TWI698113B - Identification method and systerm of electronic device - Google Patents

Abstract

An identification method of an electronic device is disclosed. The identification method is applied to a blockchain network which includes a plurality of node devices, wherein the node devices includes a service end, a client end and at least one verification end. The identification method of the present invention includes the following steps: the service end issues an identification service contract, such that the client end initiates an identification process by recording verification data to the identification service contract; the verification end verifies the client end via verification mechanism according to the verification data, so as to generate an identification result; the verification end records the identification result to an identification management contract.

Description

Authentication method and system of electronic device

The present invention relates to an authentication method and system for electronic devices, in particular to an authentication method and system for electronic devices involving the use of blockchain smart contracts.

With the popularity of the Internet and the continuous improvement of communication technology, many transactions can be realized through the Internet. In order to ensure the security of online transactions, a mechanism for identifying and confirming the identity of online users is required, and the use of digital certificates is one of the methods. The current digital certificate issuance process is that after a network user submits a Certificate Singing Request (CSR) to a certificate management center (Certificate Authority, CA) that is considered to be credible, the certificate management center will make a request to the user Identity verification, and the certificate will be issued after verification.

However, the action of a single certificate management center to confirm the identity of network users may still have credibility issues. Therefore, although users obtain a certificate issued by a certain certificate management center, they may not be provided by a certain service For Internet of Things (Internet of Things) devices that may not be operated by actual users, the identity verification method of the traditional certificate management center is also difficult to apply. Therefore, it is really necessary to think about a new identity verification mechanism to improve the problems mentioned in the previous disclosure.

The main purpose of the present invention is to provide an authentication method for an electronic device that uses blockchain smart contracts to implement authentication operations.

Another main objective of the present invention is to provide an authentication system for an electronic device implementing the above method.

In order to achieve the above objective, the authentication method of the electronic device of the present invention is applied to a blockchain network, where the blockchain network includes a plurality of node devices, and the plurality of node devices includes a server, a client, and at least one verification terminal. The authentication method of the present invention includes the following steps: the server issues an authentication service contract, so that the client initiates an authentication process by recording a verification data in the authentication service contract; the verifier uses a verification mechanism to respond to the client based on the verification data Perform verification to generate an authentication result; the verifier records the authentication result in an authentication management contract.

The authentication system of the electronic device of the present invention operates on a blockchain network, and the authentication system includes a server terminal and at least one verification terminal. The server is used for publishing an authentication service contract, so that the client initiates an authentication process by recording a verification data in the authentication service contract. The verification terminal is used for verifying the client terminal with a verification mechanism according to the verification data to generate a verification result, and record the verification result in a verification management contract.

In order to allow your reviewer to better understand the technical content of the present invention, preferred specific embodiments are described as follows.

Please refer to Figure 1 to Figure 2 first. FIG. 1 is a schematic diagram of the usage environment of an embodiment of the authentication system of the electronic device of the present invention; FIG. 2 is a system architecture diagram of an embodiment of the verification end of the authentication system of the electronic device of the present invention.

As shown in FIG. 1, in an embodiment of the present invention, the authentication system 1 of the electronic device of the present invention is applied to a blockchain network 100, wherein the blockchain network 100 includes a plurality of node devices. The plural node device includes a server 10, a plural verification terminal 20, and a client 90. In specific embodiments, each node device may be, for example, but not limited to, a server, a desktop computer, a smart phone, or other IoT devices with wireless communication functions. The authentication system 1 of the present invention includes a server 10 and a verification terminal 20.

In an embodiment of the present invention, the server 10 is used to issue the authentication service contract 11 and the authentication management contract 12 through blockchain transactions. The client 90 can initiate the authentication process by recording the authentication data in the authentication service contract 11. The authentication service contract 11 and the authentication management contract 12 mentioned here are both blockchain smart contracts (Smart Contract), which refers to a computer program that can drive execution instructions based on predetermined conditions and input data. Since how to deploy a smart contract that can generate a specific function on the blockchain network 100 is an existing technology, its principle and implementation method are already well-known to those with ordinary knowledge in the field, so I won't repeat it here.

