according to the private key signature information and the preset information includes: using The public key information verifies the private key signature information; in the case of passing the verification, obtaining the attribute information of the terminal from the blockchain ledger according to the preset information, including: in the case of passing the verification In the case of , obtain the corresponding third terminal identification information from the blockchain ledger according to the public key information; in the case of obtaining the third terminal identification information, obtain the third terminal identification information from the blockchain ledger
  • the attribute information corresponding to the three terminal identification information is used as the attribute information of the terminal.
  • the verifying the terminal according to the private key signature information and the preset information includes: according to the first terminal identification information, obtain the public key information to be verified and obtain the stored public key information of the terminal from the blockchain ledger; according to the public key information of the terminal, the public key information to be verified and all The private key signature information is verified; in the case of passing the verification, obtaining the attribute information of the terminal from the blockchain ledger according to the preset information, including: in the case of passing the verification, according to the For the first terminal identification information, attribute information of the terminal is obtained from the blockchain ledger.
  • the terminal when the preset information includes the identification information of the second terminal and the public key information, the terminal is verified according to the private key signature information and the preset information. , including: using the public key information in the preset information to verify the private key signature information; and obtaining the stored public key of the terminal from the blockchain ledger according to the second terminal identification information information; verify the public key information in the preset information according to the acquired public key information of the terminal; or verify the private key signature information by using the public key information in the preset information; and obtain the stored hash value of the public key of the terminal from the blockchain ledger according to the identification information of the second terminal; obtain the hash value to be verified according to the public key information in the preset information ; Verify the hash value to be verified according to the obtained hash value of the public key of the terminal.
  • the terminal is verified according to the private key signature information and the preset information
  • the method includes: obtaining the stored public key information of the terminal from the blockchain ledger according to the identification information of the second terminal; obtaining the public key to be verified according to the hash value of the public key in the preset information information; verifying the private key signature information according to the public key information to be verified; and verifying the public key information to be verified according to the acquired public key information of the terminal.
  • obtaining the attribute information of the terminal from the blockchain ledger according to the preset information includes: in the case of passing the verification, according to the second Terminal identification information, the attribute information of the terminal is obtained from the blockchain ledger.
  • the private key signature information includes first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the random number sent by the first network-side device in response to the access request the second signature information.
  • the relevant information to be verified further includes the timestamp; the signature information according to the private key and the preset information , verifying the terminal, including: confirming whether the time stamp is within the validity period; if the time stamp is within the validity period, verifying the terminal according to the private key signature information and the preset information authenticating.
  • the preset information further includes validity period information of the first information; the first information includes at least one of the attribute information, the first terminal identification information and the second terminal identification information; the Verifying the terminal according to the private key signature information and the preset information includes: confirming, according to the validity period information, whether the first information is within the validity period; if the first information is within the validity period In this case, the terminal is verified according to the private key signature information and other information in the preset information except the validity period information.
  • At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes using the first network the first key encrypted by the public key of the side device; the access control apparatus further includes: a first decryption module, configured to, before feeding back a request response for access control to the terminal according to the attribute information , use the private key of the first network side device to decrypt the first key encrypted by the public key to obtain the first key; a second decryption module is used to decrypt the first key according to the first key , decrypt the encrypted information obtained from the blockchain ledger to obtain the at least one authentication information; wherein, the at least one authentication information includes: attribute information of the terminal, according to the public information of the terminal the first terminal identification information obtained from the key, or the second terminal identification information unrelated to the public key of the terminal, or the third terminal identification information corresponding to the public key of the terminal, and the public key information of the terminal or all at least one of the hash values
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first information.
  • a timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
  • An embodiment of the present disclosure further provides an access control apparatus, which is applied to a terminal, as shown in FIG. 12 , including:
  • the first sending module 121 is configured to send the relevant information to be verified corresponding to the access request to the first network side device; wherein, the relevant information to be verified includes the private key signature information of the terminal and preset information in the blockchain location information in ;
  • a third receiving module 122 configured to receive a request response for access control fed back by the first network-side device
  • the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
  • the access control apparatus sends the relevant information to be verified corresponding to the access request to the first network side device; wherein, the relevant information to be verified includes the private key signature information of the terminal and the preset location information of the information in the blockchain; receiving a request response for access control fed back by the first network side device; wherein the preset information includes the public key information of the terminal, or according to the public key information of the terminal.
  • the first terminal identification information obtained by the public key, or the second terminal identification information unrelated to the public key of the terminal and the public key information of the terminal, or the identification information of the second terminal and the public key of the terminal.
  • Hash value can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid the single point of failure problem caused by DDoS attacks on traditional authentication servers.
  • the sending the relevant information to be verified corresponding to the access request to the first network-side device includes: sending an access request to the first network-side device, where the access request carries the relevant information to be verified; or, to the first network
  • the side device sends an access request; receives a random number fed back by the first network-side device according to the access request; and sends the relevant information to be verified to the first network-side device according to the random number.
  • the private key signature information includes first signature information using the terminal's private key to the timestamp, or, using the terminal's private key to respond to the access request for the first network-side device The second signature information of the random number sent.
  • the relevant information to be verified further includes the timestamp.
  • the preset information further includes validity period information of the first information; the first information includes at least one of attribute information of the terminal, identification information of the first terminal and identification information of the second terminal .
  • At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes encryption using the public key of the first network side device wherein the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or first terminal identification information unrelated to the public key of the terminal At least one of terminal identification information or third terminal identification information corresponding to the public key of the terminal, and public key information of the terminal or a hash value of the public key of the terminal.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first information.
  • a timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
  • the access control apparatus further includes: a second sending module, configured to send the first block chain node before sending the relevant information to be verified corresponding to the access request to the first network side device.
  • Information to be authenticated of the terminal wherein the information to be authenticated includes user credential information and/or attribute information; the user credential information includes terminal identification information.
  • the above implementation embodiments of the access control method on the terminal side are all applicable to the embodiments of the access control apparatus, and can also achieve the same technical effect.
  • An embodiment of the present disclosure further provides an access control apparatus, which is applied to the first blockchain node, as shown in FIG. 13 , including:
  • the fourth receiving module 131 is configured to receive the information to be authenticated sent by the terminal;
  • a first authentication module 132 configured to authenticate the information to be authenticated
  • the first storage module 133 is configured to store at least one piece of authentication information corresponding to the information to be authenticated in the blockchain ledger when the authentication is passed;
  • the to-be-authenticated information includes user credential information and/or attribute information;
  • the user credential information includes terminal identification information;
  • the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, or identification information related to the terminal.
  • the access control device receives the information to be authenticated sent by the terminal; authenticates the information to be authenticated; in the case of passing the authentication, at least one authentication information corresponding to the information to be authenticated Stored in the blockchain ledger; wherein, the information to be authenticated includes user credential information and/or attribute information; the user credential information includes terminal identification information; the at least one authentication information includes: attribute information of the terminal, The first terminal identification information obtained according to the public key of the terminal, the second terminal identification information unrelated to the public key of the terminal, or the third terminal identification information corresponding to the public key of the terminal, and the terminal At least one of the public key information of the terminal or the hash value of the public key of the terminal; it can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid Similar to the problem of single point of failure caused by DDoS attacks on traditional authentication servers.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first information.
  • a timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
  • storing at least one authentication information corresponding to the information to be authenticated in the blockchain ledger includes: randomly generating a first key for encryption; using the first key The key encrypts the at least one authentication information and stores it in the blockchain ledger.
  • the access control device further includes: a first processing module, configured to use the public key of the terminal to encrypt the first key after randomly generating the first key for encryption Stored in the blockchain ledger.
  • the authenticating the information to be authenticated includes: according to a first preset policy, sending the user credential information in the information to be authenticated to at least one second network-side device for authentication; receiving the at least one The first authentication result and the corresponding third signature information fed back by the second network-side device; according to the second preset policy, the first authentication result and the third signature information, the first authentication result of whether the user credential information is authenticated is obtained. Final result.
  • the authenticating the information to be authenticated includes: according to a first preset policy, sending attribute information in the information to be authenticated to at least one third network-side device for authentication; the second authentication result and the corresponding fourth signature information fed back by the at least one third network-side device; according to the third preset policy, the second authentication result and the fourth signature information, obtain whether the attribute information is authenticated or not. Second final result.
  • the authenticating the information to be authenticated includes: sending the information to be authenticated to a second blockchain node; receiving feedback from the second blockchain node and the user in the information to be authenticated The first authentication result corresponding to the credential information and the corresponding third signature information; and according to the second preset policy, the first authentication result and the third signature information, the first final result of whether the authentication of the user credential information is passed is obtained. and/or, receive the second authentication result corresponding to the attribute information in the information to be authenticated and the corresponding fourth signature information fed back by the second blockchain node; and according to the third preset strategy, the The second authentication result and the fourth signature information are used to obtain a second final result of whether the attribute information is authenticated.
  • the above-mentioned implementation embodiments of the access control method on the first blockchain node side are all applicable to the embodiments of the access control apparatus, and can also achieve the same technical effect.
  • An embodiment of the present disclosure also provides an access control device, which is applied to a second blockchain node, as shown in FIG. 14 , including:
  • the fifth receiving module 141 is configured to receive the information to be authenticated of the terminal sent by the first blockchain node;
  • the second processing module 142 is configured to send the user credential information in the information to be authenticated to at least one second network side device for authentication, and receive the first authentication result fed back by the at least one second network side device and the corresponding
  • the third signature information is fed back to the first blockchain node; and/or,
  • the third processing module 143 is configured to send the attribute information in the information to be authenticated to at least one third network side device for authentication, and receive the second authentication result fed back by the at least one third network side device and the corresponding fourth signature information, which is fed back to the first blockchain node;
  • the user credential information includes terminal identification information.
  • the access control apparatus receives the information to be authenticated of the terminal sent by the first blockchain node; and sends the user credential information in the information to be authenticated to at least one second network side device for authentication , and receive the first authentication result and the corresponding third signature information fed back by the at least one second network side device, and feed it back to the first blockchain node; and/or, convert the attributes in the information to be authenticated Send the information to at least one third network side device for authentication, and receive the second authentication result and the corresponding fourth signature information fed back by the at least one third network side device, and feed it back to the first blockchain node; wherein , the user credential information includes terminal identification information; it can support the implementation of the access control scheme using blockchain, and providing attribute verification services to customers in the form of blockchain can avoid similar traditional authentication servers suffering from DDoS attacks. The single point of failure problem.
  • An embodiment of the present disclosure further provides an access control apparatus, which is applied to a second network-side device, as shown in FIG. 15 , including:
  • the sixth receiving module 151 is used to receive the user credential information of the terminal to be authenticated sent by the blockchain node;
  • a fourth processing module 152 configured to authenticate the user credential information, obtain a first authentication result, and use the third signature information to sign;
  • the second feedback module 153 is configured to feed back the first authentication result and the third signature information to the blockchain node;
  • the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node;
  • the user credential information includes terminal identification information.
  • the access control device receives the user credential information of the terminal to be authenticated sent by the blockchain node; authenticates the user credential information, obtains a first authentication result, and uses the third signature information Signing; feeding back the first authentication result and the third signature information to the blockchain node; wherein the blockchain node is the first blockchain node or communicates with the first blockchain node
  • the user credential information includes terminal identification information; it can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid similar traditional
  • the authentication server suffers from a single point of failure caused by a DDoS attack.
  • the above-mentioned implementation embodiments of the access control method on the device side of the second network side are all applicable to the embodiments of the access control apparatus, and can also achieve the same technical effect.
  • An embodiment of the present disclosure further provides an access control apparatus, which is applied to a third network-side device, as shown in FIG. 16 , including:
  • the seventh receiving module 161 is configured to receive the attribute information of the terminal to be authenticated sent by the blockchain node;
  • a fifth processing module 162 configured to authenticate the attribute information, obtain a second authentication result, and use the fourth signature information to sign;
  • the third feedback module 163 is used to feed back the second authentication result and the fourth signature information to the blockchain node;
  • the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node.
  • the access control device receives the attribute information of the terminal to be authenticated sent by the blockchain node; authenticates the attribute information, obtains a second authentication result, and uses the fourth signature information to sign ; Feed back the second authentication result and the fourth signature information to the block chain node; wherein, the block chain node is the first block chain node or the first block chain node that communicates with the first block chain node.
  • Two blockchain nodes it can support the solution of using blockchain for access control, and provide attribute verification services to customers in the form of blockchain, which can avoid the single point of failure caused by DDoS attacks on traditional authentication servers. .
  • the above-mentioned implementation embodiments of the access control method on the device side of the third network side are all applicable to the embodiments of the access control apparatus, and can also achieve the same technical effect.
  • An embodiment of the present disclosure further provides a network-side device, where the network-side device is a first network-side device, as shown in FIG. 17 , including: a processor 171 and a transceiver 172;
  • the processor 171 is configured to receive, through the transceiver 172, the relevant information to be verified corresponding to the access request sent by the terminal; wherein the relevant information to be verified includes the private key signature information of the terminal and the preset information in Location information in the blockchain;
  • the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
  • the network-side device receives the relevant information to be verified corresponding to the access request sent by the terminal; wherein, the relevant information to be verified includes the private key signature information of the terminal and the preset information in the block position information in the chain; obtain the preset information from the blockchain according to the position information; verify the terminal according to the private key signature information and the preset information; if the verification is passed.n, according to the preset information, the attribute information of the terminal is obtained from the blockchain ledger; according to the attribute information, a request response for access control is fed back to the terminal; wherein the preset information includes The public key information of the terminal, or the first terminal identification information obtained according to the public key of the terminal, or the second terminal identification information unrelated to the public key of the terminal and the public key information of the terminal, or all The identification information of the second terminal and the hash value of the public key of the terminal; can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid similar traditional The authentication server suffer
  • the receiving the relevant information to be verified corresponding to the access request sent by the terminal includes: receiving the access request sent by the terminal, where the access request carries the relevant information to be verified; or, receiving the access request sent by the terminal ; feeding back a random number to the terminal according to the access request; and receiving the relevant information to be verified sent by the terminal according to the random number.
  • the verifying the terminal according to the private key signature information and the preset information includes: using The public key information verifies the private key signature information; in the case of passing the verification, obtaining the attribute information of the terminal from the blockchain ledger according to the preset information, including: in the case of passing the verification In the case of , obtain the corresponding third terminal identification information from the blockchain ledger according to the public key information; in the case of obtaining the third terminal identification information, obtain the third terminal identification information from the blockchain ledger
  • the attribute information corresponding to the three terminal identification information is used as the attribute information of the terminal.
  • the verifying the terminal according to the private key signature information and the preset information includes: according to the first terminal identification information, obtain the public key information to be verified and obtain the stored public key information of the terminal from the blockchain ledger; according to the public key information of the terminal, the public key information to be verified and all The private key signature information is verified; in the case of passing the verification, obtaining the attribute information of the terminal from the blockchain ledger according to the preset information, including: in the case of passing the verification, according to the For the first terminal identification information, attribute information of the terminal is obtained from the blockchain ledger.
  • the terminal when the preset information includes the identification information of the second terminal and the public key information, the terminal is verified according to the private key signature information and the preset information. , including: using the public key information in the preset information to verify the private key signature information; and obtaining the stored public key of the terminal from the blockchain ledger according to the second terminal identification information information; verify the public key information in the preset information according to the acquired public key information of the terminal; or verify the private key signature information by using the public key information in the preset information; and obtain the stored hash value of the public key of the terminal from the blockchain ledger according to the identification information of the second terminal; obtain the hash value to be verified according to the public key information in the preset information ; Verify the hash value to be verified according to the obtained hash value of the public key of the terminal.
  • the terminal is verified according to the private key signature information and the preset information
  • the method includes: obtaining the stored public key information of the terminal from the blockchain ledger according to the identification information of the second terminal; obtaining the public key to be verified according to the hash value of the public key in the preset information information; verifying the private key signature information according to the public key information to be verified; and verifying the public key information to be verified according to the acquired public key information of the terminal.
  • obtaining the attribute information of the terminal from the blockchain ledger according to the preset information includes: in the case of passing the verification, according to the second Terminal identification information, the attribute information of the terminal is obtained from the blockchain ledger.
  • the private key signature information includes first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the random number sent by the first network-side device in response to the access request the second signature information.
  • the relevant information to be verified further includes the timestamp; the signature information according to the private key and the preset information , verifying the terminal, including: confirming whether the time stamp is within the validity period; if the time stamp is within the validity period, verifying the terminal according to the private key signature information and the preset information authenticating.
  • the preset information further includes validity period information of the first information; the first information includes at least one of the attribute information, the first terminal identification information and the second terminal identification information; the Verifying the terminal according to the private key signature information and the preset information includes: confirming, according to the validity period information, whether the first information is within the validity period; if the first information is within the validity period In this case, the terminal is verified according to the private key signature information and other information in the preset information except the validity period information.
  • At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes using the first network the first key encrypted by the public key of the side device; the processor is further configured to: use the first network side before feeding back a request response for access control to the terminal according to the attribute information
  • the private key of the device decrypts the first key encrypted by the public key to obtain the first key; according to the first key, for the encrypted data obtained from the blockchain ledger information is decrypted to obtain the at least one authentication information;
  • the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or public identification information with the terminal.
  • key-independent second terminal identification information or third terminal identification information corresponding to the public key of the terminal, and at least one of the public key information of the terminal or a hash value of the public key of the terminal.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first information.
  • a timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
  • An embodiment of the present disclosure also provides a terminal, as shown in FIG. 18 , including: a processor 181 and a transceiver 182;
  • the processor 181 is configured to send the relevant information to be verified corresponding to the access request to the first network side device through the transceiver 182; wherein, the relevant information to be verified includes the private key signature information of the terminal and the predetermined information. Set the location information of the information in the blockchain;
  • the preset information includes public key information of the terminal, or first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, and the The public key information of the terminal, or the identification information of the second terminal and the hash value of the public key of the terminal.
  • the terminal provided by the embodiment of the present disclosure sends the relevant information to be verified corresponding to the access request to the first network-side device; wherein, the relevant information to be verified includes the private key signature information of the terminal and the preset information in the area location information in the blockchain; receiving a request response for access control fed back by the first network-side device; wherein the preset information includes the public key information of the terminal, or is obtained according to the public key of the terminal the first terminal identification information, or the second terminal identification information unrelated to the public key of the terminal and the public key information of the terminal, or the second terminal identification information and the hash value of the public key of the terminal ; It can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid the single point of failure caused by DDoS attacks on traditional authentication servers.
  • the sending the relevant information to be verified corresponding to the access request to the first network-side device includes: sending an access request to the first network-side device, where the access request carries the relevant information to be verified; or, Sending an access request to the first network-side device; receiving a random number fed back by the first network-side device according to the access request; and sending the relevant information to be verified to the first network-side device according to the random number.
  • the private key signature information includes first signature information using the terminal's private key to the timestamp, or using the terminal's private key to the random number sent by the first network-side device in response to the access request the second signature information.
  • the relevant information to be verified further includes the timestamp.
  • the preset information further includes validity period information of the first information; the first information includes at least one item of attribute information of the terminal, identification information of the first terminal and identification information of the second terminal.
  • At least one piece of authentication information related to the terminal is stored in the blockchain ledger as encrypted information encrypted with a first key; the relevant information to be verified further includes using the first network side device The first key encrypted by the public key of the terminal; wherein, the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or a public key with the terminal. key-independent second terminal identification information or third terminal identification information corresponding to the public key of the terminal, and at least one of the public key information of the terminal or a hash value of the public key of the terminal.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first information.
  • a timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
  • the processor is further configured to: before sending the relevant information to be verified corresponding to the access request to the first network-side device, send the information of the terminal to the first blockchain node through the transceiver.
  • Information to be authenticated wherein, the information to be authenticated includes user credential information and/or attribute information; the user credential information includes terminal identification information.
  • An embodiment of the present disclosure further provides a blockchain node, where the blockchain node is a first blockchain node, as shown in FIG. 19 , including: a processor 191 and a transceiver 192;
  • the processor 191 is configured to receive the information to be authenticated sent by the terminal through the transceiver 192;
  • At least one authentication information corresponding to the information to be authenticated is stored in the blockchain ledger;
  • the to-be-authenticated information includes user credential information and/or attribute information;
  • the user credential information includes terminal identification information;
  • the at least one authentication information includes: attribute information of the terminal, first terminal identification information obtained according to the public key of the terminal, or second terminal identification information unrelated to the public key of the terminal, or identification information related to the terminal.
  • the blockchain node receives the information to be authenticated sent by the terminal; authenticates the information to be authenticated; if the authentication is passed, at least one authentication information corresponding to the information to be authenticated Stored in the blockchain ledger; wherein, the information to be authenticated includes user credential information and/or attribute information; the user credential information includes terminal identification information; the at least one authentication information includes: attribute information of the terminal, The first terminal identification information obtained according to the public key of the terminal, the second terminal identification information unrelated to the public key of the terminal, or the third terminal identification information corresponding to the public key of the terminal, and the terminal At least one of the public key information of the terminal or the hash value of the public key of the terminal; it can support the implementation of the access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid Similar to the problem of single point of failure caused by DDoS attacks on traditional authentication servers.
  • the at least one piece of authentication information further includes: a timestamp corresponding to the terminal; and/or information on the validity period of the second information; wherein, the timestamp is signed by using the private key of the terminal to obtain the first timestamp of the signature information; the second information includes at least one of the attribute information, the first terminal identification information, the second terminal identification information and the third terminal identification information.
  • storing at least one authentication information corresponding to the information to be authenticated in the blockchain ledger includes: randomly generating a first key for encryption; using The first key encrypts the at least one authentication information and stores it in the blockchain ledger.
  • the processor is further configured to: after randomly generating the first key for encryption, encrypt the first key with the public key of the terminal and store the first key in the blockchain ledger.
  • the authenticating the information to be authenticated includes: according to a first preset policy, sending the user credential information in the information to be authenticated to at least one second network-side device for authentication; receiving The first authentication result and the corresponding third signature information fed back by the at least one second network side device; according to the second preset policy, the first authentication result and the third signature information, obtain whether the user credential information is authenticated The first final result passed.
  • the authenticating the information to be authenticated includes: according to a first preset policy, sending attribute information in the information to be authenticated to at least one third network-side device for authentication; receiving the at least one first 3.
  • the authentication of the information to be authenticated includes: sending the information to be authenticated to a second blockchain node; receiving feedback from the second blockchain node with the information to be authenticated The first authentication result corresponding to the user credential information in the information and the corresponding third signature information; and according to the second preset policy, the first authentication result and the third signature information, obtain whether the user credential information is authenticated or not. the first final result; and/or, receiving the second authentication result corresponding to the attribute information in the information to be authenticated and the corresponding fourth signature information fed back by the second blockchain node; and according to the third preset The policy, the second authentication result and the fourth signature information are used to obtain the second final result of whether the attribute information is authenticated.
  • the above-mentioned implementation embodiments of the access control method on the side of the first blockchain node are all applicable to the embodiments of the blockchain node, and can also achieve the same technical effect.
  • An embodiment of the present disclosure further provides a blockchain node, where the blockchain node is a second blockchain node, as shown in FIG. 20 , including: a processor 201 and a transceiver 202;
  • the processor 201 is configured to receive the information to be authenticated of the terminal sent by the first blockchain node through the transceiver 202;
  • the transceiver 202 sends the user credential information in the information to be authenticated to at least one second network side device for authentication, and receives the first authentication result and the corresponding first authentication result fed back by the at least one second network side device.
  • the transceiver 202 sends the attribute information in the information to be authenticated to at least one third network-side device for authentication, and receives the second authentication result and the corresponding fourth authentication result fed back by the at least one third network-side device.
  • the signature information is fed back to the first blockchain node;
  • the user credential information includes terminal identification information.
  • the blockchain node receives the information to be authenticated of the terminal sent by the first blockchain node, and sends the user credential information in the information to be authenticated to at least one second network side device for authentication , and receive the first authentication result and the corresponding third signature information fed back by the at least one second network side device, and feed it back to the first blockchain node; and/or, convert the attributes in the information to be authenticated Send the information to at least one third network side device for authentication, and receive the second authentication result and the corresponding fourth signature information fed back by the at least one third network side device, and feed it back to the first blockchain node; wherein , the user credential information includes terminal identification information; it can support the implementation of the access control scheme using blockchain, and providing attribute verification services to customers in the form of blockchain can avoid similar traditional authentication servers suffering from DDoS attacks. The single point of failure problem.
  • An embodiment of the present disclosure further provides a network-side device, where the network-side device is a second network-side device, as shown in FIG. 21 , including: a processor 211 and a transceiver 212;
  • the processor 211 is configured to receive, through the transceiver 212, the user credential information of the terminal to be authenticated sent by the blockchain node;
  • the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node;
  • the user credential information includes terminal identification information.
  • the network-side device receives the user credential information of the terminal to be authenticated sent by the blockchain node; authenticates the user credential information, obtains a first authentication result, and uses the third signature information to perform authentication signature; feedback the first authentication result and the third signature information to the blockchain node; wherein, the blockchain node is the first blockchain node or a device that communicates with the first blockchain node
  • the blockchain node is the first blockchain node or a device that communicates with the first blockchain node
  • the second block chain node; the user credential information includes terminal identification information; it can support the implementation of the access control scheme using block chain, and provide attribute verification services to customers in the form of block chain, which can avoid similar traditional authentication
  • the server suffers from a single point of failure caused by a DDoS attack.
  • An embodiment of the present disclosure further provides a network-side device, where the network-side device is a third network-side device, as shown in FIG. 22 , including: a processor 221 and a transceiver 222;
  • the processor 221 is configured to receive, through the transceiver 222, the attribute information of the terminal to be authenticated sent by the blockchain node;
  • the blockchain node is a first blockchain node or a second blockchain node that communicates with the first blockchain node.
  • the network side device receives the attribute information of the terminal to be authenticated sent by the blockchain node; authenticates the attribute information, obtains a second authentication result, and uses the fourth signature information to sign; Feeding back the second authentication result and the fourth signature information to the blockchain node; wherein the blockchain node is the first blockchain node or the second blockchain node that communicates with the first blockchain node Blockchain node; can support the implementation of access control scheme using blockchain, and provide attribute verification services to customers in the form of blockchain, which can avoid the problem of single point of failure caused by DDoS attacks similar to traditional authentication servers.
  • the above-mentioned implementation embodiments of the access control method on the device side of the third network side are all applicable to the embodiments of the network side device, and can also achieve the same technical effect.
  • An embodiment of the present disclosure further provides a network-side device, including a memory, a processor, and a program stored in the memory and running on the processor; the processor implements the first above-mentioned first when executing the program. an access control method on the network side device side; or, when the processor executes the program, implements the above-mentioned second access control method on the network side device side; or, when the processor executes the program, implements the above-mentioned third method An access control method on the network side device side.
  • the above-mentioned implementation embodiments of the access control method on the first network side device side, the second network side device side or the third network side device side are all applicable to the embodiments of the network side device, and can also achieve the corresponding The same technical effect.
  • An embodiment of the present disclosure further provides a terminal, including a memory, a processor, and a program stored in the memory and running on the processor; when the processor executes the program, the above-mentioned connection on the terminal side is implemented. access control method.
  • Embodiments of the present disclosure further provide a blockchain node, including a memory, a processor, and a program stored on the memory and executable on the processor; when the processor executes the program, the above-mentioned first step is implemented.
  • the above-mentioned implementation embodiments of the access control method on the first blockchain node side or the second blockchain node side are all applicable to the embodiments of the blockchain node, and can also achieve the same technical effect. .
  • An embodiment of the present disclosure further provides a readable storage medium, on which a program is stored, and when the program is executed by a processor, implements the steps in the above-mentioned access control method on the device side of the first network side; or, the program is processed When executed by the processor, the steps in the access control method on the terminal side are implemented; or, when the program is executed by the processor, the steps in the access control method on the first blockchain node side are implemented; or, the program is executed by the processor.
  • the access control method on the first network side device side, the terminal side, the first blockchain node side, the second blockchain node side, the second network side device side or the third network side device side mentioned above The implementation embodiments are all applicable to the embodiments of the readable storage medium, and the corresponding same technical effects can also be achieved.
  • the modules may be implemented in software so as to be executed by various types of processors.
  • an identified executable code module may comprise one or more physical or logical blocks of computer instructions, which may be structured as objects, procedures, or functions, for example. Nonetheless, the executable code of the identified module need not be physically located together, but may include different instructions stored in different bits that, when logically combined, constitute the module and implement the specification of the module Purpose.
  • an executable code module may be a single instruction or many instructions, and may even be distributed over multiple different code segments, among different programs, and across multiple memory devices.
  • operational data may be identified within modules, and may be implemented in any suitable form and organized within any suitable type of data structure. The operational data may be collected as a single data set, or may be distributed over different locations (including over different storage devices), and may exist at least in part only as electronic signals on a system or network.
  • a module When a module can be implemented by software, considering the level of existing hardware technology, a module that can be implemented by software, regardless of cost, can build corresponding hardware circuits to implement corresponding functions.
  • the hardware circuits include conventional very large scale integration (VLSI) circuits or gate arrays as well as off-the-shelf semiconductors such as logic chips, transistors, or other discrete components.
  • VLSI very large scale integration
  • a module may also be implemented in programmable hardware devices, such as field programmable gate arrays, programmable array logic, programmable logic devices, and the like.
  • the disclosed apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solutions of the embodiments of the present disclosure.
  • each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer-readable storage medium. Based on such understanding, the technical solutions of the present disclosure can be embodied in the form of software products in essence, or the parts that contribute to the prior art or the parts of the technical solutions.
  • the computer software products are stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present disclosure.
  • the aforementioned storage medium includes: a U disk, a removable hard disk, a ROM, a RAM, a magnetic disk, or an optical disk and other mediums that can store program codes.
  • modules, units, sub-modules, sub-units, etc. can be implemented in one or more Application Specific Integrated Circuits (ASIC), Digital Signal Processing (DSP), digital signal processing equipment ( DSP Device, DSPD), Programmable Logic Device (Programmable Logic Device, PLD), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA), general-purpose processor, controller, microcontroller, microprocessor, for in other electronic units or combinations thereof that perform the functions described in this disclosure.
  • ASIC Application Specific Integrated Circuits
  • DSP Digital Signal Processing
  • DSP Device digital signal processing equipment
  • PLD Programmable Logic Device
  • Field-Programmable Gate Array Field-Programmable Gate Array
  • FPGA Field-Programmable Gate Array

