WO2021169107A1 - 一种网络身份保护方法、装置及电子设备和存储介质 - Google Patents

一种网络身份保护方法、装置及电子设备和存储介质 Download PDF

Info

Publication number
WO2021169107A1
WO2021169107A1 PCT/CN2020/098484 CN2020098484W WO2021169107A1 WO 2021169107 A1 WO2021169107 A1 WO 2021169107A1 CN 2020098484 W CN2020098484 W CN 2020098484W WO 2021169107 A1 WO2021169107 A1 WO 2021169107A1
Authority
WO
WIPO (PCT)
Prior art keywords
transaction
login
target
website
server
Prior art date
Application number
PCT/CN2020/098484
Other languages
English (en)
French (fr)
Inventor
刘文印
麦超
冼祥斌
吴鸿文
Original Assignee
广东工业大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 广东工业大学 filed Critical 广东工业大学
Publication of WO2021169107A1 publication Critical patent/WO2021169107A1/zh
Priority to US17/888,236 priority Critical patent/US20220394026A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/08—Insurance
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/02—Payment architectures, schemes or protocols involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3821—Electronic credentials
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3825—Use of electronic signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3827—Use of message hashing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/389—Keeping log of transactions for guaranteeing non-repudiation of a transaction
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities

Definitions

  • This application relates to the field of network security technology, and more specifically, to a method and device for network identity protection, an electronic device, and a computer-readable storage medium.
  • 360 Security In the field of Internet insurance, 360 Security has launched a search compensation plan, which assumes the first compensation liability for direct property losses incurred by users due to phishing, fraud or fake official website, authorized application or website, etc., for the promotion of 360 search applications or websites.
  • Major banks have also introduced account banking, online banking, and existing fund insurance to provide users with protection against theft.
  • Tencent, Alipay, and Suning Finance have also launched account security insurance accordingly. If the security card online banking and security card mobile banking bound in their applications are stolen, they will receive compensation.
  • each user's identity insurance is limited to its own application and only protects accounts in terms of property.
  • the procedure of the claim settlement process is cumbersome, and the claim settlement certificate data is stored in the central database, and the degree of trustworthiness is low.
  • the identity information of most applications or websites that users use daily cannot be secured.
  • the purpose of this application is to provide a method and device for network identity protection, an electronic device, and a computer-readable storage medium, so as to implement insurance and automatic claim settlement for a user's network identity.
  • this application provides a network identity protection method, which is applied to a blockchain network, including:
  • the target account information After receiving the claim settlement request for the target account information, obtain all the first transaction vouchers corresponding to the target account information from the smart contract; wherein the target account information is used to log in to the target application or website, and the first transaction vouchers Used to record login information corresponding to all login requests uploaded by the server of the target application or website;
  • the server After the server allows the first login request to log in the target application or website, receiving and using the smart contract to store the first transaction credential sent by the server;
  • the blockchain node in the blockchain network is used to grant the login permission corresponding to the second login request
  • the transaction is agreed upon and stored on the chain; wherein the login permission transaction includes at least the second transaction certificate.
  • the server When the server allows the new password modification request of the target account, it returns the target account information to the password manager so that the password manager can modify the password of the target account; wherein, the target account information includes the The hidden value of the target account and the new password generated by the server;
  • a corresponding target smart contract is created for the target account information.
  • the receiving and using the smart contract to store the first transaction certificate sent by the server includes:
  • obtaining all the first transaction vouchers corresponding to the target account information from the smart contract includes:
  • the insured transaction is stored on the chain.
  • the responding to the claim settlement request by comparing all the first transaction vouchers and all the second transaction vouchers includes:
  • the client obtains a random character string and the target application or website identification from the server, generates a public key and a private key, and obtains an account used to log in to the target application or website from the password manager based on the identification information;
  • the client generates and broadcasts the second login request to the blockchain network through the password manager, so that the blockchain node corresponding to the target application or website in the blockchain network will A second login request is sent to the server for verification; wherein, the second login request includes the random character string, the identifier, the public key, the account information, and the second transaction credential;
  • the client receives the login permission transaction through the blockchain network, and uses the login token in the login permission transaction to access the server.
  • the login permission transaction further includes the login permission information identifier corresponding to the second login request;
  • the client receiving the login permission transaction through the blockchain network includes:
  • the client computer calculates the login permission information identifier corresponding to the second login request, and calls the block link port to obtain the login permission transaction corresponding to the login permission information identifier from the blockchain network.
  • the client terminal When the client terminal receives the new password modification request of the target account, determining the target application or target website corresponding to the target account;
  • the client terminal broadcasts the original account information corresponding to the target account to the blockchain network through the password manager, so that the blockchain node corresponding to the target application or target website in the blockchain network
  • the original account information is sent to the server corresponding to the target application or the target website for verification; wherein, the original account information includes the account number and old password of the target account;
  • the client receives the target account information sent by the server; the client modifies the old password of the target account in the password manager to the new password.
  • the client terminal generates and broadcasts the second login request to the blockchain network through the password manager, so that the blockchain node corresponding to the target application or website in the blockchain network will
  • the second login request sent to the server for verification includes:
  • the client generates the second login request and the one-time receiving address of the blockchain node corresponding to the target application or website through the password manager;
  • the client broadcasts the second login request to the blockchain network through the password manager, so that the blockchain node corresponding to the target application or website uses the one-time receiving address to obtain the first Second, a login request, and sending the second login request to the server for verification.
  • the generation of the second login request by the client through the password manager and the one-time receiving address of the blockchain node corresponding to the target application or website includes:
  • the client terminal generates the second login request and the transaction identifier through the password manager, and uses the transaction identifier to generate the one-time receiving address of the blockchain node corresponding to the target application or website.
  • the login permission transaction is the information after the ring signature is performed, and the signer of the ring signature is the blockchain node connected to the application or website server in the blockchain network.
  • this application provides a network identity protection device applied to a blockchain network, including:
  • the first obtaining module is used to obtain all first transaction vouchers corresponding to the target account information from the smart contract after receiving the claim settlement request for the target account information; wherein the target account information is used to log in to the target application or website ,
  • the first transaction credential is used to record login information corresponding to all login requests uploaded by the server of the target application or website;
  • the second acquiring module is used to acquire all the second transaction vouchers corresponding to the target account information from the blockchain nodes in the blockchain network; wherein, the second transaction vouchers are used to record normal authorization to log in to the The login information corresponding to the login request of the target application or website;
  • the comparison module is configured to respond to the claim settlement request by comparing all the first transaction vouchers and all the second transaction vouchers.
  • the comparison module includes:
  • the first trigger unit is used to determine that the login is abnormal when there is a first transaction voucher that does not belong to all the second transaction voucher, and trigger a claim settlement procedure;
  • the second triggering unit is used for determining the missing abnormality when there are second transaction vouchers that do not belong to all the first transaction vouchers, and triggering the claim settlement procedure.
  • an electronic device including:
  • Memory used to store computer programs
  • the processor is configured to implement the steps of the above-mentioned network identity protection method when the computer program is executed.
  • the present application provides a computer-readable storage medium having a computer program stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the foregoing network identity protection method are implemented.
  • the method for network identity protection includes: after receiving a claim settlement request for target account information, obtaining all first transaction vouchers corresponding to the target account information from the smart contract; wherein, The target account information is used to log in to the target application or website, and the first transaction credential is used to record the login information corresponding to all login requests uploaded by the server of the target application or website; The chain node obtains all the second transaction vouchers corresponding to the target account information; wherein the second transaction vouchers are used to record the login information corresponding to the login request that is normally authorized to log in to the target application or website; by comparing all the second transaction vouchers A transaction certificate and all the second transaction certificates respond to the claim settlement request.
  • the first transaction certificate is uploaded to the smart contract by the server of the application or website through its corresponding blockchain node in the blockchain network, including the login information of all login transactions that request login, It includes normal authorized login (password manager login) and attack login.
  • the second transaction certificate is obtained from the blockchain node, which is the login information of the target application or website through the blockchain network using the password manager, and the first transaction certificate in the smart contract is compared with the above-mentioned first transaction certificate. 2.
  • the transaction vouchers are compared to realize automatic claim settlement. It can be seen that the network identity protection method provided by this application fills the gaps in network identity insurance based on blockchain technology and realizes automatic claims settlement.
  • the application also discloses a network identity protection device, an electronic device and a computer-readable storage medium, which can also achieve the above technical effects.
  • Fig. 1 is an architecture diagram of a network identity protection system according to an exemplary embodiment
  • Fig. 2 is a flowchart showing a method for network identity protection according to an exemplary embodiment
  • Fig. 3 is a flowchart showing another network identity protection method according to an exemplary embodiment
  • Fig. 4 is a structural diagram of a network identity protection device according to an exemplary embodiment
  • Fig. 5 is a structural diagram of an electronic device according to an exemplary embodiment.
  • Figure 1 shows an architecture diagram of a network identity protection system provided by an embodiment of the present application. As shown in Figure 1, it includes a client, a password manager, a blockchain network, an application or a website server node, and an application Or website servers, distributed databases, insurance company nodes, supervisory nodes and smart contracts.
  • the client is mainly installed with APP, browser, browser plug-in, etc.
  • the password manager is mainly used to store and manage user application or website information, such as account information used to log in to the application or website, etc. It is also used to authorize the login requested by the client, call the blockchain system interface to generate transactions, and so on.
  • the blockchain network is a point-to-point communication network structure, which establishes a carrier for the information interaction between the password manager and the application or website server node. Different application or website server nodes are responsible for docking with application or website servers in the blockchain system, maintaining the security of the blockchain system, and uploading transaction consensus on the chain.
  • the application or website server is used to store and verify the user's network identity information and provide business services to the client.
  • the distributed database is a blockchain decentralized consensus data storage library, which is mainly used for the storage of consensus data of application or website server nodes and insurance nodes.
  • Insurance company nodes participate in data consensus on the chain and provide users with insurance services.
  • Supervisory nodes are mainly application or website server nodes, insurance company nodes authorized to manage the blockchain system, and generate insurance smart contracts. Smart contracts are one of the functional modules of the blockchain and are mainly used to implement user insurance and automatic claims settlement.
  • the embodiment of the present application discloses a method for protecting a network identity, which implements insurance and automatic claim settlement for a user's network identity.
  • a flowchart of a method for network identity protection according to an exemplary embodiment, as shown in Fig. 2, includes:
  • S101 After receiving a claim settlement request for target account information, obtain all first transaction vouchers corresponding to the target account information from the smart contract; wherein the target account information is used to log in to the target application or website, and the first The transaction certificate is used to record the login information corresponding to all login requests uploaded by the server of the target application or website;
  • the execution subject of this embodiment is a blockchain network, and the purpose is to realize automatic claims settlement for network identities.
  • the user if the user has purchased the corresponding network identity insurance for the account and found that the account is abnormal or causes losses, he can apply for compensation through the password manager.
  • the user can choose to apply for a new password for the target account and insure the new target account information. That is, this embodiment further includes: after the server allows the new password modification request of the target account, returning the target account information to the password manager, so that the password manager can modify the password of the target account;
  • the target account information includes the target account and the hidden value of the new password generated by the server.
  • the hiding method may be hashing, encryption, salting, etc., which is not limited here.
  • the process of modifying the new password is: the user enters the password manager, selects the application or website whose password is to be modified, and generates a password modification transaction (application or website account and old password encrypted by the target server node public key, user public key Signature), call the blockchain system interface to broadcast the transaction.