In an embodiment of the present invention, the plural verification terminal 20 is used for verifying the identity of the client 90 with a verification mechanism based on the verification data recorded in the authentication service contract 11 of the client 90 to generate a Authentication result. After each verification end 20 generates an authentication result, regardless of whether the authentication result is a successful verification or a verification failure, the verification end 20 will record the obtained authentication results in the authentication management contract 12 respectively. In this embodiment, the verification data is a certificate request file (Certificate Signing Request, CSR), which includes blockchain account data, user public key, and Uniform Resource Identifier (URI) data, where the block The chain account data is the account data disclosed by the client 90 on the blockchain network 100, but the verification data of the present invention is not limited to this.

As shown in FIG. 2, in an embodiment of the present invention, the verification terminal 20 includes a sending module 21, a verification module 23, an encryption module 25 and a capture module 27. Regarding the functions performed by each module, there will be more detailed descriptions below, which will not be repeated here.

It should be noted that each of the above modules can be configured as a hardware device, software program, firmware, or a combination thereof, but can also be configured by circuit loops or other appropriate types; and each module can be configured separately , Can also be combined with the type configuration. A preferred embodiment is that each module is a software program stored in the memory (not shown), and the processing unit (not shown) executes each module to achieve the functions of the invention. In addition, this implementation mode only exemplifies a preferred embodiment of the creation, and in order to avoid redundant description, it does not describe all possible variations and combinations in detail. However, those skilled in the art should understand that not all of the above-mentioned modules or components are necessary. In order to implement this creation, other more detailed conventional modules or components may also be included. Each module or component may be omitted or modified as required, and there may not be other modules or components between any two modules.

Next, please refer to Figures 1 to 5 together. Figure 3 is a flowchart of the steps of the authentication method of the electronic device of the present invention, Figure 4 is a flowchart of the steps of a verification mechanism of the authentication method, and Figure 5 is a flowchart of the authentication method The flow chart of the steps of another verification mechanism. The steps shown in FIGS. 3 to 5 will be described below in conjunction with FIGS. 1 and 2. It should be noted here that although the above authentication system 1 is used as an example to describe the authentication method of the electronic device of the present invention, the authentication method of the present invention is not limited to the authentication system 1 with the same structure described above.

As shown in Fig. 3, step S1 is first performed: the server issues an authentication service contract and an authentication management contract, so that the client initiates an authentication process by recording a verification data in the authentication service contract.

In an embodiment of the present invention, the server 10 first issues an authentication service contract 11 on the blockchain network 100 through a blockchain transaction. After the authentication service contract 11 is issued, if any node device on the blockchain network 100 wants to be authenticated, it can provide verification data recorded in the authentication service contract 11 to initiate the authentication process. Here, the node device that provides the verification data recorded in the authentication service contract 11 is the client 90. In this embodiment, the verification data is a certificate request file, which includes blockchain account data, user public key, and uniform resource identification code, but the invention is not limited to this.

Then, step S2 is performed: the verifier verifies the client by a verification mechanism according to the verification data to generate a verification result.

In an embodiment of the present invention, any node device on the blockchain network 100 can use a verification mechanism to verify the client 90 that provides the verification data based on the verification data recorded in the verification service contract 11 to generate One certification result. Here, the node device that uses the verification mechanism to verify the client 90 is the verification terminal 20. In the specific embodiment of the present invention, the verification terminal 20 will select one of the three verification methods to perform the verification operation according to the selection of the client 90. However, the present invention is not limited to this. In other embodiments, it may be limited to a single specific The verification mechanism for verification.

Figure 4 shows the flow chart of the first verification mechanism. Under this verification mechanism, the sending module 21 of the verification terminal 20 first sends the first encrypted token to the client 90 through a blockchain transaction based on the blockchain account information provided by the client 90 (that is, step S201 is executed). ). Next, the verification module 23 of the verification terminal 20 will determine whether the second encrypted token sent back from the client terminal 90 is received (ie, step S202 is executed). If the verification terminal 20 receives the second encrypted token from the client 90, it should be possible to determine that the client 90 is indeed the owner of the blockchain account data, so the verification module 23 will generate a successful verification The authentication result (that is, step S203 is executed) to complete the operation of the authentication mechanism. Conversely, if the verification module 23 does not receive the second encrypted token from the client 90 within the preset time, the verification terminal 20 will re-verify the client 90 with the same verification mechanism (ie repeat Steps S201 and S202) are implemented. When the verifier 20 uses the same verification mechanism to verify the client 90 multiple times, for example, after the preset number of times has been reached, if the verifier 20 fails to receive the second encrypted token from the client 90, then The verification module 23 of the verification terminal 20 will generate the verification result that the verification fails (ie, perform step S205) to complete the verification mechanism.