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Telephonic Communication Services (AREA)
  • Storage Device Security (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本公开提供了一种接入控制方法、装置、网络侧设备、终端及区块链节点，其中，接入控制方法包括：接收终端发送的对应于访问请求的待验证相关信息；所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；根据所述位置信息，从区块链中获取所述预设信息；根据所述私钥签名信息以及所述预设信息，对所述终端进行验证；在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息；根据所述属性信息，向所述终端反馈针对接入控制的请求响应。

Description

接入控制方法、装置、网络侧设备、终端及区块链节点
相关申请的交叉引用
本公开主张在2020年12月29日在中国提交的中国专利申请号No.202011591112.0的优先权，其全部内容通过引用包含于此。
技术领域
本公开涉及通信技术领域，尤其涉及一种接入控制方法、装置、网络侧设备、终端及区块链节点。
背景技术
访问控制指***对用户身份及其所属的策略组限制其使用数据资源能力的手段。访问控制是***保密性、完整性、可用性和合法使用性的重要基础，是网络安全防范和资源保护的关键策略之一，也是主体依据某些控制策略或权限对客体本身或其资源进行的不同授权访问。
访问控制的主要目的是限制访问主体对客体的访问，从而保障数据资源在合法范围内得以有效使用和管理。例如，***管理员控制用户对服务器、目录、文件等网络资源的访问。为了达到上述目的，访问控制需要完成两个任务：识别和确认访问***的用户、决定该用户可以对某一***资源进行何种类型的访问。
访问控制功能可以在客体实现，也可以部署集中的设备实施访问控制。对于前者，对客体设备要求较高，如果访问量比较大，将严重影响客体性能。集中部署的访问控制功能是目前常用的技术手段，访问主体向集中的访问控制***发起请求，在经过认证和授权之后，访问主体向客体发起访问。
也可以理解为，传统技术中，访问控制***是中心化设备；但是，其被暴露在网络中，容易遭受分布式拒绝服务(Distributed Denial of Service，DDoS)等网络攻击。一旦控制器受到网络攻击停止服务，有可能导致整个***无法正常运行。
也就是，相关技术中存在传统认证服务器遭受DDoS攻击导致的单点失 败问题。
发明内容
本公开的目的在于提供一种接入控制方法、装置、网络侧设备、终端及区块链节点，以解决相关技术中存在传统认证服务器遭受DDoS攻击导致单点失败的问题。
为了解决上述技术问题，本公开实施例提供一种接入控制方法，应用于第一网络侧设备，包括：
接收终端发送的对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
根据所述位置信息，从区块链中获取所述预设信息；
根据所述私钥签名信息以及所述预设信息，对所述终端进行验证；
在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息；
根据所述属性信息，向所述终端反馈针对接入控制的请求响应；
其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
可选的，所述接收终端发送的对应于访问请求的待验证相关信息，包括：
接收所述终端发送的访问请求，所述访问请求中携带有待验证相关信息；或者，
接收所述终端发送的访问请求；
根据所述访问请求，向所述终端反馈随机数；
接收所述终端根据所述随机数发送的待验证相关信息。
可选的，在所述预设信息包括所述终端的公钥信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
利用所述公钥信息对所述私钥签名信息进行验证；
所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所 述终端的属性信息，包括：
在验证通过的情况下，根据所述公钥信息，从区块链账本中获取对应的第三终端标识信息；
在获取到所述第三终端标识信息的情况下，从区块链账本中获取所述第三终端标识信息对应的属性信息作为所述终端的属性信息。
可选的，在所述预设信息包括所述第一终端标识信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
根据所述第一终端标识信息，得到待验证的公钥信息以及从区块链账本中获取已存储的所述终端的公钥信息；
根据所述终端的公钥信息，对所述待验证的公钥信息以及所述私钥签名信息进行验证；
所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：
在验证通过的情况下，根据所述第一终端标识信息，从区块链账本中获取所述终端的属性信息。
可选的，在所述预设信息包括所述第二终端标识信息以及公钥信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
利用所述预设信息中的公钥信息对所述私钥签名信息进行验证；并根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥信息；根据获取的所述终端的公钥信息，对所述预设信息中的公钥信息进行验证；或者，
利用所述预设信息中的公钥信息对所述私钥签名信息进行验证；并根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥的散列值；根据所述预设信息中的公钥信息，得到待验证的散列值；根据获取的所述终端的公钥的散列值，对所述待验证的散列值进行验证。
可选的，在所述预设信息包括所述第二终端标识信息以及公钥的散列值的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥信息；
根据所述预设信息中的公钥的散列值，得到待验证的公钥信息；
根据所述待验证的公钥信息，对所述私钥签名信息进行验证；并根据获取的所述终端的公钥信息，对所述待验证的公钥信息进行验证。
可选的，所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：
在验证通过的情况下，根据所述第二终端标识信息，从区块链账本中获取所述终端的属性信息。
可选的，所述私钥签名信息包括采用所述终端的私钥对时间戳的第一签名信息，或者，采用所述终端的私钥对所述第一网络侧设备响应于访问请求发送的随机数的第二签名信息。
可选的，在所述私钥签名信息包括第一签名信息的情况下，所述待验证相关信息还包括所述时间戳；
所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
确认所述时间戳是否处于有效期内；
在所述时间戳处于有效期内的情况下，根据所述私钥签名信息以及所述预设信息，对所述终端进行验证。
可选的，所述预设信息还包括第一信息的有效期信息；所述第一信息包括所述属性信息、所述第一终端标识信息以及所述第二终端标识信息中的至少一项；
所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
根据所述有效期信息，确认所述第一信息是否处于有效期内；
在所述第一信息处于有效期内的情况下，根据所述私钥签名信息以及所述预设信息中除所述有效期信息外的其他信息，对所述终端进行验证。
可选的，与所述终端相关的至少一个认证信息在所述区块链账本中存储为采用第一密钥加密的加密信息；所述待验证相关信息还包括使用所述第一 网络侧设备的公钥加密的所述第一密钥；
在根据所述属性信息，向所述终端反馈针对接入控制的请求响应之前，还包括：
使用所述第一网络侧设备的私钥对所述公钥加密的所述第一密钥进行解密，得到所述第一密钥；
根据所述第一密钥，针对从所述区块链账本中获取的所述加密信息进行解密，得到所述至少一个认证信息；
其中，所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
可选的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，
第二信息的有效期信息；
其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；
所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
本公开实施例还提供了一种接入控制方法，应用于终端，包括：
向第一网络侧设备发送对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
接收所述第一网络侧设备反馈的针对接入控制的请求响应；
其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
可选的，所述向第一网络侧设备发送对应于访问请求的待验证相关信息，包括：
向第一网络侧设备发送访问请求，所述访问请求中携带有待验证相关信 息；或者，
向第一网络侧设备发送访问请求；
接收所述第一网络侧设备根据所述访问请求反馈的随机数；
根据所述随机数，向所述第一网络侧设备发送待验证相关信息。
可选的，所述私钥签名信息包括采用所述终端的私钥对时间戳的第一签名信息，或者，采用所述终端的私钥对所述第一网络侧设备响应于访问请求发送的随机数的第二签名信息。
可选的，在所述私钥签名信息包括第一签名信息的情况下，所述待验证相关信息还包括所述时间戳。
可选的，所述预设信息还包括第一信息的有效期信息；所述第一信息包括所述终端的属性信息、所述第一终端标识信息以及所述第二终端标识信息中的至少一项。
可选的，与所述终端相关的至少一个认证信息在区块链账本中存储为采用第一密钥加密的加密信息；所述待验证相关信息还包括使用所述第一网络侧设备的公钥加密的所述第一密钥；
其中，所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
可选的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，
第二信息的有效期信息；
其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；
所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
可选的，在向第一网络侧设备发送对应于访问请求的待验证相关信息之前，还包括：
向第一区块链节点发送所述终端的待认证信息；
其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证 信息包括终端标识信息。
本公开实施例还提供了一种接入控制方法，应用于第一区块链节点，包括：
接收终端发送的待认证信息；
对所述待认证信息进行认证；
在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中；
其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息；
所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
可选的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，
第二信息的有效期信息；
其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；
所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
可选的，所述在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中，包括：
随机生成用于加密的第一密钥；
使用所述第一密钥对所述至少一个认证信息进行加密后存储在区块链账本中。
可选的，在随机生成用于加密的第一密钥之后，还包括：
使用所述终端的公钥对所述第一密钥加密后存储在区块链账本中。
可选的，所述对所述待认证信息进行认证，包括：
根据第一预设策略，将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证；
接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息；
根据第二预设策略、所述第一认证结果以及第三签名信息，得到所述用户凭证信息是否认证通过的第一最终结果。
可选的，所述对所述待认证信息进行认证，包括：
根据第一预设策略，将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证；
接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息；
根据第三预设策略、所述第二认证结果以及第四签名信息，得到所述属性信息是否认证通过的第二最终结果。
可选的，所述对所述待认证信息进行认证，包括：
将所述待认证信息发送给第二区块链节点；
接收所述第二区块链节点反馈的与所述待认证信息中的用户凭证信息对应的第一认证结果以及对应的第三签名信息；并根据第二预设策略、所述第一认证结果以及第三签名信息，得到所述用户凭证信息是否认证通过的第一最终结果；和/或，
接收所述第二区块链节点反馈的与所述待认证信息中的属性信息对应的第二认证结果以及对应的第四签名信息；并根据第三预设策略、所述第二认证结果以及第四签名信息，得到所述属性信息是否认证通过的第二最终结果。
本公开实施例还提供了一种接入控制方法，应用于第二区块链节点，包括：
接收第一区块链节点发送的终端的待认证信息；
将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证，并接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息，反馈给所述第一区块链节点；和/或，
将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证，并接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息，反馈给所述第一区块链节点；
其中，所述用户凭证信息包括终端标识信息。
本公开实施例还提供了一种接入控制方法，应用于第二网络侧设备，包括：
接收区块链节点发送的待认证的终端的用户凭证信息；
对所述用户凭证信息进行认证，得到第一认证结果，并使用第三签名信息进行签名；
将所述第一认证结果以及第三签名信息反馈给所述区块链节点；
其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点；
所述用户凭证信息包括终端标识信息。
本公开实施例还提供了一种接入控制方法，应用于第三网络侧设备，包括：
接收区块链节点发送的待认证的终端的属性信息；
对所述属性信息进行认证，得到第二认证结果，并使用第四签名信息进行签名；
将所述第二认证结果以及第四签名信息反馈给所述区块链节点；
其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点。
本公开实施例还提供了一种接入控制装置，应用于第一网络侧设备，包括：
第一接收模块，用于接收终端发送的对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
第一获取模块，用于根据所述位置信息，从区块链中获取所述预设信息；
第一验证模块，用于根据所述私钥签名信息以及所述预设信息，对所述终端进行验证；
第二接收模块，用于在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息；
第一反馈模块，用于根据所述属性信息，向所述终端反馈针对接入控制 的请求响应；
其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
可选的，所述接收终端发送的对应于访问请求的待验证相关信息，包括：
接收所述终端发送的访问请求，所述访问请求中携带有待验证相关信息；或者，
接收所述终端发送的访问请求；
根据所述访问请求，向所述终端反馈随机数；
接收所述终端根据所述随机数发送的待验证相关信息。
可选的，在所述预设信息包括所述终端的公钥信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
利用所述公钥信息对所述私钥签名信息进行验证；
所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：
在验证通过的情况下，根据所述公钥信息，从区块链账本中获取对应的第三终端标识信息；
在获取到所述第三终端标识信息的情况下，从区块链账本中获取所述第三终端标识信息对应的属性信息作为所述终端的属性信息。
可选的，在所述预设信息包括所述第一终端标识信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
根据所述第一终端标识信息，得到待验证的公钥信息以及从区块链账本中获取已存储的所述终端的公钥信息；
根据所述终端的公钥信息，对所述待验证的公钥信息以及所述私钥签名信息进行验证；
所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：
在验证通过的情况下，根据所述第一终端标识信息，从区块链账本中获 取所述终端的属性信息。
可选的，在所述预设信息包括所述第二终端标识信息以及公钥信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
利用所述预设信息中的公钥信息对所述私钥签名信息进行验证；并根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥信息；根据获取的所述终端的公钥信息，对所述预设信息中的公钥信息进行验证；或者，
利用所述预设信息中的公钥信息对所述私钥签名信息进行验证；并根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥的散列值；根据所述预设信息中的公钥信息，得到待验证的散列值；根据获取的所述终端的公钥的散列值，对所述待验证的散列值进行验证。
可选的，在所述预设信息包括所述第二终端标识信息以及公钥的散列值的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥信息；
根据所述预设信息中的公钥的散列值，得到待验证的公钥信息；
根据所述待验证的公钥信息，对所述私钥签名信息进行验证；并根据获取的所述终端的公钥信息，对所述待验证的公钥信息进行验证。
可选的，所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：
在验证通过的情况下，根据所述第二终端标识信息，从区块链账本中获取所述终端的属性信息。
可选的，所述私钥签名信息包括采用所述终端的私钥对时间戳的第一签名信息，或者，采用所述终端的私钥对所述第一网络侧设备响应于访问请求发送的随机数的第二签名信息。
可选的，在所述私钥签名信息包括第一签名信息的情况下，所述待验证相关信息还包括所述时间戳；
所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
确认所述时间戳是否处于有效期内；
在所述时间戳处于有效期内的情况下，根据所述私钥签名信息以及所述预设信息，对所述终端进行验证。
可选的，所述预设信息还包括第一信息的有效期信息；所述第一信息包括所述属性信息、所述第一终端标识信息以及所述第二终端标识信息中的至少一项；
所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
根据所述有效期信息，确认所述第一信息是否处于有效期内；
在所述第一信息处于有效期内的情况下，根据所述私钥签名信息以及所述预设信息中除所述有效期信息外的其他信息，对所述终端进行验证。
可选的，与所述终端相关的至少一个认证信息在所述区块链账本中存储为采用第一密钥加密的加密信息；所述待验证相关信息还包括使用所述第一网络侧设备的公钥加密的所述第一密钥；
所述接入控制装置还包括：
第一解密模块，用于在根据所述属性信息，向所述终端反馈针对接入控制的请求响应之前，使用所述第一网络侧设备的私钥对所述公钥加密的所述第一密钥进行解密，得到所述第一密钥；
第二解密模块，用于根据所述第一密钥，针对从所述区块链账本中获取的所述加密信息进行解密，得到所述至少一个认证信息；
其中，所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
可选的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，
第二信息的有效期信息；
其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息 的时间戳；
所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
本公开实施例还提供了一种接入控制装置，应用于终端，包括：
第一发送模块，用于向第一网络侧设备发送对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
第三接收模块，用于接收所述第一网络侧设备反馈的针对接入控制的请求响应；
其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
可选的，所述向第一网络侧设备发送对应于访问请求的待验证相关信息，包括：
向第一网络侧设备发送访问请求，所述访问请求中携带有待验证相关信息；或者，
向第一网络侧设备发送访问请求；
接收所述第一网络侧设备根据所述访问请求反馈的随机数；
根据所述随机数，向所述第一网络侧设备发送待验证相关信息。
可选的，所述私钥签名信息包括采用所述终端的私钥对时间戳的第一签名信息，或者，采用所述终端的私钥对所述第一网络侧设备响应于访问请求发送的随机数的第二签名信息。
可选的，在所述私钥签名信息包括第一签名信息的情况下，所述待验证相关信息还包括所述时间戳。
可选的，所述预设信息还包括第一信息的有效期信息；所述第一信息包括所述终端的属性信息、所述第一终端标识信息以及所述第二终端标识信息中的至少一项。
可选的，与所述终端相关的至少一个认证信息在区块链账本中存储为采 用第一密钥加密的加密信息；所述待验证相关信息还包括使用所述第一网络侧设备的公钥加密的所述第一密钥；
其中，所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