  • the target application or website server node receives the password modification transaction and verifies that the transaction is correct, it uses the target application or website server node's private key to decrypt the account password of the application or website.
  • the target application or website server node encrypts the account password of the account with the target application or website server public key, and then sends it to the target application or website server.
  • the target application or website server uses the private key to decrypt the application or website account password, and after verifying the correctness of the account password, the user is allowed to change it to a new password and generate the hidden value of the new password.
  • the hash value allows users to insure the account information.
  • this embodiment further includes: after receiving an insurance request for the target account information, creating a corresponding target smart contract for the target account information.
  • the target application or website server node generates a password modification transaction (the application or website account number after the user's public key is encrypted, the hidden value of the password, the smart contract address, the signature of the target application or the website server node), and broadcasts it to the blockchain system through each application Or the website server node consensus on the chain.
  • the manager calls the blockchain system interface to obtain permission to modify the password transaction, and uses the user's private key to decrypt to obtain the strong password hidden value and store it in the password manager locally or in the cloud.
  • this embodiment also includes: receiving the insurance transaction corresponding to the target account information broadcast by the password manager, and determining the insurance institution corresponding to the insurance transaction; when all the blockchains in the blockchain network After the node agrees on the insurance transaction, it stores the insurance transaction on the chain.
  • users can generate insurance transactions through the password manager, including smart contract insurance addresses, account hashes, tokens, etc., and the password manager broadcasts them to the blockchain system, which will be connected to the chain by the consensus of each application or website server node After the insurance is successful.
  • the blockchain network can include multiple insurance company nodes, that is, users can choose different insurance companies for insurance.
  • the first transaction credential in the smart contract is uploaded by the blockchain node of the application or website, that is, this embodiment also includes: when the server allows the first login request to log in to the target application or website, receiving and using all The smart contract stores the first transaction certificate sent by the server.
  • the first transaction credential is used to store the login information of all login transactions of the user's account, including normal authorized login (password manager login) and attack login.
  • the login information can be in the following forms: ⁇ E (timestamp, AppID, account Hash, unique identification of the login device, login method, etc.), HashProof1 (timestamp, AppID, account Hash, unique identification of the login device, login method, etc.) ⁇ , HashProof1 It is the first transaction certificate.
  • S102 Obtain all second transaction vouchers corresponding to the target account information from the blockchain nodes in the blockchain network; wherein, the second transaction vouchers are used to record normal authorization to log in to the target application or website. Login information corresponding to the login request;
  • the user initiates a claim application transaction (user public key, application or website account hash, login record smart contract address, public key signature, etc.) broadcast to the insurance smart contract through the password manager.
  • a claim application transaction user public key, application or website account hash, login record smart contract address, public key signature, etc.
  • Call the block link port to obtain all login permission transactions corresponding to the Hash of the application or website account under the user's public key, and extract the second transaction certificate from the transaction.
  • the second transaction credential is used to record the login information corresponding to the login request for the normal authorization to log in to the target application or website, ⁇ E (timestamp, AppID, account Hash, unique identification of the login device, login method and other information), HashProof2 (timestamp, AppID) , Account Hash, login device unique identifier, login method, etc.) ⁇ , HashProof2 is the second transaction certificate. That is, this embodiment further includes: after the server allows the second login request of the target application or website to be logged in through the blockchain network, using the blockchain node in the blockchain network to register the second login request. 2.
  • the login permission transaction corresponding to the login request is agreed upon and stored on the chain; wherein the login permission transaction includes at least the second transaction credential.
  • the process of using the password manager to log in to the target application or website through the blockchain network is: the user enters the login page of the application or website in the client.
  • the application or website server generates a random string, and returns the random string and the identification of the application or website to the client.
  • the client generates public and private keys 1CSK and 1CPK and stores them in the cache.
  • the user uses the master password and other verification to open the password manager and decrypt the account information stored locally or in the cloud.
  • Scan application or website or browser login QR code to extract login information.
  • the password manager calls the block link port to broadcast the login request transaction to the blockchain system, which can include a random string generated by the application or website, the identification of the application or website, the public key generated by the client, and the login request used to log in to the application or website.
  • the second transaction credential here may include a timestamp, an application or website identifier, an account hash, a unique identifier of the user equipment, a login method, and the like.
  • the application or website server node receives the broadcast login request transaction, uses the private key to decrypt the network identity information, and then encrypts it with the application or website server node public key and sends it to the corresponding application or website server node.
  • the application or website server decrypts to obtain the network identity information, and returns login permission information to the application or website server node after successful verification, which may include a hash value corresponding to a random string, a login token, etc.
  • the application or website server node decrypts and obtains the login permission information, it generates the login permission transaction and broadcasts it to the blockchain network, which can include the hash value corresponding to the random string, the hash value of the account, the login token and the second transaction voucher, Information such as digital signatures.
  • the blockchain network which can include the hash value corresponding to the random string, the hash value of the account, the login token and the second transaction voucher, Information such as digital signatures.
  • the client uses the hash value corresponding to the random string to obtain the consensus login permission transaction by calling the blockchain system interface, and uses 1CSK to decrypt the login token and other permitted login information.
  • the client carries the login token to re-access the application or website server. After the application or website server verifies that the login token and other information are correct, it returns to the login page after successful login.
  • S103 Respond to the claim settlement request by comparing all the first transaction vouchers and all the second transaction vouchers.
  • the first transaction vouchers are compared with the second transaction vouchers to realize automatic claim settlement.
  • the login is abnormal and the claims settlement procedure is triggered;
  • all the second transaction vouchers of the first transaction vouchers are missing, it is determined that they are missing and abnormal, and a claim settlement procedure is triggered.
  • the claim settlement is successful.
  • the claim settlement is determined to have failed.
  • the first transaction voucher and the second transaction voucher correspond to the same value, the digital signature is incorrect, and the claim information provided by the user (including target account information, etc.) ) Is incorrect, etc., and there is no specific limitation here.
  • the first transaction credential is uploaded to the smart contract by the server of the application or website through its corresponding blockchain node in the blockchain network, including the login of all login transactions that request login Information includes normal authorized login (password manager login) and attack login.
  • the second transaction voucher is obtained from the blockchain node, which is the login information of the normal authorized login target application or website, and the first transaction voucher in the smart contract is compared with the above-mentioned second transaction voucher to achieve Automatic claim settlement. It can be seen that the network identity protection method provided by the embodiments of the present application fills the gaps in network identity insurance based on blockchain technology and realizes automatic claims settlement.
  • the embodiment of the present application discloses a method for protecting network identity. Compared with the previous embodiment, this embodiment further illustrates and optimizes the technical solution. specific:
  • FIG. 3 a flowchart of another network identity protection method according to an exemplary embodiment, as shown in Fig. 3, includes:
  • S201 After the server allows the new password modification request of the target account, return the target account information to the password manager so that the password manager can modify the password of the target account; wherein the target account information includes The hidden value of the target account and the new password generated by the server;
  • S204 After the server allows the second login request of the target application or website to be logged in through the blockchain network, use the blockchain node in the blockchain network to respond to the second login request.
  • the login permission transaction is agreed upon and stored on the chain; wherein the login permission transaction includes at least the second transaction credential.
  • S206 Obtain all second transaction vouchers corresponding to the target account information from the blockchain nodes in the blockchain network; wherein, the second transaction vouchers are used to record normal authorization to log in to the target application or website. Login information corresponding to the login request;
  • S207 Respond to the claim settlement request by comparing all the first transaction vouchers and all the second transaction vouchers.
  • each account has a corresponding smart contract
  • the user insures the account information
  • the insured transaction is stored on the chain
  • the corresponding target smart contract is established for the account therein.
  • All login information of the account to log in to the target application or website are uploaded to the target smart contract.
  • all transaction vouchers in the target smart contract are used as all first transaction vouchers, compared with the second transaction vouchers corresponding to the account obtained from the blockchain node, and respond to the claims request.
  • the execution subject of this embodiment is the client.
  • the user can send a new password modification request of the target account to the client.
  • the original account information of the target account includes the account number and old password of the target account, which is used to log in to the target application or Target website.
  • the client broadcasts the original account information corresponding to the target account to the blockchain network through the password manager, so that the target application or the target website in the blockchain network corresponds to the blockchain
  • the node sends the original account information to the server corresponding to the target application or target website for verification; wherein, the original account information includes the account number and old password of the target account;
  • the password modification transaction is generated by the password manager and broadcast to the blockchain network, which contains the above-mentioned original account information.
  • the user signature can also be broadcast at the same time, which is not specifically limited here.
  • the target application or website server node After the target application or website server node receives the password modification transaction and verifies that the transaction is correct, it uses the target application or website server node's private key to decrypt the original account information, and sends it to the target application or website server.
  • S303 The client receives the target account information sent by the server;
  • S304 The client changes the old password of the target account in the password manager to the new password.
  • the target application or website server verifies the correctness of the account password, it generates a new password based on the old password, and returns the target account information to the corresponding blockchain node, including the target account number and the hidden value of the generated new password .
  • the blockchain node decrypts and obtains the target account information, generates a new password transaction that allows modification and broadcasts it to the blockchain system consensus on the chain.
  • the password manager calls the block link port to obtain permission to modify the new password transaction. After decryption, the new password is obtained and stored in the decentralized password manager or personal cloud.
  • the client obtains a random character string and an identification of the target application or website from the server, generates a public key and a private key, and obtains the target application or website from a password manager based on the identification for logging in to the target application or website Account information;
  • the execution subject of this embodiment is a client, in which a third-party application that needs to use the server resources of the application or website is installed.
  • the user enters the login page of the application or website in the client.
  • the application or website server generates a random string, and returns the random string and the identification of the application or website to the client.
  • the client generates public and private keys 1CSK and 1CPK and stores them in the cache.
  • the user uses the master password and other verification to open the password manager and decrypt the account information stored locally or in the cloud.
  • the client generates and broadcasts the second login request to the blockchain network through the password manager, so that the blockchain node corresponding to the target application or website in the blockchain network will A second login request is sent to the server for verification; wherein, the second login request includes the random character string, the identifier, the public key, the account information, and the second transaction credential;
  • the password manager calls the block link port to broadcast the second login request to the blockchain system, which can include a random string generated by the application or website, the identification of the application or website, the public key generated by the client, and it is used to log in to the application or website.
  • Account information, the second transaction certificate and the user s signature, the signature of the second transaction certificate, etc.
  • the second transaction credential here may include a timestamp, an application or website identifier, an account hash, a unique identifier of the user equipment, a login method, and the like.
  • the second login request may use application or website server node public key encryption to ensure the security of data transmission.
  • the blockchain node corresponding to the application or website server in the blockchain network looks up the transaction list to obtain the login request transaction, uses the private key of the application or website server node to decrypt the login request transaction, and sends it to the corresponding application or website server through the network.
  • the web server decrypts and verifies the received information.