Figure 5 shows the flow chart of the second verification mechanism. Under this verification mechanism, the encryption module 25 of the verification terminal 20 first uses the user public key, verification private key, and random number string to generate an encrypted message in an asymmetric encryption method (ie, step S206 is executed). Then, the sending module 21 of the verification terminal 20 sends the encrypted message and the verification public key to the client 90 according to the uniform resource identification code (ie, step S207 is performed), where the verification public key and verification private key are the verification terminal 20 The generated corresponding password group. After the client 90 receives the encrypted message from the verifier 20, it decrypts the encrypted message with the verification public key and the user private key from the verifier 20 to generate a verification string, where the user public key and the user private key It is the corresponding password group generated by the client 90. The capture module 27 of the verification terminal 20 then retrieves the decrypted verification string from the client 90 according to the uniform resource identification code (ie, step S208 is performed). After obtaining the verification string, the verification module 23 of the verification terminal 20 compares whether the verification string is consistent with the random number string used in encryption (that is, step S209 is executed). If there is a match, it should be determined that the client 90 is indeed the owner of the user's public key, and is also the owner of the domain name or Internet Protocol Address recorded in the uniform resource identification code Therefore, the verification module 23 will generate a successful verification result (ie, perform step S210) to complete the verification mechanism. Conversely, if the verification string comparison result does not match the random number string, the verification terminal 20 will re-verify the user terminal 90 with the same verification mechanism (ie, repeat steps S206 to S209). When the verifier 20 uses the same verification mechanism to verify the client 90 multiple times, for example, after the preset number of times has been reached, if the verifier 20 fails to retrieve a verification string that matches the random number string, then The verification module 23 of the verification terminal 20 will generate the verification result that the verification fails (ie, perform step S212) to complete the verification mechanism.

The third authentication mechanism is similar to the traditional authentication method adopted by the existing credential management center. For example, the verification result can be generated by sending a verification link to the email provided by the client 90, and then generating the verification result according to whether the verification link is clicked by the client 90 (also may include verification success or The result of the verification failed).

According to the above explanation, the second authentication mechanism mentioned in the previous disclosure has a double confirmation mechanism, including the confirmation of whether the user has the public key and the domain name or Internet protocol address, so the authentication result is highly credible degree. The authentication method of the present invention can provide the client 90 to select one of the verification mechanisms according to its own needs, and the content of the verification data to be provided by different verification mechanisms may be different. Therefore, in other embodiments, if the client 90 only wants to select A verification mechanism for verification can only provide blockchain account information, without the need for user public keys and uniform resource identification codes. In addition, it should be noted that the verification mechanism of the present invention is not limited to the methods mentioned in the previous disclosure.

As shown in Fig. 3, step S3 is performed: the verification terminal records the authentication result in the authentication management contract.

In an embodiment of the present invention, after the verification end 20 initiates verification and obtains the verification result, regardless of whether the verification result is a successful verification or a verification failure, the verification module 23 of the verification end 20 will record the obtained verification result in the verification Management contract 12. In a specific embodiment, the information recorded in the authentication management contract 12 includes authentication result information of successful or failed authentication, information of the authentication terminal that performs the authentication, and information of the authenticated client, but the invention is not limited to this. The authenticated client information can provide any node device on the blockchain network 100 to browse to know whether the client 90 has been authenticated and the number of times it has been authenticated, so that the node device that wants to access the client 90 can decide whether to contact The client 90 is connected. The record of the verifier information allows the server 10 to track the verification process and impose sanctions on the verifier 20 that is not verified.

Step S4 is executed: the server compares the number of authentication results recorded in the authentication management contract with respect to whether the number of authentication results of the client's successful verification reaches a certificate issuance standard value.