可选的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，
第二信息的有效期信息；
其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；
所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
可选的，还包括：
第二发送模块，用于在向第一网络侧设备发送对应于访问请求的待验证相关信息之前，向第一区块链节点发送所述终端的待认证信息；
其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息。
本公开实施例还提供了一种接入控制装置，应用于第一区块链节点，包括：
第四接收模块，用于接收终端发送的待认证信息；
第一认证模块，用于对所述待认证信息进行认证；
第一存储模块，用于在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中；
其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息；
所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
可选的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，
第二信息的有效期信息；
其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；
所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
可选的，所述在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中，包括：
随机生成用于加密的第一密钥；
使用所述第一密钥对所述至少一个认证信息进行加密后存储在区块链账本中。
可选的，还包括：
第一处理模块，用于在随机生成用于加密的第一密钥之后，使用所述终端的公钥对所述第一密钥加密后存储在区块链账本中。
可选的，所述对所述待认证信息进行认证，包括：
根据第一预设策略，将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证；
接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息；
根据第二预设策略、所述第一认证结果以及第三签名信息，得到所述用户凭证信息是否认证通过的第一最终结果。
可选的，所述对所述待认证信息进行认证，包括：
根据第一预设策略，将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证；
接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息；
根据第三预设策略、所述第二认证结果以及第四签名信息，得到所述属性信息是否认证通过的第二最终结果。
可选的，所述对所述待认证信息进行认证，包括：
将所述待认证信息发送给第二区块链节点；
接收所述第二区块链节点反馈的与所述待认证信息中的用户凭证信息对应的第一认证结果以及对应的第三签名信息；并根据第二预设策略、所述第一认证结果以及第三签名信息，得到所述用户凭证信息是否认证通过的第一最终结果；和/或，
接收所述第二区块链节点反馈的与所述待认证信息中的属性信息对应的第二认证结果以及对应的第四签名信息；并根据第三预设策略、所述第二认证结果以及第四签名信息，得到所述属性信息是否认证通过的第二最终结果。
本公开实施例还提供了一种接入控制装置，应用于第二区块链节点，包括：
第五接收模块，用于接收第一区块链节点发送的终端的待认证信息；
第二处理模块，用于将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证，并接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息，反馈给所述第一区块链节点；和/或，
第三处理模块，用于将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证，并接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息，反馈给所述第一区块链节点；
其中，所述用户凭证信息包括终端标识信息。
本公开实施例还提供了一种接入控制装置，应用于第二网络侧设备，包括：
第六接收模块，用于接收区块链节点发送的待认证的终端的用户凭证信息；
第四处理模块，用于对所述用户凭证信息进行认证，得到第一认证结果，并使用第三签名信息进行签名；
第二反馈模块，用于将所述第一认证结果以及第三签名信息反馈给所述区块链节点；
其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点；
所述用户凭证信息包括终端标识信息。
本公开实施例还提供了一种接入控制装置，应用于第三网络侧设备，包括：
第七接收模块，用于接收区块链节点发送的待认证的终端的属性信息；
第五处理模块，用于对所述属性信息进行认证，得到第二认证结果，并使用第四签名信息进行签名；
第三反馈模块，用于将所述第二认证结果以及第四签名信息反馈给所述区块链节点；
其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点。
本公开实施例还提供了一种网络侧设备，所述网络侧设备为第一网络侧设备，包括：处理器和收发机；
所述处理器，用于通过所述收发机接收终端发送的对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
根据所述位置信息，从区块链中获取所述预设信息；
根据所述私钥签名信息以及所述预设信息，对所述终端进行验证；
在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息；
根据所述属性信息，通过所述收发机向所述终端反馈针对接入控制的请求响应；
其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
可选的，所述接收终端发送的对应于访问请求的待验证相关信息，包括：
接收所述终端发送的访问请求，所述访问请求中携带有待验证相关信息；或者，
接收所述终端发送的访问请求；
根据所述访问请求，向所述终端反馈随机数；
接收所述终端根据所述随机数发送的待验证相关信息。
可选的，在所述预设信息包括所述终端的公钥信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
利用所述公钥信息对所述私钥签名信息进行验证；
所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：
在验证通过的情况下，根据所述公钥信息，从区块链账本中获取对应的第三终端标识信息；
在获取到所述第三终端标识信息的情况下，从区块链账本中获取所述第三终端标识信息对应的属性信息作为所述终端的属性信息。
可选的，在所述预设信息包括所述第一终端标识信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
根据所述第一终端标识信息，得到待验证的公钥信息以及从区块链账本中获取已存储的所述终端的公钥信息；
根据所述终端的公钥信息，对所述待验证的公钥信息以及所述私钥签名信息进行验证；
所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：
在验证通过的情况下，根据所述第一终端标识信息，从区块链账本中获取所述终端的属性信息。
可选的，在所述预设信息包括所述第二终端标识信息以及公钥信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
利用所述预设信息中的公钥信息对所述私钥签名信息进行验证；并根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥信息；根据获取的所述终端的公钥信息，对所述预设信息中的公钥信息进行验证；或者，
利用所述预设信息中的公钥信息对所述私钥签名信息进行验证；并根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥的散 列值；根据所述预设信息中的公钥信息，得到待验证的散列值；根据获取的所述终端的公钥的散列值，对所述待验证的散列值进行验证。
可选的，在所述预设信息包括所述第二终端标识信息以及公钥的散列值的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥信息；
根据所述预设信息中的公钥的散列值，得到待验证的公钥信息；
根据所述待验证的公钥信息，对所述私钥签名信息进行验证；并根据获取的所述终端的公钥信息，对所述待验证的公钥信息进行验证。
可选的，所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：
在验证通过的情况下，根据所述第二终端标识信息，从区块链账本中获取所述终端的属性信息。
可选的，所述私钥签名信息包括采用所述终端的私钥对时间戳的第一签名信息，或者，采用所述终端的私钥对所述第一网络侧设备响应于访问请求发送的随机数的第二签名信息。
可选的，在所述私钥签名信息包括第一签名信息的情况下，所述待验证相关信息还包括所述时间戳；
所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
确认所述时间戳是否处于有效期内；
在所述时间戳处于有效期内的情况下，根据所述私钥签名信息以及所述预设信息，对所述终端进行验证。
可选的，所述预设信息还包括第一信息的有效期信息；所述第一信息包括所述属性信息、所述第一终端标识信息以及所述第二终端标识信息中的至少一项；
所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
根据所述有效期信息，确认所述第一信息是否处于有效期内；
在所述第一信息处于有效期内的情况下，根据所述私钥签名信息以及所述预设信息中除所述有效期信息外的其他信息，对所述终端进行验证。
可选的，与所述终端相关的至少一个认证信息在所述区块链账本中存储为采用第一密钥加密的加密信息；所述待验证相关信息还包括使用所述第一网络侧设备的公钥加密的所述第一密钥；
所述处理器还用于：
在根据所述属性信息，向所述终端反馈针对接入控制的请求响应之前，使用所述第一网络侧设备的私钥对所述公钥加密的所述第一密钥进行解密，得到所述第一密钥；
根据所述第一密钥，针对从所述区块链账本中获取的所述加密信息进行解密，得到所述至少一个认证信息；
其中，所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
可选的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，
第二信息的有效期信息；
其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；
所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
本公开实施例还提供了一种终端，包括：处理器和收发机；
所述处理器，用于通过所述收发机向第一网络侧设备发送对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
通过所述收发机接收所述第一网络侧设备反馈的针对接入控制的请求响应；
其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公 钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
可选的，所述向第一网络侧设备发送对应于访问请求的待验证相关信息，包括：
向第一网络侧设备发送访问请求，所述访问请求中携带有待验证相关信息；或者，
向第一网络侧设备发送访问请求；
接收所述第一网络侧设备根据所述访问请求反馈的随机数；
根据所述随机数，向所述第一网络侧设备发送待验证相关信息。
可选的，所述私钥签名信息包括采用所述终端的私钥对时间戳的第一签名信息，或者，采用所述终端的私钥对所述第一网络侧设备响应于访问请求发送的随机数的第二签名信息。
可选的，在所述私钥签名信息包括第一签名信息的情况下，所述待验证相关信息还包括所述时间戳。
可选的，所述预设信息还包括第一信息的有效期信息；所述第一信息包括所述终端的属性信息、所述第一终端标识信息以及所述第二终端标识信息中的至少一项。
可选的，与所述终端相关的至少一个认证信息在区块链账本中存储为采用第一密钥加密的加密信息；所述待验证相关信息还包括使用所述第一网络侧设备的公钥加密的所述第一密钥；
其中，所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
可选的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，
第二信息的有效期信息；
其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；
所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
可选的，所述处理器还用于：
在向第一网络侧设备发送对应于访问请求的待验证相关信息之前，通过所述收发机向第一区块链节点发送所述终端的待认证信息；
其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息。
本公开实施例还提供了一种区块链节点，所述区块链节点为第一区块链节点，包括：处理器和收发机；
所述处理器，用于通过所述收发机接收终端发送的待认证信息；
对所述待认证信息进行认证；
在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中；
其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息；
所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
可选的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，
第二信息的有效期信息；
其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；
所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
可选的，所述在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中，包括：
随机生成用于加密的第一密钥；
使用所述第一密钥对所述至少一个认证信息进行加密后存储在区块链账 本中。
可选的，所述处理器还用于：
在随机生成用于加密的第一密钥之后，使用所述终端的公钥对所述第一密钥加密后存储在区块链账本中。
可选的，所述对所述待认证信息进行认证，包括：
根据第一预设策略，将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证；
接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息；
根据第二预设策略、所述第一认证结果以及第三签名信息，得到所述用户凭证信息是否认证通过的第一最终结果。
可选的，所述对所述待认证信息进行认证，包括：
根据第一预设策略，将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证；
接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息；
根据第三预设策略、所述第二认证结果以及第四签名信息，得到所述属性信息是否认证通过的第二最终结果。
可选的，所述对所述待认证信息进行认证，包括：
将所述待认证信息发送给第二区块链节点；
接收所述第二区块链节点反馈的与所述待认证信息中的用户凭证信息对应的第一认证结果以及对应的第三签名信息；并根据第二预设策略、所述第一认证结果以及第三签名信息，得到所述用户凭证信息是否认证通过的第一最终结果；和/或，
接收所述第二区块链节点反馈的与所述待认证信息中的属性信息对应的第二认证结果以及对应的第四签名信息；并根据第三预设策略、所述第二认证结果以及第四签名信息，得到所述属性信息是否认证通过的第二最终结果。
本公开实施例还提供了一种区块链节点，所述区块链节点为第二区块链节点，包括：处理器和收发机；
所述处理器，用于通过所述收发机接收第一区块链节点发送的终端的待认证信息；
通过所述收发机将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证，并接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息，反馈给所述第一区块链节点；和/或，
通过所述收发机将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证，并接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息，反馈给所述第一区块链节点；
其中，所述用户凭证信息包括终端标识信息。
本公开实施例还提供了一种网络侧设备，所述网络侧设备为第二网络侧设备，包括：处理器和收发机；
所述处理器，用于通过所述收发机接收区块链节点发送的待认证的终端的用户凭证信息；
对所述用户凭证信息进行认证，得到第一认证结果，并使用第三签名信息进行签名；
通过所述收发机将所述第一认证结果以及第三签名信息反馈给所述区块链节点；
其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点；
所述用户凭证信息包括终端标识信息。
本公开实施例还提供了一种网络侧设备，所述网络侧设备为第三网络侧设备，包括：处理器和收发机；
所述处理器，用于通过所述收发机接收区块链节点发送的待认证的终端的属性信息；
对所述属性信息进行认证，得到第二认证结果，并使用第四签名信息进行签名；
通过所述收发机将所述第二认证结果以及第四签名信息反馈给所述区块链节点；
其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信 的第二区块链节点。
本公开实施例还提供了一种网络侧设备，包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序；所述处理器执行所述程序时实现上述第一网络侧设备侧的接入控制方法；或者，所述处理器执行所述程序时实现上述第二网络侧设备侧的接入控制方法；或者，所述处理器执行所述程序时实现上述第三网络侧设备侧的接入控制方法。
本公开实施例还提供了一种终端，包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序；所述处理器执行所述程序时实现上述终端侧的接入控制方法。
本公开实施例还提供了一种区块链节点，包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序；所述处理器执行所述程序时实现上述第一区块链节点侧的接入控制方法；或者，所述处理器执行所述程序时实现上述第二区块链节点侧的接入控制方法。
本公开实施例还提供了一种可读存储介质，其上存储有程序，该程序被处理器执行时实现上述第一网络侧设备侧的接入控制方法中的步骤；或者，该程序被处理器执行时实现上述终端侧的接入控制方法中的步骤；或者，该程序被处理器执行时实现上述第一区块链节点侧的接入控制方法中的步骤；或者，该程序被处理器执行时实现上述第二区块链节点侧的接入控制方法中的步骤；或者，该程序被处理器执行时实现上述第二网络侧设备侧的接入控制方法中的步骤；或者，该程序被处理器执行时实现上述第三网络侧设备侧的接入控制方法中的步骤。
本公开的上述技术方案的有益效果如下：
上述方案中，所述接入控制方法通过接收终端发送的对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；根据所述位置信息，从区块链中获取所述预设信息；根据所述私钥签名信息以及所述预设信息，对所述终端进行验证；在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息；根据所述属性信息，向所述终端反馈针对接入控制的请求响应；其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的 公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
附图说明
为了更清楚地说明本公开实施例的技术方案，下面将对本公开实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本公开的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本公开实施例的接入控制方法流程示意图一；
图2为本公开实施例的接入控制方法流程示意图二；
图3为本公开实施例的接入控制方法流程示意图三；
图4为本公开实施例的接入控制方法流程示意图四；
图5为本公开实施例的接入控制方法流程示意图五；
图6为本公开实施例的接入控制方法流程示意图六；
图7为本公开实施例的接入控制方法实现架构示意图；
图8a为本公开实施例的接入控制方法具体实现流程示意图一；
图8b为本公开实施例的接入控制方法具体实现流程示意图二；
图9为本公开实施例的待认证信息认证架构示意图一；
图10为本公开实施例的待认证信息认证架构示意图二；
图11为本公开实施例的接入控制装置结构示意图一；
图12为本公开实施例的接入控制装置结构示意图二；
图13为本公开实施例的接入控制装置结构示意图三；
图14为本公开实施例的接入控制装置结构示意图四；
图15为本公开实施例的接入控制装置结构示意图五；
图16为本公开实施例的接入控制装置结构示意图六；
图17为本公开实施例的网络侧设备结构示意图一；
图18为本公开实施例的终端结构示意图；
图19为本公开实施例的区块链节点结构示意图一；
图20为本公开实施例的区块链节点结构示意图二；
图21为本公开实施例的网络侧设备结构示意图二；
图22为本公开实施例的网络侧设备结构示意图三。
具体实施方式
为使本公开要解决的技术问题、技术方案和优点更加清楚，下面将结合附图及具体实施例进行详细描述。
本公开针对相关的技术中存在传统认证服务器遭受DDoS攻击导致单点失败的问题，提供一种接入控制方法，应用于第一网络侧设备，如图1所示，包括：
步骤11：接收终端发送的对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