  • the password manager can use the one-time concealed address technology to broadcast the login request transaction to the blockchain network.
  • the main purpose is to hide the real address of the recipient and achieve non-traceability.
  • P is the one-time receiving address of the receiver
  • Hs is the hash function
  • r is the random number generated by the transaction sender, which only the sender knows.
  • A is the recipient's public key for viewing
  • B is the recipient's public key for payment.
  • G is a point on the elliptic curve
  • P' is for the transaction acceptor to use the transaction public key R and his own private key to view the private key to generate the obfuscated address.
  • x is that the transaction acceptor uses the transaction public key R and his own private key to pay for the private key to generate a one-time-use private key.
  • the blockchain-based network identity authorization login system because different applications or website server nodes jointly maintain the same blockchain system, and interact with user information in this system.
  • obfuscating address technology is used to hide the real address of the receiver (application or website server node) and ring signature technology to hide the authenticity of the transaction initiator (application or website server node) address. That is, the login permission information is the information after the ring signature is performed, and the signer of the ring signature is the blockchain node that accesses the application or website server in the blockchain network.
  • the second login request is generated by the password manager and broadcast to the blockchain network, so that the second login request can be transferred to the blockchain node corresponding to the target application or website in the blockchain network.
  • the step of sending the login request to the server for verification may include: generating the second login request and the one-time receiving address of the blockchain node corresponding to the target application or website through the password manager; The manager broadcasts the second login request to the blockchain network, so that the blockchain node corresponding to the target application or website uses the one-time receiving address to obtain the second login request, and transfer the The second login request is sent to the server for verification.
  • the password manager obtains the two-dimensional code information and decrypts the account information stored in the password management, and then generates the second login request.
  • the receiver is the blockchain node corresponding to the application or website server.
  • Use the public key A for viewing the blockchain node and the public public key for payment B to calculate P Hs(rA)G+B as the one-time receiving address of the blockchain node for the login request transaction.
  • the step of generating the second login request and the one-time receiving address of the blockchain node corresponding to the target application or website through the password manager includes: generating the second login through the password manager Request and transaction identification, and use the transaction identification to generate the one-time receiving address of the blockchain node corresponding to the target application or website.
  • the blockchain node corresponding to the application or website server After obtaining the encrypted login token and other information, the blockchain node corresponding to the application or website server generates a second login request and performs a ring signature.
  • the set of signers of the ring signature is the blockchain node corresponding to the application or website server.
  • the blockchain nodes corresponding to other applications or web servers verify the correctness of the user signature and the ring signature in the second login request, the consensus goes on the chain.
  • the verification ring signature can only prove that the real signer is one of the blockchain nodes corresponding to each application or website server.
  • S403 The client receives the login permission transaction through the blockchain network, and uses the login token in the login permission transaction to access the server.
  • the server returns login permission information to the application or website server node after successful authentication, which may include a login permission information identifier corresponding to the second login request (for example, a hash value corresponding to a random string), a login token, and the like.
  • the login token here may include Cookie and Token used to access the server, and the blockchain node broadcasts the login permission information to the blockchain network.
  • the application or website server node decrypts and obtains the login permission information, it generates the login permission transaction and broadcasts it to the blockchain network, which can include the hash value corresponding to the random string, the hash value of the account, the login token and the second transaction voucher, Information such as digital signatures.
  • the client computer calculates the login permission information identifier corresponding to the second login request (that is, the hash value corresponding to the random string), and obtains the login permission transaction corresponding to the login permission information identifier from the blockchain network by calling the blockchain system interface , And use 1CSK to decrypt to obtain login permission information such as login token.
  • the client carries the login token to re-access the application or website server. After the application or website server verifies that the login token and other information are correct, it returns to the login page after successful login.
  • the following describes a network identity protection device provided by an embodiment of the present application.
  • the network identity protection device described below and the network identity protection method described above can be cross-referenced.
  • a structural diagram of a network identity protection device includes:
  • the first obtaining module 401 is configured to obtain all first transaction vouchers corresponding to the target account information from the smart contract after receiving a claim settlement request for target account information; wherein, the target account information is used to log in to the target application or Website, where the first transaction credential is used to record login information corresponding to all login requests uploaded by the server of the target application or website;
  • the second obtaining module 402 is configured to obtain all the second transaction vouchers corresponding to the target account information from the blockchain nodes in the blockchain network; wherein, the second transaction vouchers are used to record normal authorized logins The login information corresponding to the login request of the target application or website;
  • the comparison module 403 is configured to respond to the claim settlement request by comparing all the first transaction vouchers and all the second transaction vouchers.
  • the first transaction certificate is uploaded to the smart contract by the server of the application or website through its corresponding blockchain node in the blockchain network, including the login of all login transactions that request login Information includes normal authorized login (password manager login) and attack login.
  • the second transaction voucher is obtained from the blockchain node, which is the login information of the normal authorized login target application or website, and the first transaction voucher in the smart contract is compared with the above-mentioned second transaction voucher to achieve Automatic claim settlement. It can be seen that the network identity protection device provided by the embodiment of the present application fills the gap in network identity insurance based on blockchain technology and realizes automatic claims settlement.
  • the first storage module is configured to receive and use the smart contract to store the first transaction credential sent by the server after the server allows the first login request to log in the target application or website;
  • the second storage module is configured to use the blockchain node in the blockchain network to register the second login request of the target application or website through the blockchain network after the server allows the second login request 2.
  • the login permission transaction corresponding to the login request is agreed upon and stored on the chain; wherein the login permission transaction includes at least the second transaction credential.
  • the return module is used to return the target account information to the password manager after the server allows the new password modification request of the target account, so that the password manager can modify the password of the target account; wherein, the target The account information includes the hidden value of the target account and the new password generated by the server;
  • the creation module is used to create a corresponding target smart contract for the target account information after receiving the insurance request for the target account information.
  • the storage module specifically receives and uses the target smart contract to store the server after the server allows the login request to log in the target application or website.
  • the first obtaining module 401 is specifically a module that obtains all first transaction vouchers corresponding to the target account information from the target smart contract after receiving a claim settlement request for target account information.
  • the first determining module is configured to receive the insurance transaction corresponding to the target account information broadcast by the password manager, and determine the insurance institution corresponding to the insurance transaction;
  • the third storage module is used to store the insurance transaction on-chain after the blockchain nodes in the blockchain network agree on the insurance transaction.
  • the comparison module 403 includes:
  • the first trigger unit is used to determine that the login is abnormal when there is a first transaction voucher that does not belong to all the second transaction voucher, and trigger a claim settlement procedure;
  • the second triggering unit is used for determining the missing abnormality when there are second transaction vouchers that do not belong to all the first transaction vouchers, and triggering the claim settlement procedure.
  • the client includes:
  • the third obtaining module is used to obtain a random character string and the identification of the target application or website from the server, generate a public key and a private key, and obtain from the password manager for logging in the target based on the identification App or website account information;
  • the first broadcasting module is used to generate and broadcast the second login request to the blockchain network through the password manager, so that the blockchain node corresponding to the target application or website in the blockchain network Sending the second login request to the server for verification; wherein the second login request includes the random character string, the identifier, the public key, and the account information;
  • the first receiving module is configured to receive the login permission transaction through the blockchain network, and use the login token in the login permission transaction to access the server.
  • the login permission transaction further includes the login permission information identifier corresponding to the second login request; the first receiving module specifically calculates the second login request Corresponding login permission information identifier, call the block link port to obtain the login permission transaction module corresponding to the login permission information identifier from the blockchain network.
  • the client further includes:
  • the second determining module is configured to determine the target application or target website corresponding to the target account when a new password modification request of the target account is received;
  • the second broadcast module is used to broadcast the original account information corresponding to the target account to the blockchain network through the password manager, so that the block corresponding to the target application or the target website in the blockchain network
  • the chain node sends the original account information to the server corresponding to the target application or target website for verification; wherein, the original account information includes the account number and old password of the target account;
  • the second receiving module is configured to receive target account information sent by the server; the client terminal changes the old password of the target account in the password manager to the new password.
  • the first broadcast module includes:
  • a generating unit configured to generate the second login request and the one-time receiving address of the blockchain node corresponding to the target application or website through the password manager;
  • the broadcasting unit is configured to broadcast the second login request to the blockchain network through the password manager, so that the blockchain node corresponding to the target application or website uses the one-time receiving address to obtain the A second login request, and sending the second login request to the server for verification.
  • the generating unit specifically generates the second login request and the transaction identifier through the password manager, and uses the transaction identifier to generate the target application or The one-time receiving address unit of the blockchain node corresponding to the website.
  • the login permission transaction is information after ring signature is performed
  • the signer of the ring signature is the block connected to the application or website server in the blockchain network Chain node.
  • the present application also provides an electronic device.
  • a structural diagram of an electronic device 500 provided in an embodiment of the present application, as shown in FIG. 5, may include a processor 11 and a memory 12.
  • the electronic device 500 may further include one or more of a multimedia component 13, an input/output (I/O) interface 14, and a communication component 15.
  • I/O input/output
  • the processor 11 is used to control the overall operation of the electronic device 500 to complete all or part of the steps in the aforementioned network identity protection method.
  • the memory 12 is used to store various types of data to support operations on the electronic device 500. These data may include, for example, instructions for any application or method to operate on the electronic device 500, as well as application-related data. For example, contact data, messages sent and received, pictures, audio, video, etc.
  • the memory 12 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, SRAM for short), electrically erasable programmable read-only memory ( Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-only Memory (Read-Only Memory, ROM for short), magnetic memory, flash memory, magnetic disk or optical disk.
  • the multimedia component 13 may include a screen and an audio component.
  • the screen may be a touch screen, for example, and the audio component is used to output and/or input audio signals.
  • the audio component may include a microphone, which is used to receive external audio signals.
  • the received audio signal may be further stored in the memory 12 or sent through the communication component 15.
  • the audio component also includes at least one speaker for outputting audio signals.
  • the I/O interface 14 provides an interface between the processor 11 and other interface modules.
  • the above-mentioned other interface modules may be a keyboard, a mouse, a button, and the like. These buttons can be virtual buttons or physical buttons.
  • the communication component 15 is used for wired or wireless communication between the electronic device 500 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, or 4G, or a combination of one or more of them, so the corresponding communication component 15 may include: Wi-Fi module, Bluetooth module, NFC module.
  • the electronic device 500 may be used by one or more application specific integrated circuits (Application Specific Integrated Circuit, ASIC for short), digital signal processor (Digital Signal Processor, DSP for short), and digital signal processing equipment (Digital Signal Processor, DSP for short).
  • ASIC Application Specific Integrated Circuit
  • DSP Digital Signal Processor
  • DSP digital signal processing equipment
  • DSPD Signal Processing Device
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • controller microcontroller, microprocessor or other electronic components Implementation, used to implement the above-mentioned network identity protection method.
  • a computer-readable storage medium including program instructions, which, when executed by a processor, implement the steps of the network identity protection method described above.
  • the computer-readable storage medium may be the foregoing memory 12 including program instructions, and the foregoing program instructions may be executed by the processor 11 of the electronic device 500 to complete the foregoing network identity protection method.