In the embodiment of the present invention, the server 10 compares whether the number of authentication results recorded in the authentication management contract 12 after the client 90 has successfully passed the authentication (ie, the authentication results for successful authentication) has reached a standard value for issuance. In other words, after different node devices have completed the verification of the client 90, they will all record the obtained authentication results in the authentication management contract 12. The more node devices (that is, the verification end) the client 90 passes the authentication, that is, It means that the reliability of the client 90 is higher.

Perform step S5: the server sends a certificate file to the client.

After step S4 is completed, when the comparison result is that the total number of authentication results successfully verified by different verification ends 20 for the client 90 has reached the certificate issuance standard value, the server 10 will send the certificate file to the client 90. For example, suppose that the verification data recorded by the client 90 is a certificate request file, and when the second verification mechanism mentioned in the previous disclosure is selected for verification, since the second verification mechanism has a higher degree of security and reliability, The standard value of certificate issuance can be set ten times, that is, as long as the client 90 has passed the verification by ten different verification terminals 20 with the second verification mechanism, the server 10 will follow the records recorded in the certification management contract 12 The certificate file is sent to the client 90 with the authentication result after ten successful verifications. For another example, suppose that the verification data recorded by the client 90 is a certificate request file, and when the first verification mechanism mentioned in the previous disclosure is selected for verification, the first verification mechanism is more secure and reliable than the second verification. The mechanism is low, so the certificate issuance standard value can be set to 20 times, that is, the server 10 will only be recorded according to the record after the client 90 has passed the verification by the first verification mechanism by 20 different verification terminals 20 The authentication results of the 20 successful verifications in the authentication management contract 12 send the certificate file to the client 90.

It should also be noted that, in other embodiments, the client 90 may simply request verification, and it is not necessary to request the certificate to be sent. That is to say, the authentication method of the present invention can also provide the client 90 to select only the verification end 20 to complete the verification and record the authentication result in the authentication management contract 12. At this time, the client 90 provides the information recorded in the authentication service contract 11. The verification data may not be a credential request file. In other words, the steps S4 and S5 mentioned in the previous disclosure can be omitted. Since the authentication result recorded in the authentication management contract 12 can be used as the basis for whether other node devices trust the client 90 device, even if there is no certificate, other node devices can also authenticate the number of authentication results of the client 90 in the authentication management contract 12 as The basis for determining whether to access the client 90.

From the foregoing disclosure, it can be known that the authentication method disclosed in the present invention uses each node device dispersed on the blockchain as an independent authentication device, that is, any node device on the blockchain can authenticate the client 90 requesting authentication. Perform identity verification. Due to the characteristics of the blockchain network that records can be traced back and the records are not easily tampered with, the prior art certificate management center can be eliminated and the effect of multiple verifications can be achieved, thereby increasing the reliability of the certification results. In addition, the authentication method of the present invention provides multiple authentication mechanisms for the client 90 to choose according to its own authentication strength requirements.

Although the present invention has disclosed the above-mentioned embodiments with examples, it is not intended to limit the present invention. Anyone with ordinary knowledge in the relevant technical field can make some changes and modifications without departing from the spirit and scope of the present invention. , Should be the scope of rights claimed in this patent, so the scope of protection of this patent shall be subject to the scope of the attached patent application.

1: Authentication system 10: Server 11: Certification service contract 12: Certification management contract 20: Verifier 21: Send module 23: Verification Module 25: Encryption module 27: Capture module 90: client 100: Blockchain network

FIG. 1 is a schematic diagram of the use environment of an embodiment of the authentication system of the electronic device of the present invention. 2 is a system architecture diagram of an embodiment of the verification terminal of the authentication system of the electronic device of the present invention. FIG. 3 is a flowchart of the steps of the authentication method of the electronic device of the present invention. Figure 4 is a flow chart showing the steps of a verification mechanism of one of the authentication methods. Figure 5 is a flowchart showing the steps of another verification mechanism of the authentication method.