步骤12：根据所述位置信息，从区块链中获取所述预设信息；
步骤13：根据所述私钥签名信息以及所述预设信息，对所述终端进行验证；
步骤14：在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息；
步骤15：根据所述属性信息，向所述终端反馈针对接入控制的请求响应；其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
具体的，步骤15可以为根据所述属性信息以及终端标识信息，向所述终端反馈针对接入控制的请求响应；所述终端标识信息可以为上述的第一终端标识信息、第二终端标识信息或第三终端标识信息。
本公开实施例提供的所述接入控制方法通过接收终端发送的对应于访问 请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；根据所述位置信息，从区块链中获取所述预设信息；根据所述私钥签名信息以及所述预设信息，对所述终端进行验证；在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息；根据所述属性信息，向所述终端反馈针对接入控制的请求响应；其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
其中，所述接收终端发送的对应于访问请求的待验证相关信息，包括：接收所述终端发送的访问请求，所述访问请求中携带有待验证相关信息；或者，接收所述终端发送的访问请求；根据所述访问请求，向所述终端反馈随机数；接收所述终端根据所述随机数发送的待验证相关信息。
本公开实施例中，在所述预设信息包括所述终端的公钥信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：利用所述公钥信息对所述私钥签名信息进行验证；所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：在验证通过的情况下，根据所述公钥信息，从区块链账本中获取对应的第三终端标识信息；在获取到所述第三终端标识信息的情况下，从区块链账本中获取所述第三终端标识信息对应的属性信息作为所述终端的属性信息。
其中，所述根据所述属性信息，向所述终端反馈针对接入控制的请求响应，可以包括：根据所述第三终端标识信息以及属性信息，向所述终端反馈针对接入控制的请求响应。
本公开实施例中，在所述预设信息包括所述第一终端标识信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：根据所述第一终端标识信息，得到待验证的公钥信息以及从区块链账本中获取已存储的所述终端的公钥信息；根据所述终端的公钥信息，对所述待验证 的公钥信息以及所述私钥签名信息进行验证；所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：在验证通过的情况下，根据所述第一终端标识信息，从区块链账本中获取所述终端的属性信息。
其中，所述根据所述属性信息，向所述终端反馈针对接入控制的请求响应，包括：根据所述第一终端标识信息以及属性信息，向所述终端反馈针对接入控制的请求响应。
本公开实施例中，在所述预设信息包括所述第二终端标识信息以及公钥信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：利用所述预设信息中的公钥信息对所述私钥签名信息进行验证；并根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥信息；根据获取的所述终端的公钥信息，对所述预设信息中的公钥信息进行验证；或者，利用所述预设信息中的公钥信息对所述私钥签名信息进行验证；并根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥的散列值；根据所述预设信息中的公钥信息，得到待验证的散列值；根据获取的所述终端的公钥的散列值，对所述待验证的散列值进行验证。
其中，在所述预设信息包括所述第二终端标识信息以及公钥的散列值的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥信息；根据所述预设信息中的公钥的散列值，得到待验证的公钥信息；根据所述待验证的公钥信息，对所述私钥签名信息进行验证；并根据获取的所述终端的公钥信息，对所述待验证的公钥信息进行验证。
本公开实施例中，所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：在验证通过的情况下，根据所述第二终端标识信息，从区块链账本中获取所述终端的属性信息。
其中，所述根据所述属性信息，向所述终端反馈针对接入控制的请求响应，包括：根据所述第二终端标识信息以及属性信息，向所述终端反馈针对接入控制的请求响应。
本公开实施例中，所述私钥签名信息包括采用所述终端的私钥对时间戳的第一签名信息，或者，采用所述终端的私钥对所述第一网络侧设备响应于访问请求发送的随机数的第二签名信息。
其中，在所述私钥签名信息包括第一签名信息的情况下，所述待验证相关信息还包括所述时间戳；所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：确认所述时间戳是否处于有效期内；在所述时间戳处于有效期内的情况下，根据所述私钥签名信息以及所述预设信息，对所述终端进行验证。
具体可根据时间戳自身确认确定时间戳是否处于有效期内，但并不以此为限。
本公开实施例中，所述预设信息还包括第一信息的有效期信息；所述第一信息包括所述属性信息、所述第一终端标识信息以及所述第二终端标识信息中的至少一项；所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：根据所述有效期信息，确认所述第一信息是否处于有效期内；在所述第一信息处于有效期内的情况下，根据所述私钥签名信息以及所述预设信息中除所述有效期信息外的其他信息，对所述终端进行验证。
关于“根据所述有效期信息，确认所述第一信息是否处于有效期内”具体可以为：首先根据区块链账本上存储的有效期信息(第二信息的有效期信息)，核对预设信息中的有效期信息；在核对通过的情况下，根据所述有效期信息，确认所述第一信息是否处于有效期内。
其中，与所述终端相关的至少一个认证信息在所述区块链账本中存储为采用第一密钥加密的加密信息；所述待验证相关信息还包括使用所述第一网络侧设备的公钥加密的所述第一密钥；在根据所述属性信息，向所述终端反馈针对接入控制的请求响应之前，还包括：使用所述第一网络侧设备的私钥对所述公钥加密的所述第一密钥进行解密，得到所述第一密钥；根据所述第一密钥，针对从所述区块链账本中获取的所述加密信息进行解密，得到所述至少一个认证信息；其中，所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及， 所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
进一步的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，第二信息的有效期信息；其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
本公开实施例还提供了一种接入控制方法，应用于终端，如图2所示，包括：
步骤21：向第一网络侧设备发送对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
步骤22：接收所述第一网络侧设备反馈的针对接入控制的请求响应；其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
本公开实施例提供的所述接入控制方法通过向第一网络侧设备发送对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；接收所述第一网络侧设备反馈的针对接入控制的请求响应；其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
其中，所述向第一网络侧设备发送对应于访问请求的待验证相关信息，包括：向第一网络侧设备发送访问请求，所述访问请求中携带有待验证相关信息；或者，向第一网络侧设备发送访问请求；接收所述第一网络侧设备根据所述访问请求反馈的随机数；根据所述随机数，向所述第一网络侧设备发送待验证相关信息。
本公开实施例中，所述私钥签名信息包括采用所述终端的私钥对时间戳的第一签名信息，或者，采用所述终端的私钥对所述第一网络侧设备响应于访问请求发送的随机数的第二签名信息。
其中，在所述私钥签名信息包括第一签名信息的情况下，所述待验证相关信息还包括所述时间戳。
本公开实施例中，所述预设信息还包括第一信息的有效期信息；所述第一信息包括所述终端的属性信息、所述第一终端标识信息以及所述第二终端标识信息中的至少一项。
其中，与所述终端相关的至少一个认证信息在区块链账本中存储为采用第一密钥加密的加密信息；所述待验证相关信息还包括使用所述第一网络侧设备的公钥加密的所述第一密钥；其中，所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
进一步的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，第二信息的有效期信息；其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
本公开实施例中，在向第一网络侧设备发送对应于访问请求的待验证相关信息之前，还包括：向第一区块链节点发送所述终端的待认证信息；其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息。
本公开实施例还提供了一种接入控制方法，应用于第一区块链节点，如图3所示，包括：
步骤31：接收终端发送的待认证信息；
步骤32：对所述待认证信息进行认证；
步骤33：在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中；其中，所述待认证信息包括用户凭证信息和/或 属性信息；所述用户凭证信息包括终端标识信息；所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
步骤32具体可以为：利用共识机制，对所述待认证信息进行认证。
本公开实施例提供的所述接入控制方法通过接收终端发送的待认证信息；对所述待认证信息进行认证；在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中；其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息；所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
进一步的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，第二信息的有效期信息；其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
其中，所述在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中，包括：随机生成用于加密的第一密钥；使用所述第一密钥对所述至少一个认证信息进行加密后存储在区块链账本中。
进一步的，在随机生成用于加密的第一密钥之后，还包括：使用所述终端的公钥对所述第一密钥加密后存储在区块链账本中。
针对采用多平台认证的情况：本公开实施例中，所述对所述待认证信息进行认证，包括：根据第一预设策略，将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证；接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息；根据第二预设策略、所述 第一认证结果以及第三签名信息，得到所述用户凭证信息是否认证通过的第一最终结果；和/或，
所述对所述待认证信息进行认证，包括：根据第一预设策略，将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证；接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息；根据第三预设策略、所述第二认证结果以及第四签名信息，得到所述属性信息是否认证通过的第二最终结果。
其中，第一预设策略、第三预设策略和/或第三预设策略为预置的策略或在智能合约中约定的策略。
针对通过中间节点以采用多平台认证的情况：本公开实施例中，所述对所述待认证信息进行认证，包括：将所述待认证信息发送给第二区块链节点；接收所述第二区块链节点反馈的与所述待认证信息中的用户凭证信息对应的第一认证结果以及对应的第三签名信息；并根据第二预设策略、所述第一认证结果以及第三签名信息，得到所述用户凭证信息是否认证通过的第一最终结果；和/或，接收所述第二区块链节点反馈的与所述待认证信息中的属性信息对应的第二认证结果以及对应的第四签名信息；并根据第三预设策略、所述第二认证结果以及第四签名信息，得到所述属性信息是否认证通过的第二最终结果。
其中，第三预设策略和/或第三预设策略为预置的策略或在智能合约中约定的策略。
本公开实施例还提供了一种接入控制方法，应用于第二区块链节点，如图4所示，包括：
步骤41：接收第一区块链节点发送的终端的待认证信息；
步骤42：将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证，并接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息，反馈给所述第一区块链节点；和/或，将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证，并接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息，反馈给所述第一区块链节点；其中，所述用户凭证信息包括终端标识信息。
本公开实施例提供的所述接入控制方法通过接收第一区块链节点发送的终端的待认证信息；将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证，并接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息，反馈给所述第一区块链节点；和/或，将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证，并接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息，反馈给所述第一区块链节点；其中，所述用户凭证信息包括终端标识信息；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
本公开实施例还提供了一种接入控制方法，应用于第二网络侧设备，如图5所示，包括：
步骤51：接收区块链节点发送的待认证的终端的用户凭证信息；
步骤52：对所述用户凭证信息进行认证，得到第一认证结果，并使用第三签名信息进行签名；
步骤53：将所述第一认证结果以及第三签名信息反馈给所述区块链节点；其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点；所述用户凭证信息包括终端标识信息。
本公开实施例提供的所述接入控制方法通过接收区块链节点发送的待认证的终端的用户凭证信息；对所述用户凭证信息进行认证，得到第一认证结果，并使用第三签名信息进行签名；将所述第一认证结果以及第三签名信息反馈给所述区块链节点；其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点；所述用户凭证信息包括终端标识信息；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
本公开实施例还提供了一种接入控制方法，应用于第三网络侧设备，如图6所示，包括：
步骤61：接收区块链节点发送的待认证的终端的属性信息；
步骤62：对所述属性信息进行认证，得到第二认证结果，并使用第四签名信息进行签名；
步骤63：将所述第二认证结果以及第四签名信息反馈给所述区块链节点；其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点。
本公开实施例提供的所述接入控制方法通过接收区块链节点发送的待认证的终端的属性信息；对所述属性信息进行认证，得到第二认证结果，并使用第四签名信息进行签名；将所述第二认证结果以及第四签名信息反馈给所述区块链节点；其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
下面结合第一网络侧设备、第二网络侧设备、第三网络侧设备、终端、第一区块链节点以及第二区块链节点等多侧对本公开实施例提供的所述接入控制方法进行进一步说明。
针对上述技术问题，本公开实施例提供了一种接入控制方法，具体可实现为采用区块链实现接入控制的方法，涉及以区块链的方式向客户提供认证和验证服务，从而可以避免传统认证服务器遭受DDoS攻击导致的单点失败问题。
本公开实施例提供的接入控制方法的实现架构具体可如图7所示，其中涉及：用户(对应于上述终端)、区块链***(对应于上述区块链，包含第一区块链节点以及第二区块链节点)以及应用(对应于上述第一网络侧设备)；具体的区块链***中的区块链网络节点由多个认证节点组成，其中认证节点主要负责对用户身份(对应于上述用户凭证信息)进行认证，并对用户的属性(对应于上述属性信息)进行认证，并将认证后的结果记录到区块链账本中；用户在访问业务***(对应于上述第一网络侧设备)时，业务***在区块链查询用户身份及属性信息。用户(客户端)和业务***(具体为该***中的应用(服务器))都拥有自己的公钥和私钥。
本方案中，用户(客户端)首先向区块链***提交认证请求(对应于上 述待认证信息)，其中包括身份认证信息(对应于上述用户凭证信息)和属性信息，区块链***中的认证节点分别对身份认证信息和属性信息进行认证，并将经过认证和共识的信息记录到区块链账本，主要流程如下：
操作1.用户(客户端)向区块链***提交身份认证信息和/或属性信息；
操作2.区块链节点(即上述第一区块链节点)对上述信息(身份认证信息和/或属性信息)进行认证(具体可为认证这些信息的正确性)；
操作3.上述信息经区块链节点认证和共识之后，区块链节点将用户ID(对应于上述用户凭证信息，具体可对应于上述第一终端标识信息、第二终端标识信息或第三终端标识信息)和/或用户公钥散列值和/或用户公钥、用户属性信息(即上述终端的属性信息)、有效期(即上述有效期信息)等记录到区块链账本中；
可选地，为防止信息泄露，可以对数据进行加密存储。例如：记需要记录的数据明文为info，记录到区块链账本中的密文为：
(Epk_C(K),Ek(info))，其中pk_C为用户的公钥。其中，E表示加密、E的下标表示所使用的密钥、括号内表示数据；K为区块链节点随机生成的第一密钥。
操作4.用户向应用服务器(对应于上述第一网络侧设备)发起访问请求：
a)方式一(时间戳签名)：其中包括时间戳，用户私钥对时间戳的签名(即上述第一签名信息)，用户ID和/或用户公钥散列值和/或用户公钥、用户属性信息、有效期等信息在区块链中的位置(即上述位置信息)，如果操作3未记录用户公钥(而是记录了散列值)，则本操作中还需携带用户公钥。
b)方式二(随机数签名)：请求不携带用户信息，应用服务器返回随机数，用户对使用私钥对随机数签名(即上述第二签名信息)，并将签名以及用户ID和/或用户公钥散列值和/或用户公钥、用户属性信息、有效期等信息在区块链中的位置发送给应用服务器，如果操作3未记录用户公钥，则本操作中还需携带用户公钥。
此外，如果对数据进行了加密存储，上述两种方式中，访问请求还应包含解密密钥(即上述使用所述第一网络侧设备的公钥加密的所述第一密钥)：
(Epk_S(K))，其中pk_S为应用服务器的公钥。
操作5.应用服务器在区块链账本中查询相关信息，对用户(客户端)进行验证：
a)方式一(时间戳签名)：使用用户公钥验证对时间戳的签名是否正确，时间戳是否在有效期内，验证用户公钥或散列值是否与账本中记录的一致(或匹配)。若验证成功，则说明该用户即账本中的用户，账本中记录的属性信息即该用户的属性，应用服务器可以进一步利用该属性和用户ID进行访问授权(控制接入)。
b)方式二(随机数签名)：使用用户公钥验证对随机数的签名是否正确，验证用户公钥或散列值是否与账本中记录的一致(或匹配)。若验证成功，则说明该用户即账本中的用户，账本中记录的属性信息即该用户的属性，应用服务器可以进一步利用该属性和用户ID进行访问授权。
此外，如果对数据进行了加密存储，上述两种方式中，应用服务器还应使用服务器私钥解密得出K，进一步对账本中的密文进行解密：
DK(Ek(info))，得出info，即用户信息(用户ID)及属性信息，其中D表示解密。
具体的，一些实施例中，本公开实施例提供的所述接入控制方法可如图8a所示(第一网络侧设备以应用服务器(网关)为例)，包括：
步骤81：用户(客户端)向区块链节点(即上述第一区块链节点)发送认证请求(对应于上述待认证信息)；
步骤82：区块链节点执行认证操作；
步骤83：认证通过，记录到区块链账本(用户ID和/或公钥，属性信息)；
步骤84：区块链节点向用户(客户端)反馈认证响应；
步骤85：用户(客户端)向应用服务器(网关)发送访问请求；
步骤86：应用服务器(网关)向区块链账本查询用户认证信息及属性信息；
步骤87：应用服务器(网关)根据查询到的信息对用户(客户端)进行验证；
步骤88：应用服务器(网关)向用户(客户端)反馈请求响应。
另一些实施例中，本公开实施例的接入控制方法还可应用于软件定义边 界(Software Defined Perimeter，SDP)场景，具体实现流程可参见图8b(第一网络侧设备以SDP连接接受主机(Accepting SDP Hosts，AH)为例)，该方法包括：
步骤810：SDP连接发起主机(Initiating SDP Hosts，IH)向区块链节点(即上述第一区块链节点)发送认证请求(对应于上述待认证信息)；
步骤820：区块链节点执行认证操作；
步骤830：认证通过，记录到区块链账本(IH的ID和/或公钥，属性信息)；
步骤840：区块链节点向IH反馈认证响应；
步骤850：IH向AH发送访问请求；
步骤860：AH向区块链账本查询IH认证信息及属性信息；
步骤870：AH根据查询到的信息对IH进行验证；
步骤880：AH向IH反馈请求响应。
此外，上述操作2认证过程中，如果身份认证信息和属性信息需要由不同的节点进行认证，那么具体流程可如下：