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Finance (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • Physics & Mathematics (AREA)
  • Strategic Management (AREA)
  • Computer Security & Cryptography (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Technology Law (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

一种网络身份保护方法、装置及一种电子设备和计算机可读存储介质，该方法包括：当接收到目标账户信息的理赔请求后，从智能合约中获取目标账户信息对应的所有第一交易凭证；其中，目标账户信息用于登录目标应用或网站，第一交易凭证用于记录目标应用或网站的服务器上传的所有登录请求对应的登录信息；从区块链网络中的区块链节点获取目标账户信息对应的所有第二交易凭证；其中，第二交易凭证用于记录正常授权登录目标应用或网站的登录请求对应的登录信息；通过对比所有第一交易凭证和所有第二交易凭证响应理赔请求。由此可见，本申请提供的网络身份保护方法，实现了为用户网络身份进行投保与自动理赔。

Description

一种网络身份保护方法、装置及电子设备和存储介质
本申请要求于2020年2月26日提交中国专利局、申请号为202010120877.X、发明名称为“一种网络身份保护方法、装置及电子设备和存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络安全技术领域，更具体地说，涉及一种网络身份保护方法、装置及一种电子设备和一种计算机可读存储介质。
背景技术
在互联网保险领域，360安全公司推出了搜索赔付计划，对360搜索的推广应用或网站，因采取钓鱼、诈骗或假冒官网、授权应用或网站等行为导致用户发生的直接财产损失承担先行赔付责任。各大银行也推出账户银行，网银，存在资金保险，为用户提供被盗保障。腾讯，支付宝，苏宁金融也相应推出了账户安全保险，在其应用中绑定的安全卡网银以及安全卡手机银行若被盗造成损失，则获得赔付。
在上述方案中，各用户身份保险局限于本身应用而且只保障财产方面的账户，理赔过程手续繁琐，理赔凭证数据存储于中心数据库中，可信任程度低。并且用户日常使用的大部分应用或网站身份信息得不到安全保障。
因此，如何为用户网络身份进行投保与自动理赔是本领域技术人员需要解决的技术问题。
发明内容
本申请的目的在于提供一种网络身份保护方法、装置及一种电子设备和一种计算机可读存储介质，实现了为用户网络身份进行投保与自动理赔。
为实现上述目的，本申请提供了一种网络身份保护方法，应用于区块链网络，包括：
当接收到目标账户信息的理赔请求后，从智能合约中获取所述目标账 户信息对应的所有第一交易凭证；其中，所述目标账户信息用于登录目标应用或网站，所述第一交易凭证用于记录所述目标应用或网站的服务器上传的所有登录请求对应的登录信息；
从所述区块链网络中的区块链节点获取所述目标账户信息对应的所有第二交易凭证；其中，所述第二交易凭证用于记录正常授权登录所述目标应用或网站的登录请求对应的登录信息；
通过对比所有所述第一交易凭证和所有所述第二交易凭证响应所述理赔请求。
其中，还包括：
当所述服务器允许登录所述目标应用或网站的第一登录请求后，接收并利用所述智能合约存储所述服务器发送的所述第一交易凭证；
当所述服务器允许通过所述区块链网络登录所述目标应用或网站的第二登录请求后，利用所述区块链网络中的区块链节点对所述第二登录请求对应的登录许可交易进行共识并上链存储；其中登录许可交易至少包括所述第二交易凭证。
其中，还包括：
当所述服务器允许目标账户的新密码修改请求后，向密码管理器返回所述目标账户信息，以便所述密码管理器对所述目标账户进行密码修改；其中，所述目标账户信息包括所述目标账户和所述服务器生成的新密码的隐藏值；
当接收到对所述目标账户信息的投保请求后，为所述目标账户信息创建对应的目标智能合约。
其中，所述接收并利用所述智能合约存储所述服务器发送的所述第一交易凭证，包括：
接收并利用所述目标智能合约存储所述服务器发送的所述目标账户信息对应的第一交易凭证；
相应的，从智能合约中获取所述目标账户信息对应的所有第一交易凭证，包括：
从所述目标智能合约中获取所述目标账户信息对应的所有第一交易凭 证。
其中，还包括：
接收所述密码管理器广播的所述目标账户信息对应的投保交易，确定所述投保交易对应的投保机构；
当所述区块链网络中的区块链节点对所述投保交易共识后，对所述投保交易进行上链存储。
其中，所述通过对比所有所述第一交易凭证和所有所述第二交易凭证响应所述理赔请求，包括：
当存在不属于所有所述第二交易凭证的第一交易凭证时，判定登录异常，并触发理赔程序；
当存在不属于所有所述第一交易凭证的第二交易凭证时，判定缺失异常，并触发理赔程序。
其中，还包括：
客户端从所述服务器中获取随机字符串和所述目标应用或网站的标识，生成公钥和私钥，并基于所述标识从密码管理器中获取用于登录所述目标应用或网站的账户信息；
所述客户端通过所述密码管理器生成并向所述区块链网络广播所述第二登录请求，以便所述区块链网络中所述目标应用或网站对应的区块链节点将所述第二登录请求发送至所述服务器进行验证；其中，所述第二登录请求包括所述随机字符串、所述标识、所述公钥、所述账户信息和所述第二交易凭证；
所述客户端通过所述区块链网络接收所述登录许可交易，并利用所述登录许可交易中的登录令牌访问所述服务器。
其中，所述登录许可交易还包括所述第二登录请求对应的登录许可信息标识；所述客户端通过所述区块链网络接收登录许可交易，包括：
所述客户端计算所述第二登录请求对应的登录许可信息标识，调用区块链接口从所述区块链网络中获取所述登录许可信息标识对应的登录许可交易。
其中，还包括：
当所述客户端接收到所述目标账户的新密码修改请求时，确定所述目标账户对应的目标应用或目标网站；
所述客户端通过所述密码管理器向所述区块链网络广播所述目标账户对应的原始账户信息，以便所述区块链网络中所述目标应用或目标网站对应的区块链节点将所述原始账户信息发送至所述目标应用或目标网站对应的服务器进行验证；其中，所述原始账户信息包含所述目标账户的账号和旧密码；
所述客户端接收所述服务器发送的目标账户信息；所述客户端将所述密码管理器中所述目标账户的旧密码修改为所述新密码。
其中，所述客户端通过所述密码管理器生成并向区块链网络广播所述第二登录请求，以便所述区块链网络中所述目标应用或网站对应的区块链节点将所述第二登录请求发送至所述服务器进行验证，包括：
所述客户端通过所述密码管理器生成所述第二登录请求和所述目标应用或网站对应的区块链节点的一次性接收地址；
所述客户端通过所述密码管理器将所述第二登录请求广播至所述区块链网络，以便所述目标应用或网站对应的区块链节点利用所述一次性接收地址获取所述第二登录请求，并将所述第二登录请求发送至所述服务器进行验证。
其中，所述客户端通过所述密码管理器生成所述第二登录请求和所述目标应用或网站对应的区块链节点的一次性接收地址，包括：
所述客户端通过所述密码管理器生成所述第二登录请求和交易标识，并利用所述交易标识生成所述目标应用或网站对应的区块链节点的一次性接收地址。
其中，所述登录许可交易为进行环签名后的信息，环签名的签名者为所述区块链网络中接入应用或网站服务器的区块链节点。
为实现上述目的，本申请提供了一种网络身份保护装置，应用于区块链网络，包括：
第一获取模块，用于当接收到目标账户信息的理赔请求后，从智能合约中获取所述目标账户信息对应的所有第一交易凭证；其中，所述目标账 户信息用于登录目标应用或网站，所述第一交易凭证用于记录所述目标应用或网站的服务器上传的所有登录请求对应的登录信息；
第二获取模块，用于从所述区块链网络中的区块链节点获取所述目标账户信息对应的所有第二交易凭证；其中，所述第二交易凭证用于记录正常授权登录所述目标应用或网站的登录请求对应的登录信息；
对比模块，用于通过对比所有所述第一交易凭证和所有所述第二交易凭证响应所述理赔请求。
其中，所述对比模块包括：
第一触发单元，用于当存在不属于所有所述第二交易凭证的第一交易凭证时，判定登录异常，并触发理赔程序；
第二触发单元，用于当存在不属于所有所述第一交易凭证的第二交易凭证时，判定缺失异常，并触发理赔程序。
为实现上述目的，本申请提供了一种电子设备，包括：
存储器，用于存储计算机程序；
处理器，用于执行所述计算机程序时实现如上述网络身份保护方法的步骤。
为实现上述目的，本申请提供了一种计算机可读存储介质，所述计算机可读存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现如上述网络身份保护方法的步骤。
通过以上方案可知，本申请提供的一种网络身份保护方法，包括：当接收到目标账户信息的理赔请求后，从智能合约中获取所述目标账户信息对应的所有第一交易凭证；其中，所述目标账户信息用于登录目标应用或网站，所述第一交易凭证用于记录所述目标应用或网站的服务器上传的所有登录请求对应的登录信息；从所述区块链网络中的区块链节点获取所述目标账户信息对应的所有第二交易凭证；其中，所述第二交易凭证用于记录正常授权登录所述目标应用或网站的登录请求对应的登录信息；通过对比所有所述第一交易凭证和所有所述第二交易凭证响应所述理赔请求。
本申请提供的网络身份保护方法，第一交易凭证由应用或网站的服务器通过其在区块链网络中对应的的区块链节点上传至智能合约，包括请求 登录的所有登录交易的登录信息，即包括正常的授权登录(密码管理器登录)，也包括攻击登录。当接收到理赔请求后从区块链节点中获取第二交易凭证，其为利用密码管理器通过区块链网络登录目标应用或网站的登录信息，将智能合约中的第一交易凭证与上述第二交易凭证进行对比，实现自动理赔。由此可见，本申请提供的网络身份保护方法，基于区块链技术填补网络身份保险的空白，并实现自动理赔。本申请还公开了一种网络身份保护装置及一种电子设备和一种计算机可读存储介质，同样能实现上述技术效果。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性的，并不能限制本申请。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。附图是用来提供对本公开的进一步理解，并且构成说明书的一部分，与下面的具体实施方式一起用于解释本公开，但并不构成对本公开的限制。在附图中：
图1为根据一示例性实施例示出的一种网络身份保护系统的架构图；
图2为根据一示例性实施例示出的一种网络身份保护方法的流程图；
图3为根据一示例性实施例示出的另一种网络身份保护方法的流程图；
图4为根据一示例性实施例示出的一种网络身份保护装置的结构图；
图5为根据一示例性实施例示出的一种电子设备的结构图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例， 而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
为了便于理解本申请提供的网络身份保护方法，下面对其使用的系统进行介绍。参见图1，其示出了本申请实施例提供的一种网络身份保护系统的架构图，如图1所示，包括客户端、密码管理器、区块链网络、应用或网站服务器节点、应用或网站服务器、分布式数据库、保险公司节点、监督节点和智能合约。
客户端主要安装有APP、浏览器、浏览器插件等。密码管理器主要用于存储管理用户应用或网站信息，例如用于登录该应用或网站的账户信息等，还用于授权客户端请求的登录、调用区块链系统接口生成交易等。区块链网络为点对点通信网络结构，建立密码管理器与应用或网站服务器节点信息交互的载体。不同的应用或网站服务器节点在区块链系统中负责与应用或网站服务器对接，维护区块链系统安全，交易共识上链等。应用或网站服务器用于存储、验证用户网络身份信息，为客户端提供业务服务。分布式数据库为区块链去中心化共识数据存储库，主要用于应用或网站服务器节点、保险节点共识数据的存储。保险公司节点参与数据共识上链并为用户提供投保服务，监督节点主要为应用或网站服务器节点、保险公司节点授权管理区块链系统，生成保险智能合约等。智能合约属于区块链功能模块之一，主要用于实现用户投保与自动理赔。
本申请实施例公开了一种网络身份保护方法，实现了为用户网络身份进行投保与自动理赔。
参见图2，根据一示例性实施例示出的一种网络身份保护方法的流程图，如图2所示，包括：
S101：当接收到目标账户信息的理赔请求后，从智能合约中获取所述目标账户信息对应的所有第一交易凭证；其中，所述目标账户信息用于登录目标应用或网站，所述第一交易凭证用于记录所述目标应用或网站的服务器上传的所有登录请求对应的登录信息；