1: Authentication system

10: Server

11: Certification service contract

12: Certification management contract

20: Verifier

90: client

100: Blockchain network

Claims (12)

An authentication method for an electronic device is applied to a blockchain network. The blockchain network includes a plurality of node devices. The plurality of node devices includes a server, a client and at least one verification terminal. The authentication method includes the following Steps: The server issues an authentication service contract so that the client initiates an authentication process by recording a verification data in the authentication service contract; the at least one verifier uses a verification mechanism to the user based on the verification data Verifying by the end to generate an authentication result; and the at least one verifying end records the authentication result in an authentication management contract. For example, the authentication method described in item 1 of the scope of patent application, wherein the verification data includes a blockchain account data, and the verification mechanism includes: the at least one verification terminal sends a first encrypted token to the The user end; the at least one verification end determines whether a second encrypted token is received from the user end; and if so, the at least one verification end generates the authentication result. For example, the authentication method described in item 1 of the scope of patent application, wherein the verification data includes a blockchain account data, a user public key and a uniform resource identification code, and the verification mechanism includes: the at least one verification terminal uses the user public Key, a verification private key and a random number string encryption to generate an encrypted message; The at least one verification terminal sends the encrypted message and a verification public key to the client terminal according to the uniform resource identification code, wherein the verification public key and the verification private key are the password sets generated by the verification terminal; the at least one verification The terminal retrieves a verification string to the client according to the uniform resource identification code, wherein the verification string is generated by the client after decrypting the encrypted message using the verification public key and a user private key. The key and the user private key are the cipher set generated by the client; and the at least one verifier compares whether the verification string matches the random number string; if so, the at least one verifier generates the verification result. For example, the authentication method described in item 1 of the scope of patent application, wherein the verification data is a certificate request file, the authentication method further includes the following steps: the server comparison record is recorded in the authentication management contract regarding the successful verification of the client Whether the number of authentication results reaches a certification standard value; and if so, the server sends a certificate file to the client. For example, the authentication method described in item 2 or 3 of the scope of patent application, wherein the verification data includes a certificate request file, and the authentication method further includes the following steps: the server compares the records in the authentication management contract regarding the client verification Whether the number of successful authentication results reaches a certification standard value; and if so, the server sends a certificate file to the client. Such as the authentication method described in item 1 of the scope of patent application, wherein the authentication mechanism is executed according to the selection of the client. An authentication system for an electronic device operates on a blockchain network. The blockchain network includes a plurality of node devices. The authentication system includes: a server, which is one of the node devices for publishing An authentication service contract, so that a client initiates an authentication process by recording a verification data in the authentication service contract; and at least one verification terminal is at least one of the plurality of node devices, and is used for verifying The data is verified by a verification mechanism to the client to generate an authentication result, and the authentication result is recorded in an authentication management contract. For example, the authentication system described in item 7 of the scope of patent application, wherein the verification data includes a blockchain account data, and the at least one verification terminal includes: a sending module for sending a first Encrypting tokens to the client; and a verification module for determining whether a second encrypted token from the client is received, and generating the authentication result when the second encrypted token is received To complete the verification mechanism. For example, the authentication system described in item 7 of the scope of patent application, wherein the verification data includes a blockchain account data, a user public key and a uniform resource identification code, and the at least one verification terminal includes: an encryption module for Use the user public key, a verification private key and a random number string to encrypt to generate an encrypted message; a sending module for sending the encrypted message and a verification public key to the client according to the uniform resource identification code, wherein The verification public key and the verification private key are cipher sets generated by the verification terminal; An acquisition module for extracting a verification string to the client according to the uniform resource identification code, wherein the verification string is used by the client to decrypt the encrypted message using the verification public key and a user private key Generated later, the user public key and the user private key are cipher sets generated by the client; and a verification module for comparing whether the verification string matches the random number string, and in the verification word When the string matches the random number string, the authentication result is generated to complete the verification mechanism. For example, in the authentication system described in item 7 of the scope of patent application, the authentication data is a certificate request file, and the server is used to compare whether the number of authentication results recorded in the authentication management contract about the successful authentication of the client has reached At a certification standard value, and when the number of authentication results of the client reaches the certification standard value, a certificate file is sent to the client. For example, the authentication system described in item 8 or 9 of the scope of patent application, wherein the authentication data is a certificate request file, and the server is used to compare the number of authentication results recorded in the authentication management contract regarding the successful authentication of the client Whether it reaches a certification standard value, and when the number of authentication results of the client reaches the certification standard value, send a certificate file to the client. For example, in the authentication system described in item 7 of the scope of patent application, the authentication mechanism is executed according to the selection of the client.

Images