方式一，该方式需要为认证信息(即身份认证信息)和属性信息制定认证策略(包含上述第一预设策略、第二预设策略以及第三预设策略)，策略中应包括信息转发策略(即上述第一预设策略)，如图9所示：
a)区块链节点在接收的身份认证信息和属性信息之后，根据策略，分别将认证信息和属性信息转发至相应的认证节点(对应于上述将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证，将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证)；不同的认证节点可以认证不同的认证信息或者属性信息，比如属性认证节点1认证属性1，属性认证节点2认证属性2，在此不作限定。
b)认证信息认证节点和属性认证节点分别对上述信息进行认证，对认证结果进行签名；
具体的，认证信息认证节点可以是认证服务器；例如用户提交了用户名口令认证信息，区块链节点将认证信息转发至认证信息认证节点，认证信息认证节点对用户名口令进行认证。这里认证信息认证节点1和2可以类比为 微信和支付宝，用户提交哪个口令，区块链节点就把认证信息提交给相应的认证信息认证节点。
c)认证信息认证节点和属性认证节点返回验证结果(对应于上述第一认证结果、第二认证结果)及其对结果的签名(对应于上述第三签名信息、第四签名信息)；
d)区块链节点根据接收到的认证结果以及签名，确定最终认证结果(对应于上述第一最终结果、第二最终结果)。
方式二，该方式需要使用中间节点(即上述第二区块链节点)，如图10所示：
a)区块链节点(即上述第一区块链节点)在接收的身份认证信息和属性信息之后，将认证信息和属性信息转发至中间节点；
b)中间节点将认证信息和属性信息转发至相应的认证节点(对应于上述将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证，将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证)；不同的认证节点可以认证不同的认证信息或者属性信息，比如属性认证节点1认证属性1，属性认证节点2认证属性2，在此不作限定。
c)认证信息认证节点和属性认证节点分别对上述信息进行认证，对认证结果进行签名；
具体的，认证信息认证节点可以是认证服务器；例如用户提交了用户名口令认证信息，区块链节点将认证信息转发至认证信息认证节点，认证信息认证节点对用户名口令进行认证。这里认证信息认证节点1和2可以类比为微信和支付宝，用户提交哪个口令，区块链节点就把认证信息提交给相应的认证信息认证节点。
d)认证信息认证节点和属性认证节点将认证结果(对应于上述第一认证结果、第二认证结果)及其对结果的签名(对应于上述第三签名信息、第四签名信息)发送至中间节点；
e)区块链节点从中间节点获取认证结果以及签名，确定最终认证结果(对应于上述第一最终结果、第二最终结果)。
这种方式可以可降低开销，减少信息交互。
下面对本公开实施例提供的方案进行举例说明。
举例1：统一认证(本举例中针对上述操作5提供另一实现方式)；
该举例中，区块链充当统一认证平台的角色，用户向区块链***提交认证请求，区块链节点(对应于上述第一区块链节点)对用户进行认证，并将用户信息、公钥信息及属性信息记录到区块链账本中。当用户向应用***提交访问请求时，应用***需要验证用户签名，确保用户公钥正确性，之后根据公钥在区块链中查询用户信息及属性信息，实现对用户的认证。
1.用户向区块链发起认证请求，携带待认证信息；
2.区块链***对用户提供的待认证信息进行认证，认证通过后，将用户的身份或者属性信息记录到区块链账本中；
3.用户向应用***发起访问请求，其中携带用户私钥对时间戳的签名，或者应用***向用户发送一随机数，用户使用私钥对随机数进行签名并发送给应用***。可选地，请求中还可以携带用户身份或属性信息在区块链中记录的位置。
4.访问请求中携带公钥的情况下，应用***可以直接用公钥验证用户的签名，如果签名正确，就可以使用公钥在区块链中查询用户的身份(用户ID)和属性信息。
5.应用***可以进一步利用该属性以及用户的身份进行访问授权。
举例2：双重认证(对应于上述图9和图10的认证方式)；
在某些高安全级别的应用场景，需要对用户身份实施非常严格认证措施，例如，需要有两个或多个认证机构提供的认证信息。该实施例中，用户具有两个认证平台(例如微信平台和支付宝平台)的认证信息，用户向区块链***提交认证请求，该请求中可以包括多个认证平台(例如微信平台和支付宝平台)的认证数据，区块链节点提取到用户认证数据，并将用户认证数据以图9或图10中的方式分别发送给相应的认证平台进行认证，认证平台根据用户的认证数据对用户进行认证，并将认证结果返回给区块链节点。区块链节点根据收到的认证结果，利用预置的策略或在智能合约中约定的策略对认证结果进行处理。由于认证节点可以获取到上述两个认证平台对用户的认证结果，从而可以实现对用户身份的双重认证。
由上可知，本公开实施例提供的方案，具体涉及一种基于区块链的接入控制方法：用户(客户端)向区块链***提交认证请求；区块链对认证信息和属性信息进行认证，并将经过认证和共识的信息记录到区块链账本；用户在访问业务***时，业务***在区块链查询用户身份及属性信息。
其中，具体的可以是：用户(客户端)向区块链***提交认证请求，其中包括认证信息和属性信息；区块链节点向相应的认证信息认证节点和属性信息认证节点发送认证请求；相应的认证信息认证节点和属性信息认证节点认证请求，并反馈认证结果；区块链节点处理认证结果。
综上所述，本公开实施例提供的方案能够避免单点失败问题；且使用智能合约实现认证授权，节点在被篡改的情况下不影响正常业务。
本公开实施例还提供了一种接入控制装置，应用于第一网络侧设备，如图11所示，包括：
第一接收模块111，用于接收终端发送的对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
第一获取模块112，用于根据所述位置信息，从区块链中获取所述预设信息；
第一验证模块113，用于根据所述私钥签名信息以及所述预设信息，对所述终端进行验证；
第二接收模块114，用于在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息；
第一反馈模块115，用于根据所述属性信息，向所述终端反馈针对接入控制的请求响应；
其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
本公开实施例提供的所述接入控制装置通过接收终端发送的对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签 名信息以及预设信息在区块链中的位置信息；根据所述位置信息，从区块链中获取所述预设信息；根据所述私钥签名信息以及所述预设信息，对所述终端进行验证；在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息；根据所述属性信息，向所述终端反馈针对接入控制的请求响应；其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
其中，所述接收终端发送的对应于访问请求的待验证相关信息，包括：接收所述终端发送的访问请求，所述访问请求中携带有待验证相关信息；或者，接收所述终端发送的访问请求；根据所述访问请求，向所述终端反馈随机数；接收所述终端根据所述随机数发送的待验证相关信息。
本公开实施例中，在所述预设信息包括所述终端的公钥信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：利用所述公钥信息对所述私钥签名信息进行验证；所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：在验证通过的情况下，根据所述公钥信息，从区块链账本中获取对应的第三终端标识信息；在获取到所述第三终端标识信息的情况下，从区块链账本中获取所述第三终端标识信息对应的属性信息作为所述终端的属性信息。
其中，在所述预设信息包括所述第一终端标识信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：根据所述第一终端标识信息，得到待验证的公钥信息以及从区块链账本中获取已存储的所述终端的公钥信息；根据所述终端的公钥信息，对所述待验证的公钥信息以及所述私钥签名信息进行验证；所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：在验证通过的情况下，根据所述第一终端标识信息，从区块链账本中获取所述终端的属性信息。
本公开实施例中，在所述预设信息包括所述第二终端标识信息以及公钥信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：利用所述预设信息中的公钥信息对所述私钥签名信息进行验证；并根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥信息；根据获取的所述终端的公钥信息，对所述预设信息中的公钥信息进行验证；或者，利用所述预设信息中的公钥信息对所述私钥签名信息进行验证；并根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥的散列值；根据所述预设信息中的公钥信息，得到待验证的散列值；根据获取的所述终端的公钥的散列值，对所述待验证的散列值进行验证。
其中，在所述预设信息包括所述第二终端标识信息以及公钥的散列值的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥信息；根据所述预设信息中的公钥的散列值，得到待验证的公钥信息；根据所述待验证的公钥信息，对所述私钥签名信息进行验证；并根据获取的所述终端的公钥信息，对所述待验证的公钥信息进行验证。
本公开实施例中，所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：在验证通过的情况下，根据所述第二终端标识信息，从区块链账本中获取所述终端的属性信息。
其中，所述私钥签名信息包括采用所述终端的私钥对时间戳的第一签名信息，或者，采用所述终端的私钥对所述第一网络侧设备响应于访问请求发送的随机数的第二签名信息。
本公开实施例中，在所述私钥签名信息包括第一签名信息的情况下，所述待验证相关信息还包括所述时间戳；所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：确认所述时间戳是否处于有效期内；在所述时间戳处于有效期内的情况下，根据所述私钥签名信息以及所述预设信息，对所述终端进行验证。
其中，所述预设信息还包括第一信息的有效期信息；所述第一信息包括所述属性信息、所述第一终端标识信息以及所述第二终端标识信息中的至少 一项；所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：根据所述有效期信息，确认所述第一信息是否处于有效期内；在所述第一信息处于有效期内的情况下，根据所述私钥签名信息以及所述预设信息中除所述有效期信息外的其他信息，对所述终端进行验证。
本公开实施例中，与所述终端相关的至少一个认证信息在所述区块链账本中存储为采用第一密钥加密的加密信息；所述待验证相关信息还包括使用所述第一网络侧设备的公钥加密的所述第一密钥；所述接入控制装置还包括：第一解密模块，用于在根据所述属性信息，向所述终端反馈针对接入控制的请求响应之前，使用所述第一网络侧设备的私钥对所述公钥加密的所述第一密钥进行解密，得到所述第一密钥；第二解密模块，用于根据所述第一密钥，针对从所述区块链账本中获取的所述加密信息进行解密，得到所述至少一个认证信息；其中，所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
进一步的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，第二信息的有效期信息；其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
其中，上述第一网络侧设备侧的接入控制方法的所述实现实施例均适用于该接入控制装置的实施例中，也能达到对应相同的技术效果。
本公开实施例还提供了一种接入控制装置，应用于终端，如图12所示，包括：
第一发送模块121，用于向第一网络侧设备发送对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
第三接收模块122，用于接收所述第一网络侧设备反馈的针对接入控制的请求响应；
其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公 钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
本公开实施例提供的所述接入控制装置通过向第一网络侧设备发送对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；接收所述第一网络侧设备反馈的针对接入控制的请求响应；其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
其中，所述向第一网络侧设备发送对应于访问请求的待验证相关信息，包括：向第一网络侧设备发送访问请求，所述访问请求中携带有待验证相关信息；或者，向第一网络侧设备发送访问请求；接收所述第一网络侧设备根据所述访问请求反馈的随机数；根据所述随机数，向所述第一网络侧设备发送待验证相关信息。
本公开实施例中，所述私钥签名信息包括采用所述终端的私钥对时间戳的第一签名信息，或者，采用所述终端的私钥对所述第一网络侧设备响应于访问请求发送的随机数的第二签名信息。
其中，在所述私钥签名信息包括第一签名信息的情况下，所述待验证相关信息还包括所述时间戳。
进一步的，所述预设信息还包括第一信息的有效期信息；所述第一信息包括所述终端的属性信息、所述第一终端标识信息以及所述第二终端标识信息中的至少一项。
其中，与所述终端相关的至少一个认证信息在区块链账本中存储为采用第一密钥加密的加密信息；所述待验证相关信息还包括使用所述第一网络侧设备的公钥加密的所述第一密钥；其中，所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终 端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
进一步的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，第二信息的有效期信息；其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
进一步的，所述的接入控制装置，还包括：第二发送模块，用于在向第一网络侧设备发送对应于访问请求的待验证相关信息之前，向第一区块链节点发送所述终端的待认证信息；其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息。
其中，上述终端侧的接入控制方法的所述实现实施例均适用于该接入控制装置的实施例中，也能达到对应相同的技术效果。
本公开实施例还提供了一种接入控制装置，应用于第一区块链节点，如图13所示，包括：
第四接收模块131，用于接收终端发送的待认证信息；
第一认证模块132，用于对所述待认证信息进行认证；
第一存储模块133，用于在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中；
其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息；
所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
本公开实施例提供的所述接入控制装置通过接收终端发送的待认证信息；对所述待认证信息进行认证；在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中；其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息；所述至少 一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
进一步的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，第二信息的有效期信息；其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
其中，所述在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中，包括：随机生成用于加密的第一密钥；使用所述第一密钥对所述至少一个认证信息进行加密后存储在区块链账本中。
进一步的，所述的接入控制装置，还包括：第一处理模块，用于在随机生成用于加密的第一密钥之后，使用所述终端的公钥对所述第一密钥加密后存储在区块链账本中。
其中，所述对所述待认证信息进行认证，包括：根据第一预设策略，将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证；接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息；根据第二预设策略、所述第一认证结果以及第三签名信息，得到所述用户凭证信息是否认证通过的第一最终结果。
本公开实施例中，所述对所述待认证信息进行认证，包括：根据第一预设策略，将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证；接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息；根据第三预设策略、所述第二认证结果以及第四签名信息，得到所述属性信息是否认证通过的第二最终结果。
其中，所述对所述待认证信息进行认证，包括：将所述待认证信息发送给第二区块链节点；接收所述第二区块链节点反馈的与所述待认证信息中的用户凭证信息对应的第一认证结果以及对应的第三签名信息；并根据第二预 设策略、所述第一认证结果以及第三签名信息，得到所述用户凭证信息是否认证通过的第一最终结果；和/或，接收所述第二区块链节点反馈的与所述待认证信息中的属性信息对应的第二认证结果以及对应的第四签名信息；并根据第三预设策略、所述第二认证结果以及第四签名信息，得到所述属性信息是否认证通过的第二最终结果。
其中，上述第一区块链节点侧的接入控制方法的所述实现实施例均适用于该接入控制装置的实施例中，也能达到对应相同的技术效果。
本公开实施例还提供了一种接入控制装置，应用于第二区块链节点，如图14所示，包括：
第五接收模块141，用于接收第一区块链节点发送的终端的待认证信息；
第二处理模块142，用于将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证，并接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息，反馈给所述第一区块链节点；和/或，
第三处理模块143，用于将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证，并接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息，反馈给所述第一区块链节点；
其中，所述用户凭证信息包括终端标识信息。
本公开实施例提供的所述接入控制装置通过接收第一区块链节点发送的终端的待认证信息；将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证，并接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息，反馈给所述第一区块链节点；和/或，将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证，并接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息，反馈给所述第一区块链节点；其中，所述用户凭证信息包括终端标识信息；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
其中，上述第二区块链节点侧的接入控制方法的所述实现实施例均适用 于该接入控制装置的实施例中，也能达到对应相同的技术效果。
本公开实施例还提供了一种接入控制装置，应用于第二网络侧设备，如图15所示，包括：
第六接收模块151，用于接收区块链节点发送的待认证的终端的用户凭证信息；
第四处理模块152，用于对所述用户凭证信息进行认证，得到第一认证结果，并使用第三签名信息进行签名；
第二反馈模块153，用于将所述第一认证结果以及第三签名信息反馈给所述区块链节点；
其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点；
所述用户凭证信息包括终端标识信息。
本公开实施例提供的所述接入控制装置通过接收区块链节点发送的待认证的终端的用户凭证信息；对所述用户凭证信息进行认证，得到第一认证结果，并使用第三签名信息进行签名；将所述第一认证结果以及第三签名信息反馈给所述区块链节点；其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点；所述用户凭证信息包括终端标识信息；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
其中，上述第二网络侧设备侧的接入控制方法的所述实现实施例均适用于该接入控制装置的实施例中，也能达到对应相同的技术效果。
本公开实施例还提供了一种接入控制装置，应用于第三网络侧设备，如图16所示，包括：
第七接收模块161，用于接收区块链节点发送的待认证的终端的属性信息；
第五处理模块162，用于对所述属性信息进行认证，得到第二认证结果，并使用第四签名信息进行签名；
第三反馈模块163，用于将所述第二认证结果以及第四签名信息反馈给 所述区块链节点；
其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点。
本公开实施例提供的所述接入控制装置通过接收区块链节点发送的待认证的终端的属性信息；对所述属性信息进行认证，得到第二认证结果，并使用第四签名信息进行签名；将所述第二认证结果以及第四签名信息反馈给所述区块链节点；其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
其中，上述第三网络侧设备侧的接入控制方法的所述实现实施例均适用于该接入控制装置的实施例中，也能达到对应相同的技术效果。
本公开实施例还提供了一种网络侧设备，所述网络侧设备为第一网络侧设备，如图17所示，包括：处理器171和收发机172；