本实施例的执行主体为区块链网络，目的是为网络身份实现自动理赔。在具体实施中，如果用户为该账号购买了相应的网络身份保险，并发现该账号异常或造成损失时，便可通过密码管理器申请理赔。用户可以选择为目标账户申请新的密码，并为新的目标账户信息进行投保。即本实施例还包括：当所述服务器允许目标账户的新密码修改请求后，向密码管理器返回所述目标账户信息，以便所述密码管理器对所述目标账户进行密码修改；其中，所述目标账户信息包括所述目标账户和所述服务器生成的新密码的隐藏值。具体的，隐藏方式可以为散列、加密、加盐等，在此不进行限定。
在具体实施中，修改新密码的过程为：用户进入密码管理器，选择要修改密码的应用或网站，生成修改密码交易(目标服务器节点公钥加密的应用或网站账号和旧密码，用户公钥签名)，调用区块链系统接口广播交易。目标应用或网站服务器节点接收到修改密码交易并验证交易正确后，利用目标应用或网站服务器节点私钥解密获得应用或网站的账号密码。目标应用或网站服务器节点利用目标应用或网站服务器公钥加密账户的账号密码后，发送到目标应用或网站服务器。目标应用或网站服务器利用私钥解密获得应用或网站账号密码，并验证账号密码的正确性后，允许用户修改为新密码，并生成新密码的隐藏值。利用目标应用或网站服务器节点公钥加密新密码隐藏值，发送到目标应用或网站服务器节点。目标应用或网站服务器节点利用私钥解密获得新密码隐藏值后，生成允许购买交易(用户账号散列值，目标应用或网站服务器节点签名)，广播共识后在相应的智能合约保险里面添加用户账号散列值，即允许用户为账户信息投保。即本实施例还包括：当接收到对所述目标账户信息的投保请求后，为所述目标账户信息创建对应的目标智能合约。目标应用或网站服务器节点生成允许修改密码交易(用户公钥加密后应用或网站账号、密码的隐藏值、智能合约地址，目标应用或网站服务器节点的签名)，广播到区块链系统经各应用或网站服务器节点共识上链。管理器调用区块链系统接口获得允许修改密码交易，利用用户私钥解密获得强密码隐藏值存储于密码管理器本地或云端。
目标账户进行密码修改后，用户可以为账户信息进行投保。具体的，本实施例还包括：接收所述密码管理器广播的所述目标账户信息对应的投 保交易，确定所述投保交易对应的投保机构；当所述区块链网络中的所有区块链节点对所述投保交易共识后，对所述投保交易进行上链存储。
在具体实施中，用户可以通过密码管理器生成投保交易，包括智能合约保险地址、账号Hash、代币等，密码管理器将其广播到区块链系统，经各应用或网站服务器节点共识上链后投保成功。可以理解的是，区块链网络可以包括多个保险公司节点，即用户可以选择不同的保险公司进行投保。
智能合约中的第一交易凭证由应用或网站的区块链节点进行上传，即本实施例还包括：当所述服务器允许登录所述目标应用或网站的第一登录请求后，接收并利用所述智能合约存储所述服务器发送的所述第一交易凭证。第一交易凭证用于存储该用户此账号所有登录交易的登录信息，即包括正常的授权登录(密码管理器登录)，也包括攻击登录。登录信息可以为以下形式：{E(时间戳，AppID，账号Hash，登录设备唯一标识，登录方式等)，HashProof1(时间戳，AppID，账号Hash，登录设备唯一标识，登录方式等)}，HashProof1即为第一交易凭证。
S102：从所述区块链网络中的区块链节点获取所述目标账户信息对应的所有第二交易凭证；其中，所述第二交易凭证用于记录正常授权登录所述目标应用或网站的登录请求对应的登录信息；
在本步骤中，用户通过密码管理器向保险智能合约发起理赔申请交易(用户公钥，应用或网站账号hash，登录记录智能合约地址，公钥签名等)广播。调用区块链接口获得用户公钥下该应用或网站账号Hash对应的所有登录许可交易，从交易中提取出第二交易凭证。第二交易凭证用于记录正常授权登录目标应用或网站的登录请求对应的登录信息，{E(时间戳，AppID，账号Hash，登录设备唯一标识，登录方式等信息)，HashProof2(时间戳，AppID，账号Hash，登录设备唯一标识，登录方式等)}，HashProof2即为第二交易凭证。即本实施例还包括：当所述服务器允许通过所述区块链网络登录所述目标应用或网站的第二登录请求后，利用所述区块链网络中的区块链节点对所述第二登录请求对应的登录许可交易进行共识并上链存储；其中登录许可交易至少包括所述第二交易凭证。
利用密码管理器通过区块链网络登录目标应用或网站的过程为：用户 在客户端中进入应用或网站的登录页面。应用或网站服务器生成随机字符串，并将随机字符串和应用或网站的标识返回至客户端。同时，客户端生成公私钥1CSK和1CPK保存于缓存中。用户用主密码等验证打开密码管理器，解密存储于本地或云端的账户信息。扫描应用或网站或浏览器登录二维码提取登录信息。密码管理器调用区块链接口向区块链系统广播登录请求交易，可以包括应用或网站产生的随机字符串、应用或网站的标识、客户端产生的公钥、用于登录该应用或网站的账户信息、第二交易凭证和用户签名、对第二交易凭证的签名等。此处的第二交易凭证可以包括时间戳、应用或网站的标识、账号Hash、用户设备唯一标识、登录方式等。应用或网站服务器节点接收到广播的登录请求交易，利用私钥解密网络身份信息，然后利用应用或网站服务器节点公钥加密后发送至相应的应用或网站服务器节点。应用或网站服务器解密获得网络身份信息，验证成功后向应用或网站服务器节点返回登录许可信息，可以包括随机字符串对应的哈希值、登录令牌等。应用或网站服务器节点解密获得登录许可信息后，生成登录许可交易广播至区块链网络，可以包括随机字符串对应的哈希值、账号的哈希值、登录令牌和对第二交易凭证，数字签名等信息。其他应用或网站服务器节点验证登录许可交易正确后，通过共识上链。客户端通过调用区块链系统接口，利用随机字符串对应的哈希值获取共识后的登录许可交易，并利用1CSK解密获得登录令牌等许可登录信息。客户端携带登录令牌重新访问应用或网站服务器，应用或网站服务器验证登录令牌等信息正确后，返回登录成功后页面。
S103：通过对比所有所述第一交易凭证和所有所述第二交易凭证响应所述理赔请求。
在本步骤中，对比第一交易凭证与第二交易凭证实现自动理赔，当存在不属于所有所述第二交易凭证的第一交易凭证时，判定登录异常，并触发理赔程序；当存在不属于所有所述第一交易凭证的第二交易凭证时，判定缺失异常，并触发理赔程序。触发理赔程序后理赔成功，除上述两种理赔成功的情形外，判定理赔失败，例如第一交易凭证与第二交易凭证对应相等、数字签名不正确、用户提供的理赔信息(包括目标账户信息等)不 正确等，在此不进行具体限定。
本申请实施例提供的网络身份保护方法，第一交易凭证由应用或网站的服务器通过其在区块链网络中对应的的区块链节点上传至智能合约，包括请求登录的所有登录交易的登录信息，即包括正常的授权登录(密码管理器登录)，也包括攻击登录。当接收到理赔请求后从区块链节点中获取第二交易凭证，其为正常授权登录目标应用或网站的登录信息，将智能合约中的第一交易凭证与上述第二交易凭证进行对比，实现自动理赔。由此可见，本申请实施例提供的网络身份保护方法，基于区块链技术填补网络身份保险的空白，并实现自动理赔。
本申请实施例公开了一种网络身份保护方法，相对于上一实施例，本实施例对技术方案作了进一步的说明和优化。具体的：
参见图3，根据一示例性实施例示出的另一种网络身份保护方法的流程图，如图3所示，包括：
S201：当所述服务器允许目标账户的新密码修改请求后，向密码管理器返回所述目标账户信息，以便所述密码管理器对所述目标账户进行密码修改；其中，所述目标账户信息包括所述目标账户和所述服务器生成的新密码的隐藏值；
S202：当接收到对所述目标账户信息的投保请求后，为所述目标账户信息创建对应的目标智能合约；
S203：当所述服务器允许登录所述目标应用或网站的第一登录请求后，接收并利用所述目标智能合约存储所述服务器发送的所述目标账户信息对应的第一交易凭证；
S204：当所述服务器允许通过所述区块链网络登录所述目标应用或网站的第二登录请求后，利用所述区块链网络中的区块链节点对所述第二登录请求对应的登录许可交易进行共识并上链存储；其中登录许可交易至少包括所述第二交易凭证。
S205：当接收到所述目标账户信息的理赔请求后，从所述目标智能合约中获取所述目标账户信息对应的所有第一交易凭证；
S206：从所述区块链网络中的区块链节点获取所述目标账户信息对应的所有第二交易凭证；其中，所述第二交易凭证用于记录正常授权登录所述目标应用或网站的登录请求对应的登录信息；
S207：通过对比所有所述第一交易凭证和所有所述第二交易凭证响应所述理赔请求。
在本实施例中，每个账户有对应的智能合约，用户为账户信息进行投保，投保交易上链存储，为其中的账号建立对应的目标智能合约。该账号所有登录目标应用或网站的登录信息均上传至目标智能合约。在用户申请理赔后，将目标智能合约中的所有交易凭证作为所有第一交易凭证，与从区块链节点中获取的该账户对应的第二交易凭证进行对比，响应理赔请求。
下面详细介绍用户通过客户端修改新密码的过程，具体可以包括以下步骤：
S301：当所述客户端接收到所述目标账户的新密码修改请求时，确定所述目标账户对应的目标应用或目标网站；
本实施例的执行主体为客户端，在具体实施中，用户可以向客户端发送目标账户的新密码修改请求，目标账户的原始账户信息包含目标账户的账号和旧密码，用于登录目标应用或目标网站。
S302：所述客户端通过所述密码管理器向所述区块链网络广播所述目标账户对应的原始账户信息，以便所述区块链网络中所述目标应用或目标网站对应的区块链节点将所述原始账户信息发送至所述目标应用或目标网站对应的服务器进行验证；其中，所述原始账户信息包含所述目标账户的账号和旧密码；
在本步骤中，通过密码管理器生成并向区块链网络广播修改密码交易，其中包含上述原始账户信息，当然也可以同时广播用户签名，在此不进行具体限定。目标应用或网站服务器节点接收到修改密码交易并验证交易正确后，利用目标应用或网站服务器节点私钥解密获得原始账户信息，并发送到目标应用或网站服务器。
S303：所述客户端接收所述服务器发送的目标账户信息；
S304：所述客户端将所述密码管理器中所述目标账户的旧密码修改为所述新密码。
在具体实施中，目标应用或网站服务器验证账号密码的正确性后，基于旧密码生成新密码，并向对应的区块链节点返回目标账户信息，其中包括目标账号、生成的新密码的隐藏值。该区块链节点解密获得目标账户信息，生成允许修改新密码交易广播到区块链系统共识上链。密码管理器调用区块链接口获得允许修改新密码交易，解密后获得新密码，保存于去中心密码管理器或个人云端中。
下面详细介绍利用密码管理器通过区块链网络登录目标应用或网站的过程，具体可以包括以下步骤：
S401：客户端从所述服务器中获取随机字符串和所述目标应用或网站的标识，生成公钥和私钥，并基于所述标识从密码管理器中获取用于登录所述目标应用或网站的账户信息；
本实施例的执行主体为客户端，其中安装有需要使用应用或网站的服务器资源的第三方应用。在具体实施中，用户在客户端中进入应用或网站的登录页面。应用或网站服务器生成随机字符串，并将随机字符串和应用或网站的标识返回至客户端。同时，客户端生成公私钥1CSK和1CPK保存于缓存中。用户用主密码等验证打开密码管理器，解密存储于本地或云端的账户信息。
S402：所述客户端通过所述密码管理器生成并向区块链网络广播所述第二登录请求，以便所述区块链网络中所述目标应用或网站对应的区块链节点将所述第二登录请求发送至所述服务器进行验证；其中，所述第二登录请求包括所述随机字符串、所述标识、所述公钥、所述账户信息和所述第二交易凭证；
在本步骤中，扫描应用或网站或浏览器登录二维码提取登录信息。密码管理器调用区块链接口向区块链系统广播第二登录请求，可以包括应用或网站产生的随机字符串、应用或网站的标识、客户端产生的公钥、用于登录该应用或网站的账户信息、第二交易凭证和用户签名、对第二交易凭 证的签名等。此处的第二交易凭证可以包括时间戳、应用或网站的标识、账号Hash、用户设备唯一标识、登录方式等。第二登录请求可以使用应用或网站服务器节点公钥加密保证数据传输的安全性。区块链网络中应用或网站服务器对应的区块链节点查找交易列表获得登录请求交易，利用的应用或网站服务器节点私钥解密登录请求交易，通过网络发送至相应的应用或网站服务器，应用或网站服务器解密并验证接收到的信息。
需要说明的是，密码管理器可以使用一次性隐蔽地址技术向区块链网络广播登录请求交易。主要目的是实现隐藏接收者的真正地址，实现不可追溯性。混淆地址公式为：P＝Hs(rA)G+B。P为接收者的一次性接收地址，Hs为哈希函数，r为交易发送者产生的随机数，只有发送者知道。A为接收者的查看公钥，B为接收者的支付公钥。G为椭圆曲线上的一点，R＝rG为交易公钥，公开于交易中。
接收者从交易列表中检查交易是否是发送给自己：P'＝Hs(aR)G+B。P'为交易接受者利用交易公钥R和自己的查看私钥，支付私钥生成混淆地址。x为交易接受者利用交易公钥R和自己的查看私钥，支付私钥生成一次性使用私钥。