所述处理器171，用于通过所述收发机172接收终端发送的对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
根据所述位置信息，从区块链中获取所述预设信息；
根据所述私钥签名信息以及所述预设信息，对所述终端进行验证；
在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息；
根据所述属性信息，通过所述收发机172向所述终端反馈针对接入控制的请求响应；
其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
本公开实施例提供的所述网络侧设备通过接收终端发送的对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名 信息以及预设信息在区块链中的位置信息；根据所述位置信息，从区块链中获取所述预设信息；根据所述私钥签名信息以及所述预设信息，对所述终端进行验证；在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息；根据所述属性信息，向所述终端反馈针对接入控制的请求响应；其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
其中，所述接收终端发送的对应于访问请求的待验证相关信息，包括：接收所述终端发送的访问请求，所述访问请求中携带有待验证相关信息；或者，接收所述终端发送的访问请求；根据所述访问请求，向所述终端反馈随机数；接收所述终端根据所述随机数发送的待验证相关信息。
本公开实施例中，在所述预设信息包括所述终端的公钥信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：利用所述公钥信息对所述私钥签名信息进行验证；所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：在验证通过的情况下，根据所述公钥信息，从区块链账本中获取对应的第三终端标识信息；在获取到所述第三终端标识信息的情况下，从区块链账本中获取所述第三终端标识信息对应的属性信息作为所述终端的属性信息。
其中，在所述预设信息包括所述第一终端标识信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：根据所述第一终端标识信息，得到待验证的公钥信息以及从区块链账本中获取已存储的所述终端的公钥信息；根据所述终端的公钥信息，对所述待验证的公钥信息以及所述私钥签名信息进行验证；所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：在验证通过的情况下，根据所述第一终端标识信息，从区块链账本中获取所述终端的属性信息。
本公开实施例中，在所述预设信息包括所述第二终端标识信息以及公钥信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：利用所述预设信息中的公钥信息对所述私钥签名信息进行验证；并根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥信息；根据获取的所述终端的公钥信息，对所述预设信息中的公钥信息进行验证；或者，利用所述预设信息中的公钥信息对所述私钥签名信息进行验证；并根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥的散列值；根据所述预设信息中的公钥信息，得到待验证的散列值；根据获取的所述终端的公钥的散列值，对所述待验证的散列值进行验证。
其中，在所述预设信息包括所述第二终端标识信息以及公钥的散列值的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥信息；根据所述预设信息中的公钥的散列值，得到待验证的公钥信息；根据所述待验证的公钥信息，对所述私钥签名信息进行验证；并根据获取的所述终端的公钥信息，对所述待验证的公钥信息进行验证。
本公开实施例中，所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：在验证通过的情况下，根据所述第二终端标识信息，从区块链账本中获取所述终端的属性信息。
其中，所述私钥签名信息包括采用所述终端的私钥对时间戳的第一签名信息，或者，采用所述终端的私钥对所述第一网络侧设备响应于访问请求发送的随机数的第二签名信息。
本公开实施例中，在所述私钥签名信息包括第一签名信息的情况下，所述待验证相关信息还包括所述时间戳；所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：确认所述时间戳是否处于有效期内；在所述时间戳处于有效期内的情况下，根据所述私钥签名信息以及所述预设信息，对所述终端进行验证。
其中，所述预设信息还包括第一信息的有效期信息；所述第一信息包括所述属性信息、所述第一终端标识信息以及所述第二终端标识信息中的至少 一项；所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：根据所述有效期信息，确认所述第一信息是否处于有效期内；在所述第一信息处于有效期内的情况下，根据所述私钥签名信息以及所述预设信息中除所述有效期信息外的其他信息，对所述终端进行验证。
本公开实施例中，与所述终端相关的至少一个认证信息在所述区块链账本中存储为采用第一密钥加密的加密信息；所述待验证相关信息还包括使用所述第一网络侧设备的公钥加密的所述第一密钥；所述处理器还用于：在根据所述属性信息，向所述终端反馈针对接入控制的请求响应之前，使用所述第一网络侧设备的私钥对所述公钥加密的所述第一密钥进行解密，得到所述第一密钥；根据所述第一密钥，针对从所述区块链账本中获取的所述加密信息进行解密，得到所述至少一个认证信息；其中，所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
进一步的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，第二信息的有效期信息；其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
其中，上述第一网络侧设备侧的接入控制方法的所述实现实施例均适用于该网络侧设备的实施例中，也能达到对应相同的技术效果。
本公开实施例还提供了一种终端，如图18所示，包括：处理器181和收发机182；
所述处理器181，用于通过所述收发机182向第一网络侧设备发送对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
通过所述收发机182接收所述第一网络侧设备反馈的针对接入控制的请求响应；
其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公 钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
本公开实施例提供的所述终端通过向第一网络侧设备发送对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；接收所述第一网络侧设备反馈的针对接入控制的请求响应；其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
本公开实施例中，所述向第一网络侧设备发送对应于访问请求的待验证相关信息，包括：向第一网络侧设备发送访问请求，所述访问请求中携带有待验证相关信息；或者，向第一网络侧设备发送访问请求；接收所述第一网络侧设备根据所述访问请求反馈的随机数；根据所述随机数，向所述第一网络侧设备发送待验证相关信息。
其中，所述私钥签名信息包括采用所述终端的私钥对时间戳的第一签名信息，或者，采用所述终端的私钥对所述第一网络侧设备响应于访问请求发送的随机数的第二签名信息。
本公开实施例中，在所述私钥签名信息包括第一签名信息的情况下，所述待验证相关信息还包括所述时间戳。
其中，所述预设信息还包括第一信息的有效期信息；所述第一信息包括所述终端的属性信息、所述第一终端标识信息以及所述第二终端标识信息中的至少一项。
本公开实施例中，与所述终端相关的至少一个认证信息在区块链账本中存储为采用第一密钥加密的加密信息；所述待验证相关信息还包括使用所述第一网络侧设备的公钥加密的所述第一密钥；其中，所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息 或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
进一步的，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，第二信息的有效期信息；其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
本公开实施例中，所述处理器还用于：在向第一网络侧设备发送对应于访问请求的待验证相关信息之前，通过所述收发机向第一区块链节点发送所述终端的待认证信息；其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息。
其中，上述终端侧的接入控制方法的所述实现实施例均适用于该终端的实施例中，也能达到对应相同的技术效果。
本公开实施例还提供了一种区块链节点，所述区块链节点为第一区块链节点，如图19所示，包括：处理器191和收发机192；
所述处理器191，用于通过所述收发机192接收终端发送的待认证信息；
对所述待认证信息进行认证；
在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中；
其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息；
所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
本公开实施例提供的所述区块链节点通过接收终端发送的待认证信息；对所述待认证信息进行认证；在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中；其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息；所述至少 一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
其中，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，第二信息的有效期信息；其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
本公开实施例中，所述在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中，包括：随机生成用于加密的第一密钥；使用所述第一密钥对所述至少一个认证信息进行加密后存储在区块链账本中。
其中，所述处理器还用于：在随机生成用于加密的第一密钥之后，使用所述终端的公钥对所述第一密钥加密后存储在区块链账本中。
本公开实施例中，所述对所述待认证信息进行认证，包括：根据第一预设策略，将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证；接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息；根据第二预设策略、所述第一认证结果以及第三签名信息，得到所述用户凭证信息是否认证通过的第一最终结果。
其中，所述对所述待认证信息进行认证，包括：根据第一预设策略，将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证；接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息；根据第三预设策略、所述第二认证结果以及第四签名信息，得到所述属性信息是否认证通过的第二最终结果。
本公开实施例中，所述对所述待认证信息进行认证，包括：将所述待认证信息发送给第二区块链节点；接收所述第二区块链节点反馈的与所述待认证信息中的用户凭证信息对应的第一认证结果以及对应的第三签名信息；并 根据第二预设策略、所述第一认证结果以及第三签名信息，得到所述用户凭证信息是否认证通过的第一最终结果；和/或，接收所述第二区块链节点反馈的与所述待认证信息中的属性信息对应的第二认证结果以及对应的第四签名信息；并根据第三预设策略、所述第二认证结果以及第四签名信息，得到所述属性信息是否认证通过的第二最终结果。
其中，上述第一区块链节点侧的接入控制方法的所述实现实施例均适用于该区块链节点的实施例中，也能达到对应相同的技术效果。
本公开实施例还提供了一种区块链节点，所述区块链节点为第二区块链节点，如图20所示，包括：处理器201和收发机202；
所述处理器201，用于通过所述收发机202接收第一区块链节点发送的终端的待认证信息；
通过所述收发机202将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证，并接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息，反馈给所述第一区块链节点；和/或，
通过所述收发机202将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证，并接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息，反馈给所述第一区块链节点；
其中，所述用户凭证信息包括终端标识信息。
本公开实施例提供的所述区块链节点通过接收第一区块链节点发送的终端的待认证信息；将所述待认证信息中的用户凭证信息发送给至少一个第二网络侧设备进行认证，并接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息，反馈给所述第一区块链节点；和/或，将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证，并接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息，反馈给所述第一区块链节点；其中，所述用户凭证信息包括终端标识信息；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
其中，上述第二区块链节点侧的接入控制方法的所述实现实施例均适用 于该区块链节点的实施例中，也能达到对应相同的技术效果。
本公开实施例还提供了一种网络侧设备，所述网络侧设备为第二网络侧设备，如图21所示，包括：处理器211和收发机212；
所述处理器211，用于通过所述收发机212接收区块链节点发送的待认证的终端的用户凭证信息；
对所述用户凭证信息进行认证，得到第一认证结果，并使用第三签名信息进行签名；
通过所述收发机212将所述第一认证结果以及第三签名信息反馈给所述区块链节点；
其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点；
所述用户凭证信息包括终端标识信息。
本公开实施例提供的所述网络侧设备通过接收区块链节点发送的待认证的终端的用户凭证信息；对所述用户凭证信息进行认证，得到第一认证结果，并使用第三签名信息进行签名；将所述第一认证结果以及第三签名信息反馈给所述区块链节点；其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点；所述用户凭证信息包括终端标识信息；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
其中，上述第二网络侧设备侧的接入控制方法的所述实现实施例均适用于该网络侧设备的实施例中，也能达到对应相同的技术效果。
本公开实施例还提供了一种网络侧设备，所述网络侧设备为第三网络侧设备，如图22所示，包括：处理器221和收发机222；
所述处理器221，用于通过所述收发机222接收区块链节点发送的待认证的终端的属性信息；
对所述属性信息进行认证，得到第二认证结果，并使用第四签名信息进行签名；
通过所述收发机222将所述第二认证结果以及第四签名信息反馈给所述 区块链节点；
其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点。
本公开实施例提供的所述网络侧设备通过接收区块链节点发送的待认证的终端的属性信息；对所述属性信息进行认证，得到第二认证结果，并使用第四签名信息进行签名；将所述第二认证结果以及第四签名信息反馈给所述区块链节点；其中，所述区块链节点为第一区块链节点或与所述第一区块链节点通信的第二区块链节点；能够支撑实现采用区块链进行接入控制的方案，而以区块链的方式向客户提供属性验证服务，可以避免类似传统认证服务器遭受DDoS攻击导致的单点失败的问题。
其中，上述第三网络侧设备侧的接入控制方法的所述实现实施例均适用于该网络侧设备的实施例中，也能达到对应相同的技术效果。
本公开实施例还提供了一种网络侧设备，包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序；所述处理器执行所述程序时实现上述第一网络侧设备侧的接入控制方法；或者，所述处理器执行所述程序时实现上述第二网络侧设备侧的接入控制方法；或者，所述处理器执行所述程序时实现上述第三网络侧设备侧的接入控制方法。
其中，上述第一网络侧设备侧、第二网络侧设备侧或第三网络侧设备侧的接入控制方法的所述实现实施例均适用于该网络侧设备的实施例中，也能达到对应相同的技术效果。
本公开实施例还提供了一种终端，包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序；所述处理器执行所述程序时实现上述终端侧的接入控制方法。
其中，上述终端侧的接入控制方法的所述实现实施例均适用于该终端的实施例中，也能达到对应相同的技术效果。
本公开实施例还提供了一种区块链节点，包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序；所述处理器执行所述程序时实现上述第一区块链节点侧的接入控制方法；或者，所述处理器执行所述程序时实现上述第二区块链节点侧的接入控制方法。
其中，上述第一区块链节点侧或第二区块链节点侧的接入控制方法的所述实现实施例均适用于该区块链节点的实施例中，也能达到对应相同的技术效果。
本公开实施例还提供了一种可读存储介质，其上存储有程序，该程序被处理器执行时实现上述第一网络侧设备侧的接入控制方法中的步骤；或者，该程序被处理器执行时实现上述终端侧的接入控制方法中的步骤；或者，该程序被处理器执行时实现上述第一区块链节点侧的接入控制方法中的步骤；或者，该程序被处理器执行时实现上述第二区块链节点侧的接入控制方法中的步骤；或者，该程序被处理器执行时实现上述第二网络侧设备侧的接入控制方法中的步骤；或者，该程序被处理器执行时实现上述第三网络侧设备侧的接入控制方法中的步骤。
其中，上述第一网络侧设备侧、终端侧、第一区块链节点侧、第二区块链节点侧、第二网络侧设备侧或第三网络侧设备侧的接入控制方法的所述实现实施例均适用于该可读存储介质的实施例中，也能达到对应相同的技术效果。
需要说明的是，此说明书中所描述的许多功能部件都被称为模块，以便更加特别地强调其实现方式的独立性。
本公开实施例中，模块可以用软件实现，以便由各种类型的处理器执行。举例来说，一个标识的可执行代码模块可以包括计算机指令的一个或多个物理或者逻辑块，举例来说，其可以被构建为对象、过程或函数。尽管如此，所标识模块的可执行代码无需物理地位于一起，而是可以包括存储在不同位里上的不同的指令，当这些指令逻辑上结合在一起时，其构成模块并且实现该模块的规定目的。
实际上，可执行代码模块可以是单条指令或者是许多条指令，并且甚至可以分布在多个不同的代码段上，分布在不同程序当中，以及跨越多个存储器设备分布。同样地，操作数据可以在模块内被识别，并且可以依照任何适当的形式实现并且被组织在任何适当类型的数据结构内。所述操作数据可以作为单个数据集被收集，或者可以分布在不同位置上(包括在不同存储设备上)，并且至少部分地可以仅作为电子信号存在于***或网络上。
在模块可以利用软件实现时，考虑到现有硬件工艺的水平，所以可以以软件实现的模块，在不考虑成本的情况下，本领域技术人员都可以搭建对应的硬件电路来实现对应的功能，所述硬件电路包括常规的超大规模集成(VLSI)电路或者门阵列以及诸如逻辑芯片、晶体管之类的现有半导体或者是其它分立的元件。模块还可以用可编程硬件设备，诸如现场可编程门阵列、可编程阵列逻辑、可编程逻辑设备等实现。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本公开的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的***、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本公开所提供的实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个***，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本公开实施例方案的目的。
另外，在本公开各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用 时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本公开的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本公开各个实施例所述的方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
可以理解的是，本公开实施例描述的这些实施例可以用硬件、软件、固件、中间件、微码或其组合来实现。对于硬件实现，模块、单元、子模块、子单元等可以实现在一个或多个专用集成电路(Application Specific Integrated Circuits，ASIC)、数字信号处理器(Digital Signal Processing，DSP)、数字信号处理设备(DSP Device，DSPD)、可编程逻辑设备(Programmable Logic Device，PLD)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)、通用处理器、控制器、微控制器、微处理器、用于执行本公开所述功能的其它电子单元或其组合中。
以上所述的是本公开的优选实施方式，应当指出对于本技术领域的普通人员来说，在不脱离本公开所述原理前提下，还可以作出若干改进和润饰，这些改进和润饰也应视为本公开的保护范围。