在基于区块链的网络身份授权登录系统中，因为不同的应用或网站服务器节点共同维护同一个区块链系统，并在此系统中进行用户信息的交互。为了实现不同应用或网站服务器节点之间的用户流量等隐私保护，利用混淆地址技术隐藏接收者(应用或网站服务器节点)真实地址和环签名技术隐藏交易发起者(应用或网站服务器节点)的真实地址。即所述登录许可信息为进行环签名后的信息，环签名的签名者为所述区块链网络中接入应用或网站服务器的区块链节点。
具体的，所述通过所述密码管理器生成并向区块链网络广播第二登录请求，以便通过所述区块链网络中所述目标应用或网站对应的区块链节点将所述第二登录请求发送至所述服务器进行验证的步骤可以包括：通过所述密码管理器生成所述第二登录请求和所述目标应用或网站对应的区块链节点的一次性接收地址；通过所述密码管理器将所述第二登录请求广播至所述区块链网络，以便所述目标应用或网站对应的区块链节点利用所述一 次性接收地址获取所述第二登录请求，并将所述第二登录请求发送至所述服务器进行验证。
在具体实施中，密码管理器获得二维码信息并解密密码管理中存储的账号信息后，生成第二登录请求。接收者为应用或网站服务器对应的区块链节点，为了隐藏该区块链节点的地址，去中心密码管理生成一个随机数r，并计算交易标识R＝rG公开放在交易中。利用区块链节点的查看公钥A与支付公钥B计算P＝Hs(rA)G+B作为此次登录请求交易区块链节点的一次性接收地址。即所述通过所述密码管理器生成所述第二登录请求和所述目标应用或网站对应的区块链节点的一次性接收地址的步骤包括：通过所述密码管理器生成所述第二登录请求和交易标识，并利用所述交易标识生成所述目标应用或网站对应的区块链节点的一次性接收地址。
各区块链节点查看交易列表，并利用交易标识R＝rG和自己的查看私钥和支付公钥B计算P'＝Hs(aR)G+B获得发送给自己的交易。应用或网站服务器对应的区块链节点获得加密后的登录令牌等信息后，生成第二登录请求，并进行环签名，环签名的签名者集合为应用或网站服务器对应的区块链节点。其他应用或网站服务器对应的区块链节点验证第二登录请求中用户签名与环签名的正确性后，共识上链。在验证环签名中只能证明真实签名者是各应用或网站服务器对应的区块链节点之一。
S403：所述客户端通过所述区块链网络接收所述登录许可交易，并利用所述登录许可交易中的登录令牌访问所述服务器。
在具体实施中，服务器验证成功后向应用或网站服务器节点返回登录许可信息，可以包括第二登录请求对应的登录许可信息标识(例如随机字符串对应的哈希值)、登录令牌等。此处的登录令牌可以包括用于访问服务器的Cookie和Token，该区块链节点将登录许可信息广播至区块链网络。应用或网站服务器节点解密获得登录许可信息后，生成登录许可交易广播至区块链网络，可以包括随机字符串对应的哈希值、账号的哈希值、登录令牌和对第二交易凭证，数字签名等信息。其他应用或网站服务器节点验证登录许可交易正确后，通过共识上链。客户端计算所述第二登录请求对应的登录许可信息标识(即随机字符串对应的哈希值)，通过调用区块链系 统接口从区块链网络中获取登录许可信息标识对应的登录许可交易，并利用1CSK解密获得登录令牌等登录许可信息。客户端携带登录令牌重新访问应用或网站服务器，应用或网站服务器验证登录令牌等信息正确后，返回登录成功后页面。
下面对本申请实施例提供的一种网络身份保护装置进行介绍，下文描述的一种网络身份保护装置与上文描述的一种网络身份保护方法可以相互参照。
参见图4，根据一示例性实施例示出的一种网络身份保护装置的结构图，如图4所示，包括：
第一获取模块401，用于当接收到目标账户信息的理赔请求后，从智能合约中获取所述目标账户信息对应的所有第一交易凭证；其中，所述目标账户信息用于登录目标应用或网站，所述第一交易凭证用于记录所述目标应用或网站的服务器上传的所有登录请求对应的登录信息；
第二获取模块402，用于从所述区块链网络中的区块链节点获取所述目标账户信息对应的所有第二交易凭证；其中，所述第二交易凭证用于记录正常授权登录所述目标应用或网站的登录请求对应的登录信息；
对比模块403，用于通过对比所有所述第一交易凭证和所有所述第二交易凭证响应所述理赔请求。
本申请实施例提供的网络身份保护装置，第一交易凭证由应用或网站的服务器通过其在区块链网络中对应的的区块链节点上传至智能合约，包括请求登录的所有登录交易的登录信息，即包括正常的授权登录(密码管理器登录)，也包括攻击登录。当接收到理赔请求后从区块链节点中获取第二交易凭证，其为正常授权登录目标应用或网站的登录信息，将智能合约中的第一交易凭证与上述第二交易凭证进行对比，实现自动理赔。由此可见，本申请实施例提供的网络身份保护装置，基于区块链技术填补网络身份保险的空白，并实现自动理赔。
在上述实施例的基础上，作为一种优选实施方式，还包括：
第一存储模块，用于当所述服务器允许登录所述目标应用或网站的第一登录请求后，接收并利用所述智能合约存储所述服务器发送的所述第一交易凭证；
第二存储模块，用于当所述服务器允许通过所述区块链网络登录所述目标应用或网站的第二登录请求后，利用所述区块链网络中的区块链节点对所述第二登录请求对应的登录许可交易进行共识并上链存储；其中登录许可交易至少包括所述第二交易凭证。
在上述实施例的基础上，作为一种优选实施方式，还包括：
返回模块，用于当所述服务器允许目标账户的新密码修改请求后，向密码管理器返回所述目标账户信息，以便所述密码管理器对所述目标账户进行密码修改；其中，所述目标账户信息包括所述目标账户和所述服务器生成的新密码的隐藏值；
创建模块，用于当接收到对所述目标账户信息的投保请求后，为所述目标账户信息创建对应的目标智能合约。
在上述实施例的基础上，作为一种优选实施方式，所述存储模块具体为当所述服务器允许登录所述目标应用或网站的登录请求后，接收并利用所述目标智能合约存储所述服务器发送的所述目标账户信息对应的第一交易凭证的模块；
相应的，第一获取模块401具体为当接收到目标账户信息的理赔请求后，从所述目标智能合约中获取所述目标账户信息对应的所有第一交易凭证的模块。
在上述实施例的基础上，作为一种优选实施方式，还包括：
第一确定模块，用于接收所述密码管理器广播的所述目标账户信息对应的投保交易，确定所述投保交易对应的投保机构；
第三存储模块，用于当所述区块链网络中的区块链节点对所述投保交易共识后，对所述投保交易进行上链存储。
在上述实施例的基础上，作为一种优选实施方式，所述对比模块403包括：
第一触发单元，用于当存在不属于所有所述第二交易凭证的第一交易 凭证时，判定登录异常，并触发理赔程序；
第二触发单元，用于当存在不属于所有所述第一交易凭证的第二交易凭证时，判定缺失异常，并触发理赔程序。
在上述实施例的基础上，作为一种优选实施方式，所述客户端包括：
第三获取模块，用于从所述服务器中获取随机字符串和所述目标应用或网站的标识，生成公钥和私钥，并基于所述标识从密码管理器中获取用于登录所述目标应用或网站的账户信息；
第一广播模块，用于通过所述密码管理器生成并向所述区块链网络广播所述第二登录请求，以便所述区块链网络中所述目标应用或网站对应的区块链节点将所述第二登录请求发送至所述服务器进行验证；其中，所述第二登录请求包括所述随机字符串、所述标识、所述公钥和所述账户信息；
第一接收模块，用于通过所述区块链网络接收所述登录许可交易，并利用所述登录许可交易中的登录令牌访问所述服务器。
在上述实施例的基础上，作为一种优选实施方式，所述登录许可交易还包括所述第二登录请求对应的登录许可信息标识；所述第一接收模块具体为计算所述第二登录请求对应的登录许可信息标识，调用区块链接口从所述区块链网络中获取所述登录许可信息标识对应的登录许可交易的模块。
在上述实施例的基础上，作为一种优选实施方式，所述客户端还包括：
第二确定模块，用于当接收到所述目标账户的新密码修改请求时，确定所述目标账户对应的目标应用或目标网站；
第二广播模块，用于通过所述密码管理器向所述区块链网络广播所述目标账户对应的原始账户信息，以便所述区块链网络中所述目标应用或目标网站对应的区块链节点将所述原始账户信息发送至所述目标应用或目标网站对应的服务器进行验证；其中，所述原始账户信息包含所述目标账户的账号和旧密码；
第二接收模块，用于接收所述服务器发送的目标账户信息；所述客户端将所述密码管理器中所述目标账户的旧密码修改为所述新密码。
在上述实施例的基础上，作为一种优选实施方式，所述第一广播模块 包括：
生成单元，用于通过所述密码管理器生成所述第二登录请求和所述目标应用或网站对应的区块链节点的一次性接收地址；
广播单元，用于通过所述密码管理器将所述第二登录请求广播至所述区块链网络，以便所述目标应用或网站对应的区块链节点利用所述一次性接收地址获取所述第二登录请求，并将所述第二登录请求发送至所述服务器进行验证。
在上述实施例的基础上，作为一种优选实施方式，所述生成单元具体为通过所述密码管理器生成所述第二登录请求和交易标识，并利用所述交易标识生成所述目标应用或网站对应的区块链节点的一次性接收地址的单元。
在上述实施例的基础上，作为一种优选实施方式，所述登录许可交易为进行环签名后的信息，环签名的签名者为所述区块链网络中接入应用或网站服务器的区块链节点。
关于上述实施例中的装置，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
本申请还提供了一种电子设备，参见图5，本申请实施例提供的一种电子设备500的结构图，如图5所示，可以包括处理器11和存储器12。该电子设备500还可以包括多媒体组件13，输入/输出(I/O)接口14，以及通信组件15中的一者或多者。
其中，处理器11用于控制该电子设备500的整体操作，以完成上述的网络身份保护方法中的全部或部分步骤。存储器12用于存储各种类型的数据以支持在该电子设备500的操作，这些数据例如可以包括用于在该电子设备500上操作的任何应用程序或方法的指令，以及应用程序相关的数据，例如联系人数据、收发的消息、图片、音频、视频等等。该存储器12可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，例如静态随机存取存储器(Static Random Access Memory，简称SRAM)，电可擦除可编程只读存储器(Electrically Erasable Programmable Read-Only Memory， 简称EEPROM)，可擦除可编程只读存储器(Erasable Programmable Read-Only Memory，简称EPROM)，可编程只读存储器(Programmable Read-Only Memory，简称PROM)，只读存储器(Read-Only Memory，简称ROM)，磁存储器，快闪存储器，磁盘或光盘。多媒体组件13可以包括屏幕和音频组件。其中屏幕例如可以是触摸屏，音频组件用于输出和/或输入音频信号。例如，音频组件可以包括一个麦克风，麦克风用于接收外部音频信号。所接收的音频信号可以被进一步存储在存储器12或通过通信组件15发送。音频组件还包括至少一个扬声器，用于输出音频信号。I/O接口14为处理器11和其他接口模块之间提供接口，上述其他接口模块可以是键盘，鼠标，按钮等。这些按钮可以是虚拟按钮或者实体按钮。通信组件15用于该电子设备500与其他设备之间进行有线或无线通信。无线通信，例如Wi-Fi，蓝牙，近场通信(Near Field Communication，简称NFC)，2G、3G或4G，或它们中的一种或几种的组合，因此相应的该通信组件15可以包括：Wi-Fi模块，蓝牙模块，NFC模块。
在一示例性实施例中，电子设备500可以被一个或多个应用专用集成电路(Application Specific Integrated Circuit，简称ASIC)、数字信号处理器(Digital Signal Processor，简称DSP)、数字信号处理设备(Digital Signal Processing Device，简称DSPD)、可编程逻辑器件(Programmable Logic Device，简称PLD)、现场可编程门阵列(Field Programmable Gate Array，简称FPGA)、控制器、微控制器、微处理器或其他电子元件实现，用于执行上述的网络身份保护方法。
在另一示例性实施例中，还提供了一种包括程序指令的计算机可读存储介质，该程序指令被处理器执行时实现上述网络身份保护方法的步骤。例如，该计算机可读存储介质可以为上述包括程序指令的存储器12，上述程序指令可由电子设备500的处理器11执行以完成上述的网络身份保护方法。
说明书中各个实施例采用递进的方式描述，每个实施例重点说明的都是与其他实施例的不同之处，各个实施例之间相同相似部分互相参见即可。对于实施例公开的装置而言，由于其与实施例公开的方法相对应，所以描 述的比较简单，相关之处参见方法部分说明即可。应当指出，对于本技术领域的普通技术人员来说，在不脱离本申请原理的前提下，还可以对本申请进行若干改进和修饰，这些改进和修饰也落入本申请权利要求的保护范围内。
还需要说明的是，在本说明书中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。

Claims (16)

  1. 一种网络身份保护方法，其特征在于，应用于区块链网络，包括：
    当接收到目标账户信息的理赔请求后，从智能合约中获取所述目标账户信息对应的所有第一交易凭证；其中，所述目标账户信息用于登录目标应用或网站，所述第一交易凭证用于记录所述目标应用或网站的服务器上传的所有登录请求对应的登录信息；
    从所述区块链网络中的区块链节点获取所述目标账户信息对应的所有第二交易凭证；其中，所述第二交易凭证用于记录正常授权登录所述目标应用或网站的登录请求对应的登录信息；
    通过对比所有所述第一交易凭证和所有所述第二交易凭证响应所述理赔请求。
  2. 根据权利要求1所述网络身份保护方法，其特征在于，还包括：
    当所述服务器允许登录所述目标应用或网站的第一登录请求后，接收并利用所述智能合约存储所述服务器发送的所述第一交易凭证；
    当所述服务器允许通过所述区块链网络登录所述目标应用或网站的第二登录请求后，利用所述区块链网络中的区块链节点对所述第二登录请求对应的登录许可交易进行共识并上链存储；其中登录许可交易至少包括所述第二交易凭证。
  3. 根据权利要求2所述网络身份保护方法，其特征在于，还包括：
    当所述服务器允许目标账户的新密码修改请求后，向密码管理器返回所述目标账户信息，以便所述密码管理器对所述目标账户进行密码修改；其中，所述目标账户信息包括所述目标账户和所述服务器生成的新密码的隐藏值；
    当接收到对所述目标账户信息的投保请求后，为所述目标账户信息创建对应的目标智能合约。
  4. 根据权利要求3所述网络身份保护方法，其特征在于，所述接收并利用所述智能合约存储所述服务器发送的所述第一交易凭证，包括：
    接收并利用所述目标智能合约存储所述服务器发送的所述目标账户信息对应的第一交易凭证；
    相应的，从智能合约中获取所述目标账户信息对应的所有第一交易凭证，包括：
    从所述目标智能合约中获取所述目标账户信息对应的所有第一交易凭证。
  5. 根据权利要求1所述网络身份保护方法，其特征在于，还包括：
    接收所述密码管理器广播的所述目标账户信息对应的投保交易，确定所述投保交易对应的投保机构；
    当所述区块链网络中的区块链节点对所述投保交易共识后，对所述投保交易进行上链存储。
  6. 根据权利要求1所述网络身份保护方法，其特征在于，所述通过对比所有所述第一交易凭证和所有所述第二交易凭证响应所述理赔请求，包括：
    当存在不属于所有所述第二交易凭证的第一交易凭证后，判定登录异常，并触发理赔程序；
    当存在不属于所有所述第一交易凭证的第二交易凭证后，判定缺失异常，并触发理赔程序。
  7. 根据权利要求2所述网络身份保护方法，其特征在于，还包括：
    客户端从所述服务器中获取随机字符串和所述目标应用或网站的标识，生成公钥和私钥，并基于所述标识从密码管理器中获取用于登录所述目标应用或网站的账户信息；
    所述客户端通过所述密码管理器生成并向所述区块链网络广播所述第二登录请求，以便所述区块链网络中所述目标应用或网站对应的区块链节点将所述第二登录请求发送至所述服务器进行验证；其中，所述第二登录请求包括所述随机字符串、所述标识、所述公钥、所述账户信息和所述第二交易凭证；
    所述客户端通过所述区块链网络接收所述登录许可交易，并利用所述登录许可交易中的登录令牌访问所述服务器。
  8. 根据权利要求7所述网络身份保护方法，其特征在于，所述登录许可交易还包括所述第二登录请求对应的登录许可信息标识；所述客户端通 过所述区块链网络接收登录许可交易，包括：
    所述客户端计算所述第二登录请求对应的登录许可信息标识，调用区块链接口从所述区块链网络中获取所述登录许可信息标识对应的登录许可交易。
  9. 根据权利要求3所述网络身份保护方法，其特征在于，还包括：
    当所述客户端接收到所述目标账户的新密码修改请求时，确定所述目标账户对应的目标应用或目标网站；
    所述客户端通过所述密码管理器向所述区块链网络广播所述目标账户对应的原始账户信息，以便所述区块链网络中所述目标应用或目标网站对应的区块链节点将所述原始账户信息发送至所述目标应用或目标网站对应的服务器进行验证；其中，所述原始账户信息包含所述目标账户的账号和旧密码；
    所述客户端接收所述服务器发送的目标账户信息；所述客户端将所述密码管理器中所述目标账户的旧密码修改为所述新密码。
  10. 根据权利要求7所述网络身份保护方法，其特征在于，所述客户端通过所述密码管理器生成并向区块链网络广播所述第二登录请求，以便所述区块链网络中所述目标应用或网站对应的区块链节点将所述第二登录请求发送至所述服务器进行验证，包括：
    所述客户端通过所述密码管理器生成所述第二登录请求和所述目标应用或网站对应的区块链节点的一次性接收地址；
    所述客户端通过所述密码管理器将所述第二登录请求广播至所述区块链网络，以便所述目标应用或网站对应的区块链节点利用所述一次性接收地址获取所述第二登录请求，并将所述第二登录请求发送至所述服务器进行验证。
  11. 根据权利要求10所述网络身份保护方法，其特征在于，所述客户端通过所述密码管理器生成所述第二登录请求和所述目标应用或网站对应的区块链节点的一次性接收地址，包括：
    所述客户端通过所述密码管理器生成所述第二登录请求和交易标识，并利用所述交易标识生成所述目标应用或网站对应的区块链节点的一次性 接收地址。
  12. 根据权利要求10所述网络身份保护方法，其特征在于，所述登录许可交易为进行环签名后的信息，环签名的签名者为所述区块链网络中接入应用或网站服务器的区块链节点。
  13. 一种网络身份保护装置，其特征在于，应用于区块链网络，包括：
    第一获取模块，用于当接收到目标账户信息的理赔请求后，从智能合约中获取所述目标账户信息对应的所有第一交易凭证；其中，所述目标账户信息用于登录目标应用或网站，所述第一交易凭证用于记录所述目标应用或网站的服务器上传的所有登录请求对应的登录信息；
    第二获取模块，用于从所述区块链网络中的区块链节点获取所述目标账户信息对应的所有第二交易凭证；其中，所述第二交易凭证用于记录正常授权登录所述目标应用或网站的登录请求对应的登录信息；
    对比模块，用于通过对比所有所述第一交易凭证和所有所述第二交易凭证响应所述理赔请求。
  14. 根据权利要求13所述网络身份保护装置，其特征在于，所述对比模块包括：
    第一触发单元，用于当存在不属于所有所述第二交易凭证的第一交易凭证后，判定登录异常，并触发理赔程序；
    第二触发单元，用于当存在不属于所有所述第一交易凭证的第二交易凭证后，判定缺失异常，并触发理赔程序。
  15. 一种电子设备，其特征在于，包括：
    存储器，用于存储计算机程序；
    处理器，用于执行所述计算机程序后实现如权利要求1至12任一项所述网络身份保护方法的步骤。
  16. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有计算机程序，所述计算机程序被处理器执行后实现如权利要求1至12任一项所述网络身份保护方法的步骤。
PCT/CN2020/098484 2020-02-26 2020-06-28 一种网络身份保护方法、装置及电子设备和存储介质 WO2021169107A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/888,236 US20220394026A1 (en) 2020-02-26 2022-08-15 Network identity protection method and device, and electronic equipment and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010120877.XA CN111353903B (zh) 2020-02-26 2020-02-26 一种网络身份保护方法、装置及电子设备和存储介质
CN202010120877.X 2020-02-26