Claims (34)

  1. 一种接入控制方法，应用于第一网络侧设备，其中，所述方法包括：
    接收终端发送的对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
    根据所述位置信息，从区块链中获取所述预设信息；
    根据所述私钥签名信息以及所述预设信息，对所述终端进行验证；
    在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息；
    根据所述属性信息，向所述终端反馈针对接入控制的请求响应；
    其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
  2. 根据权利要求1所述的接入控制方法，其中，所述接收终端发送的对应于访问请求的待验证相关信息，包括：
    接收所述终端发送的访问请求，所述访问请求中携带有待验证相关信息；或者，
    接收所述终端发送的访问请求；
    根据所述访问请求，向所述终端反馈随机数；
    接收所述终端根据所述随机数发送的待验证相关信息。
  3. 根据权利要求1所述的接入控制方法，其中，在所述预设信息包括所述终端的公钥信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
    利用所述公钥信息对所述私钥签名信息进行验证；
    所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：
    在验证通过的情况下，根据所述公钥信息，从区块链账本中获取对应的第三终端标识信息；
    在获取到所述第三终端标识信息的情况下，从区块链账本中获取所述第三终端标识信息对应的属性信息作为所述终端的属性信息。
  4. 根据权利要求1所述的接入控制方法，其中，在所述预设信息包括所述第一终端标识信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
    根据所述第一终端标识信息，得到待验证的公钥信息以及从区块链账本中获取已存储的所述终端的公钥信息；
    根据所述终端的公钥信息，对所述待验证的公钥信息以及所述私钥签名信息进行验证；
    所述在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息，包括：
    在验证通过的情况下，根据所述第一终端标识信息，从区块链账本中获取所述终端的属性信息。
  5. 根据权利要求1所述的接入控制方法，其中，在所述预设信息包括所述第二终端标识信息以及公钥信息的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
    利用所述预设信息中的公钥信息对所述私钥签名信息进行验证；并根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥信息；根据获取的所述终端的公钥信息，对所述预设信息中的公钥信息进行验证；或者，
    利用所述预设信息中的公钥信息对所述私钥签名信息进行验证；并根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥的散列值；根据所述预设信息中的公钥信息，得到待验证的散列值；根据获取的所述终端的公钥的散列值，对所述待验证的散列值进行验证。
  6. 根据权利要求1所述的接入控制方法，其中，在所述预设信息包括所述第二终端标识信息以及公钥的散列值的情况下，所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
    根据所述第二终端标识信息，从区块链账本中获取已存储的所述终端的公钥信息；
    根据所述预设信息中的公钥的散列值，得到待验证的公钥信息；
    根据所述待验证的公钥信息，对所述私钥签名信息进行验证；并根据获取的所述终端的公钥信息，对所述待验证的公钥信息进行验证。
  7. 根据权利要求1或2所述的接入控制方法，其中，所述私钥签名信息包括采用所述终端的私钥对时间戳的第一签名信息，或者，采用所述终端的私钥对所述第一网络侧设备响应于访问请求发送的随机数的第二签名信息；
    在所述私钥签名信息包括第一签名信息的情况下，所述待验证相关信息还包括所述时间戳；
    所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
    确认所述时间戳是否处于有效期内；
    在所述时间戳处于有效期内的情况下，根据所述私钥签名信息以及所述预设信息，对所述终端进行验证。
  8. 根据权利要求1所述的接入控制方法，其中，所述预设信息还包括第一信息的有效期信息；所述第一信息包括所述属性信息、所述第一终端标识信息以及所述第二终端标识信息中的至少一项；
    所述根据所述私钥签名信息以及所述预设信息，对所述终端进行验证，包括：
    根据所述有效期信息，确认所述第一信息是否处于有效期内；
    在所述第一信息处于有效期内的情况下，根据所述私钥签名信息以及所述预设信息中除所述有效期信息外的其他信息，对所述终端进行验证。
  9. 根据权利要求1所述的接入控制方法，其中，与所述终端相关的至少一个认证信息在所述区块链账本中存储为采用第一密钥加密的加密信息；所述待验证相关信息还包括使用所述第一网络侧设备的公钥加密的所述第一密钥；
    在根据所述属性信息，向所述终端反馈针对接入控制的请求响应之前，还包括：
    使用所述第一网络侧设备的私钥对所述公钥加密的所述第一密钥进行解密，得到所述第一密钥；
    根据所述第一密钥，针对从所述区块链账本中获取的所述加密信息进行解密，得到所述至少一个认证信息；
    其中，所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
  10. 根据权利要求9所述的接入控制方法，其中，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，
    第二信息的有效期信息；
    其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；
    所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
  11. 一种接入控制方法，应用于终端，其中，所述方法包括：
    向第一网络侧设备发送对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
    接收所述第一网络侧设备反馈的针对接入控制的请求响应；
    其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
  12. 根据权利要求11所述的接入控制方法，其中，所述向第一网络侧设备发送对应于访问请求的待验证相关信息，包括：
    向第一网络侧设备发送访问请求，所述访问请求中携带有待验证相关信息；或者，
    向第一网络侧设备发送访问请求；
    接收所述第一网络侧设备根据所述访问请求反馈的随机数；
    根据所述随机数，向所述第一网络侧设备发送待验证相关信息。
  13. 根据权利要求11或12所述的接入控制方法，其中，所述私钥签名信息包括采用所述终端的私钥对时间戳的第一签名信息，或者，采用所述终端的私钥对所述第一网络侧设备响应于访问请求发送的随机数的第二签名信息；
    在所述私钥签名信息包括第一签名信息的情况下，所述待验证相关信息还包括所述时间戳。
  14. 根据权利要求11所述的接入控制方法，其中，所述预设信息还包括第一信息的有效期信息；所述第一信息包括所述终端的属性信息、所述第一终端标识信息以及所述第二终端标识信息中的至少一项。
  15. 根据权利要求11所述的接入控制方法，其中，与所述终端相关的至少一个认证信息在区块链账本中存储为采用第一密钥加密的加密信息；所述待验证相关信息还包括使用所述第一网络侧设备的公钥加密的所述第一密钥；
    其中，所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
  16. 根据权利要求15所述的接入控制方法，其中，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，
    第二信息的有效期信息；
    其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；
    所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
  17. 根据权利要求11所述的接入控制方法，其中，在向第一网络侧设备发送对应于访问请求的待验证相关信息之前，还包括：
    向第一区块链节点发送所述终端的待认证信息；
    其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息。
  18. 一种接入控制方法，应用于第一区块链节点，其中，所述方法包括：
    接收终端发送的待认证信息；
    对所述待认证信息进行认证；
    在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中；
    其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息；
    所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
  19. 根据权利要求18所述的接入控制方法，其中，所述至少一个认证信息还包括：所述终端对应的时间戳；和/或，
    第二信息的有效期信息；
    其中，所述时间戳为采用所述终端的私钥进行签名以得到第一签名信息的时间戳；
    所述第二信息包括所述属性信息、第一终端标识信息、第二终端标识信息以及第三终端标识信息中的至少一项。
  20. 根据权利要求18所述的接入控制方法，其中，所述在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中，包括：
    随机生成用于加密的第一密钥；
    使用所述第一密钥对所述至少一个认证信息进行加密后存储在区块链账本中。
  21. 根据权利要求20所述的接入控制方法，其中，在随机生成用于加密的第一密钥之后，还包括：
    使用所述终端的公钥对所述第一密钥加密后存储在区块链账本中。
  22. 根据权利要求18所述的接入控制方法，其中，所述对所述待认证信息进行认证，包括：
    根据第一预设策略，将所述待认证信息中的用户凭证信息发送给至少一 个第二网络侧设备进行认证；
    接收所述至少一个第二网络侧设备反馈的第一认证结果以及对应的第三签名信息；
    根据第二预设策略、所述第一认证结果以及第三签名信息，得到所述用户凭证信息是否认证通过的第一最终结果。
  23. 根据权利要求18所述的接入控制方法，其中，所述对所述待认证信息进行认证，包括：
    根据第一预设策略，将所述待认证信息中的属性信息发送给至少一个第三网络侧设备进行认证；
    接收所述至少一个第三网络侧设备反馈的第二认证结果以及对应的第四签名信息；
    根据第三预设策略、所述第二认证结果以及第四签名信息，得到所述属性信息是否认证通过的第二最终结果。
  24. 根据权利要求18所述的接入控制方法，其中，所述对所述待认证信息进行认证，包括：
    将所述待认证信息发送给第二区块链节点；
    接收所述第二区块链节点反馈的与所述待认证信息中的用户凭证信息对应的第一认证结果以及对应的第三签名信息；并根据第二预设策略、所述第一认证结果以及第三签名信息，得到所述用户凭证信息是否认证通过的第一最终结果；和/或，
    接收所述第二区块链节点反馈的与所述待认证信息中的属性信息对应的第二认证结果以及对应的第四签名信息；并根据第三预设策略、所述第二认证结果以及第四签名信息，得到所述属性信息是否认证通过的第二最终结果。
  25. 一种接入控制装置，应用于第一网络侧设备，其中，所述接入控制装置包括：
    第一接收模块，用于接收终端发送的对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
    第一获取模块，用于根据所述位置信息，从区块链中获取所述预设信息；
    第一验证模块，用于根据所述私钥签名信息以及所述预设信息，对所述终端进行验证；
    第二接收模块，用于在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息；
    第一反馈模块，用于根据所述属性信息，向所述终端反馈针对接入控制的请求响应；
    其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
  26. 一种接入控制装置，应用于终端，其中，所述接入控制装置包括：
    第一发送模块，用于向第一网络侧设备发送对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
    第三接收模块，用于接收所述第一网络侧设备反馈的针对接入控制的请求响应；
    其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
  27. 一种接入控制装置，应用于第一区块链节点，其中，所述接入控制装置包括：
    第四接收模块，用于接收终端发送的待认证信息；
    第一认证模块，用于对所述待认证信息进行认证；
    第一存储模块，用于在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中；
    其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息；
    所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公 钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
  28. 一种网络侧设备，所述网络侧设备为第一网络侧设备，包括：处理器和收发机；
    所述处理器，用于通过所述收发机接收终端发送的对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
    根据所述位置信息，从区块链中获取所述预设信息；
    根据所述私钥签名信息以及所述预设信息，对所述终端进行验证；
    在验证通过的情况下，根据所述预设信息，从区块链账本中获取所述终端的属性信息；
    根据所述属性信息，通过所述收发机向所述终端反馈针对接入控制的请求响应；
    其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
  29. 一种终端，包括：处理器和收发机；
    所述处理器，用于通过所述收发机向第一网络侧设备发送对应于访问请求的待验证相关信息；其中，所述待验证相关信息包括所述终端的私钥签名信息以及预设信息在区块链中的位置信息；
    通过所述收发机接收所述第一网络侧设备反馈的针对接入控制的请求响应；
    其中，所述预设信息包括所述终端的公钥信息，或者根据所述终端的公钥得到的第一终端标识信息，或者与所述终端的公钥无关的第二终端标识信息以及所述终端的公钥信息，或者所述第二终端标识信息以及所述终端的公钥的散列值。
  30. 一种区块链节点，所述区块链节点为第一区块链节点，包括：处理 器和收发机；
    所述处理器，用于通过所述收发机接收终端发送的待认证信息；
    对所述待认证信息进行认证；
    在认证通过的情况下，将与所述待认证信息对应的至少一个认证信息存储在区块链账本中；
    其中，所述待认证信息包括用户凭证信息和/或属性信息；所述用户凭证信息包括终端标识信息；
    所述至少一个认证信息包括：所述终端的属性信息、根据所述终端的公钥得到的第一终端标识信息或与所述终端的公钥无关的第二终端标识信息或与所述终端的公钥对应的第三终端标识信息，以及，所述终端的公钥信息或者所述终端的公钥的散列值中的至少一个。
  31. 一种网络侧设备，包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序；其中，所述处理器执行所述程序时实现如权利要求1至10中任一项所述的接入控制方法。
  32. 一种终端，包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序；其中，所述处理器执行所述程序时实现如权利要求11至17中任一项所述的接入控制方法。
  33. 一种区块链节点，包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序；其中，所述处理器执行所述程序时实现如权利要求18至24中任一项所述的接入控制方法。
  34. 一种可读存储介质，其上存储有程序，其中，该程序被处理器执行时实现如权利要求1至10中任一项所述的接入控制方法中的步骤；或者，
    该程序被处理器执行时实现如权利要求11至17中任一项所述的接入控制方法中的步骤；或者，
    该程序被处理器执行时实现如权利要求18至24中任一项所述的接入控制方法中的步骤。
PCT/CN2021/141520 2020-12-29 2021-12-27 接入控制方法、装置、网络侧设备、终端及区块链节点 WO2022143498A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP21914235.3A EP4274192A1 (en) 2020-12-29 2021-12-27 Access control method and apparatus, and network-side device, terminal and blockchain node
JP2023539818A JP2024501326A (ja) 2020-12-29 2021-12-27 アクセス制御方法、装置、ネットワーク側機器、端末及びブロックチェーンノード
US18/259,518 US20240064021A1 (en) 2020-12-29 2021-12-27 Access control method, apparatus, network side device, terminal and blockchain node