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/888,236 Continuation US20220394026A1 (en) 2020-02-26 2022-08-15 Network identity protection method and device, and electronic equipment and storage medium

Publications (1)

Publication Number Publication Date
WO2021169107A1 true WO2021169107A1 (zh) 2021-09-02

Family

ID=71194108

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/098484 WO2021169107A1 (zh) 2020-02-26 2020-06-28 一种网络身份保护方法、装置及电子设备和存储介质

Country Status (3)

Country Link
US (1) US20220394026A1 (zh)
CN (1) CN111353903B (zh)
WO (1) WO2021169107A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114266017A (zh) * 2021-12-30 2022-04-01 北京深思数盾科技股份有限公司 软件许可方法及电子设备
CN115037557A (zh) * 2022-08-10 2022-09-09 深圳易伙科技有限责任公司 一种用于用户访问应用的临时身份认证方法和装置
CN116566710A (zh) * 2023-05-28 2023-08-08 易知名国际文化传媒(北京)有限公司 一种区块链数据管理方法及系统

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111353903B (zh) * 2020-02-26 2021-07-06 广东工业大学 一种网络身份保护方法、装置及电子设备和存储介质
CN112347456B (zh) 2020-10-28 2023-09-01 达闼机器人股份有限公司 程序验证方法和装置、平台和用户终端及在线服务系统
CN112702354B (zh) * 2020-12-29 2023-08-11 国家电网有限公司大数据中心 一种基于区块链技术的数据资源共享追溯方法及装置
CN113221093B (zh) * 2021-05-25 2022-11-25 成都佰纳瑞信息技术有限公司 一种基于区块链的单点登录系统、方法、设备和产品
CN113326488A (zh) * 2021-05-26 2021-08-31 广东工业大学 一种个人信息保护系统以及方法
CN113506108A (zh) * 2021-06-25 2021-10-15 网易（杭州）网络有限公司 一种账户管理方法、装置、终端及存储介质
CN114268472B (zh) * 2021-12-10 2023-12-15 杭州溪塔科技有限公司 基于区块链的应用系统的用户认证方法及系统
CN115049385B (zh) * 2022-05-24 2024-05-28 福建天晴在线互动科技有限公司 一种通过线上服务端保证苹果内购充值到账的方法及系统
CN115842680B (zh) * 2023-02-14 2023-05-02 杭州西软计算机工程有限公司 一种网络身份认证管理方法及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104426861A (zh) * 2013-08-27 2015-03-18 中国银联股份有限公司 网页检测方法及系统
CN108038786A (zh) * 2017-11-14 2018-05-15 北京欧链科技有限公司 基于区块链的理赔事件的处理方法及系统
US10108954B2 (en) * 2016-06-24 2018-10-23 PokitDok, Inc. System and method for cryptographically verified data driven contracts
KR20190069728A (ko) * 2017-12-12 2019-06-20 김준유 비정형 데이터를 이용한 보험 플랫폼 제공 방법 및 장치
CN110047008A (zh) * 2018-12-18 2019-07-23 阿里巴巴集团控股有限公司 一种基于区块链的理赔方法和装置
CN111353903A (zh) * 2020-02-26 2020-06-30 广东工业大学 一种网络身份保护方法、装置及电子设备和存储介质

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101816653B1 (ko) * 2017-02-14 2018-02-21 주식회사 코인플러그 스마트 컨트랙트 및 블록체인 데이터베이스를 사용하여 서비스 제공 서버에 의하여 제공되는 서비스를 이용하기 위한 사용자의 로그인 요청에 대하여 pki 기반의 인증을 통해 로그인을 대행하는 방법 및 이를 이용한 서버
CN107147652B (zh) * 2017-05-18 2019-08-09 电子科技大学 一种基于区块链的用户多形态身份的安全融合认证方法
CN107370730B (zh) * 2017-07-14 2020-06-02 创新先进技术有限公司 一种登录信息处理方法及设备
CN109637637A (zh) * 2017-10-20 2019-04-16 北京航空航天大学 基于区块链的医疗管理系统
US10642967B2 (en) * 2017-11-28 2020-05-05 American Express Travel Related Services Company, Inc. Single sign-on solution using blockchain
CN108322465B (zh) * 2018-01-31 2021-09-24 腾讯科技（深圳）有限公司 资源分享、请求、处理方法、装置、存储介质和设备
CN108510250A (zh) * 2018-03-30 2018-09-07 深圳市优学链科技有限公司 区块链注册方法、系统及注册服务器
CN108711108B (zh) * 2018-05-15 2021-05-18 厦门快商通信息技术有限公司 一种基于区块链技术的人身保险决策支持方法及系统
CN109242699A (zh) * 2018-06-28 2019-01-18 平安科技（深圳）有限公司 基于区块链的医疗保险理赔方法、系统及计算机设备
US10938566B2 (en) * 2018-08-08 2021-03-02 Keir Finlow-Bates Blockchain based identity and access management
CN108965339A (zh) * 2018-09-25 2018-12-07 安徽灵图壹智能科技有限公司 一种区块链学校数据访问系统
CN113190822B (zh) * 2019-01-16 2023-06-09 腾讯科技（深圳）有限公司 身份认证方法、个人安全内核节点、和电子设备
CN109947848A (zh) * 2019-01-30 2019-06-28 阿里巴巴集团控股有限公司 基于区块链的存证方法和装置
PL3602457T3 (pl) * 2019-02-28 2021-10-25 Advanced New Technologies Co., Ltd. System i sposób zarządzania danymi w łańcuchu bloków
CN110020526A (zh) * 2019-04-02 2019-07-16 深圳智乾区块链科技有限公司 基于区块链身份认证的审批方法、装置及存储介质
US10972475B1 (en) * 2020-01-29 2021-04-06 Capital One Services, Llc Account access security using a distributed ledger and/or a distributed file system

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104426861A (zh) * 2013-08-27 2015-03-18 中国银联股份有限公司 网页检测方法及系统
US10108954B2 (en) * 2016-06-24 2018-10-23 PokitDok, Inc. System and method for cryptographically verified data driven contracts
CN108038786A (zh) * 2017-11-14 2018-05-15 北京欧链科技有限公司 基于区块链的理赔事件的处理方法及系统
KR20190069728A (ko) * 2017-12-12 2019-06-20 김준유 비정형 데이터를 이용한 보험 플랫폼 제공 방법 및 장치
CN110047008A (zh) * 2018-12-18 2019-07-23 阿里巴巴集团控股有限公司 一种基于区块链的理赔方法和装置
CN111353903A (zh) * 2020-02-26 2020-06-30 广东工业大学 一种网络身份保护方法、装置及电子设备和存储介质

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114266017A (zh) * 2021-12-30 2022-04-01 北京深思数盾科技股份有限公司 软件许可方法及电子设备
CN115037557A (zh) * 2022-08-10 2022-09-09 深圳易伙科技有限责任公司 一种用于用户访问应用的临时身份认证方法和装置
CN115037557B (zh) * 2022-08-10 2022-10-25 深圳易伙科技有限责任公司 一种用于用户访问应用的临时身份认证方法和装置
CN116566710A (zh) * 2023-05-28 2023-08-08 易知名国际文化传媒(北京)有限公司 一种区块链数据管理方法及系统
CN116566710B (zh) * 2023-05-28 2024-04-26 深圳市远东数智采技术服务有限公司 一种区块链数据管理方法及系统

Also Published As

Publication number Publication date
US20220394026A1 (en) 2022-12-08
CN111353903A (zh) 2020-06-30
CN111353903B (zh) 2021-07-06

Similar Documents

Publication Publication Date Title
WO2021169107A1 (zh) 一种网络身份保护方法、装置及电子设备和存储介质
CN111429254B (zh) 一种业务数据处理方法、设备以及可读存储介质
US11025435B2 (en) System and method for blockchain-based cross-entity authentication
US11533164B2 (en) System and method for blockchain-based cross-entity authentication
US11757641B2 (en) Decentralized data authentication
CN110537346B (zh) 安全去中心化域名系统
US9838205B2 (en) Network authentication method for secure electronic transactions
WO2020062668A1 (zh) 一种身份认证方法、身份认证装置及计算机可读介质
JP2020528222A (ja) ブロックチェーンにおけるスマートコントラクトに基づくトランザクション活動の取扱注意データを保護するための方法及びデバイス
JP2008501176A (ja) プライバシーを保護する情報配布システム
TW201248526A (en) Dynamic platform reconfiguration by multi-tenant service providers
US12033142B2 (en) Authenticator app for consent architecture
JP7376727B2 (ja) 暗号学的に安全な要求の検証
JP7282982B2 (ja) グループ署名による匿名イベント証明
CN113169866A (zh) 使用同时密钥发布来防止共谋的技术
CN111949335A (zh) 用于共享金融数据的方法和设备
JP2022534677A (ja) ブロックチェーンを使用するオンラインアプリケーションおよびウェブページの保護
JP2023542578A (ja) トークン償還による匿名認証

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20922413

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20922413

Country of ref document: EP

Kind code of ref document: A1