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011591112.0 2020-12-29
CN202011591112.0A CN114697061B (zh) 2020-12-29 2020-12-29 接入控制方法、装置、网络侧设备、终端及区块链节点

Publications (1)

Publication Number Publication Date
WO2022143498A1 true WO2022143498A1 (zh) 2022-07-07

Family

ID=82132066

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/141520 WO2022143498A1 (zh) 2020-12-29 2021-12-27 接入控制方法、装置、网络侧设备、终端及区块链节点

Country Status (5)

Country Link
US (1) US20240064021A1 (zh)
EP (1) EP4274192A1 (zh)
JP (1) JP2024501326A (zh)
CN (1) CN114697061B (zh)
WO (1) WO2022143498A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115277021A (zh) * 2022-07-29 2022-11-01 蚂蚁区块链科技(上海)有限公司 一种防范网络攻击的方法及装置
CN116032591B (zh) * 2022-12-23 2024-07-19 迈普通信技术股份有限公司 一种哑终端仿冒识别方法及***

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108702622A (zh) * 2017-11-30 2018-10-23 深圳前海达闼云端智能科技有限公司 移动网络接入认证方法、装置、存储介质及区块链节点
CN109495516A (zh) * 2019-01-07 2019-03-19 国网江苏省电力有限公司无锡供电分公司 基于区块链的电力物联网终端接入方法
WO2020141783A1 (ko) * 2018-12-31 2020-07-09 주식회사 코인플러그 블록체인 네트워크를 이용하여 사용자의 아이덴티티를 관리하는 방법 및 서버, 그리고, 블록체인 네트워크 기반의 사용자 아이덴티티를 이용하여 사용자를 인증하는 방법 및 단말
CN111601280A (zh) * 2020-05-14 2020-08-28 中国联合网络通信集团有限公司 一种接入验证方法及装置

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101919586B1 (ko) * 2017-05-10 2018-11-16 주식회사 코인플러그 블록체인 기반의 사물 인터넷 기기에 대한 비용을 결제하는 방법, 이를 이용한 서버, 서비스 제공 단말, 및 사용자 전자 지갑
WO2018214133A1 (zh) * 2017-05-25 2018-11-29 深圳前海达闼云端智能科技有限公司 基于区块链的fido认证方法、装置及***
KR102254499B1 (ko) * 2018-03-30 2021-05-21 주식회사 코인플러그 블록체인 기반의 권한 인증 방법, 단말 및 이를 이용한 서버
CN110493007B (zh) * 2019-09-06 2021-07-13 腾讯科技（深圳）有限公司 一种基于区块链的信息验证方法、装置、设备及存储介质
CN111949953B (zh) * 2020-06-23 2021-10-22 卓尔智联(武汉)研究院有限公司 基于区块链的身份认证方法、***、装置和计算机设备
CN112039872B (zh) * 2020-08-28 2022-07-05 武汉见邦融智科技有限公司 基于区块链的跨域匿名认证方法及***

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108702622A (zh) * 2017-11-30 2018-10-23 深圳前海达闼云端智能科技有限公司 移动网络接入认证方法、装置、存储介质及区块链节点
WO2020141783A1 (ko) * 2018-12-31 2020-07-09 주식회사 코인플러그 블록체인 네트워크를 이용하여 사용자의 아이덴티티를 관리하는 방법 및 서버, 그리고, 블록체인 네트워크 기반의 사용자 아이덴티티를 이용하여 사용자를 인증하는 방법 및 단말
CN109495516A (zh) * 2019-01-07 2019-03-19 国网江苏省电力有限公司无锡供电分公司 基于区块链的电力物联网终端接入方法
CN111601280A (zh) * 2020-05-14 2020-08-28 中国联合网络通信集团有限公司 一种接入验证方法及装置

Also Published As

Publication number Publication date
EP4274192A1 (en) 2023-11-08
JP2024501326A (ja) 2024-01-11
CN114697061B (zh) 2023-05-09
US20240064021A1 (en) 2024-02-22
CN114697061A (zh) 2022-07-01

Similar Documents

Publication Publication Date Title
JP6941146B2 (ja) データセキュリティサービス
CN110537346B (zh) 安全去中心化域名***
US8196186B2 (en) Security architecture for peer-to-peer storage system
US20130145447A1 (en) Cloud-based data backup and sync with secure local storage of access keys
US20100250921A1 (en) Authorizing a Login Request of a Remote Device
TW201918049A (zh) 可信遠端證明方法、裝置和系統
CN108173827B (zh) 基于区块链思维的分布式sdn控制平面安全认证方法
CN101588245A (zh) 一种身份认证的方法、***及存储设备
WO2022143498A1 (zh) 接入控制方法、装置、网络侧设备、终端及区块链节点
US11218317B1 (en) Secure enclave implementation of proxied cryptographic keys
US11418329B1 (en) Shared secret implementation of proxied cryptographic keys
CN112733129B (zh) 一种服务器带外管理的可信接入方法
US11804957B2 (en) Exporting remote cryptographic keys
JP2001186122A (ja) 認証システム及び認証方法
CN114175574A (zh) 无线安全协议
CN113557689A (zh) 用管理器设备初始化数据存储设备
WO2022143935A1 (zh) 基于区块链的sdp访问控制方法及***
JP2022534677A (ja) ブロックチェーンを使用するオンラインアプリケーションおよびウェブページの保護
Khan et al. A brief review on cloud computing authentication frameworks
JP6266170B2 (ja) ３層セキュリティおよび算出アーキテクチャ
WO2022143898A1 (zh) 基于区块链的sdp访问控制方法及装置
Tan et al. A universal decentralized authentication and authorization protocol based on blockchain
CN114039748A (zh) 身份验证方法、***、计算机设备和存储介质
TW202116038A (zh) 電子裝置之認證方法及系統
Chen et al. SSL/TLS session-aware user authentication using a gaa bootstrapped key

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21914235

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 18259518

Country of ref document: US

WWE Wipo information: entry into national phase

Ref document number: 2023539818

Country of ref document: JP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2021914235

Country of ref document: EP

Effective date: 20230731