CN108737436B - Cross-domain server identity authentication method based on trust alliance blockchain - Google Patents

Abstract

The invention discloses a cross-domain server identity authentication method based on a trust alliance block chain. ) authenticate the identity of the user accessing the server in the IBC domain of the identity-based cryptosystem; (4) set the valid time of the authentication credential; (5) re-authenticate the identity of the user accessing the server in the public key infrastructure PKI domain; (6) re-authenticate the identity-based The identity of the user accessing the server in the cryptosystem IBC domain. The invention constructs a trust alliance block chain, realizes inter-domain mutual authentication through mutual authentication between nodes in the trust alliance block chain, and then realizes cross-domain authentication for servers, reduces the maintenance burden on the bridge center system, and reduces users It has good practicability and scalability.

Description

Cross-domain server identity authentication method based on trust alliance blockchain

technical field

The invention belongs to the technical field of network communication, and further relates to a method for cross-domain authentication server identity based on a trust alliance block chain in the technical field of network security. The present invention can be applied to a method for authenticating the identity of the accessed server when a user requests cross-domain access to the server in the certificate-based public key infrastructure PKI (Public Key Infrastructure) and the identity-based cryptosystem IBC (Identity-Based Cryptography) domain .

Background technique

At present, the trust domain authentication framework based on public key mostly uses certificate-based public key infrastructure PKI and identity-based cryptosystem IBC. When an identity-based cryptography IBC domain user accesses a public key infrastructure PKI domain server, or a public key infrastructure PKI domain user accesses an identity-based cryptography IBC domain server, the identity of the accessed server needs to be authenticated to ensure that It provides secure services. At this time, there will be problems such as the inability to achieve cross-domain identity authentication due to the difference in the authentication structure of the public key infrastructure PKI and the identity-based cryptography system IBC.

Beijing Dimansen Technology Co., Ltd. proposed an identity-based combined key cross-domain authentication method in its patent document "An identification-based combined key cross-domain authentication method" (application number 201710647789.3, publication number CN 107395364A). Authentication method. In this method, an IKI system is established outside each identity key infrastructure IKI (Identity Key Infrastructure) system, which is called bridge IKI. Each IKI system and bridge IKI mutually issue matrix identifiers. The mutual exchange of matrix identifiers issued by IKIs realizes cross-domain authentication. The above interactive authentication is based on the trustworthiness of the bridge IKI system, so it is necessary to maintain trust security; during user authentication, the matrix identity of the system and the bridge IKI matrix identity are exchanged, and the above matrix identity needs to be stored. The shortcomings of this method are: first, the identity of the bridge IKI system needs to be maintained by trust, which increases the maintenance burden; second, when the number of IKI systems increases, the storage burden of the bridge IKI system increases. Increase the user's storage burden.

Southwest Jiaotong University's patent documents "Authentication Key Agreement Method for Users in the IBC Domain to Access Resources in the PKI Domain" (Application No. 201710081516.7, Publication No. CN 106789042 A) and "Authentication for Users in the PKI Domain to Access Resources in the IBC Domain" Key agreement method (application number 201710082835.X, public number CN106877996A)" discloses an identity authentication key agreement method for realizing cross-domain access between PKI and IBC domains. The above system includes authentication of users, resources, and IBC and PKI domains server. In its implementation method, the user needs to first send an authentication application to the authentication server in the local domain, then jointly generate an access authorization ticket and a session key with the authentication server in the foreign domain, and finally use the generated authorization ticket to apply for the authentication of the resource side. After the resource end verifies that the user's identity is legal, secure communication with the user is realized. The disadvantage of this method is that since the client performs four interactive communications during the authentication process, operations such as authorization tickets, session keys, and signature encryption are required before communication, resulting in the computational load and communication costs carried by the client. It is not suitable for lightweight mobile user terminals with limited resources.

SUMMARY OF THE INVENTION

The purpose of the present invention is to propose a cross-domain authentication method for servers based on trust alliance blockchain, aiming at the above-mentioned deficiencies of the prior art. cross-domain authentication and secure and efficient re-authentication.

The idea of realizing the purpose of the present invention is as follows: the certificate server in the public key infrastructure PKI domain and the domain proxy server in the identity-based cryptosystem IBC domain are used as nodes to construct a trust alliance blockchain; all nodes in the trust alliance blockchain are used as nodes. The certificate of the server and the certificate of the legal user in the PKI domain of the public key infrastructure are stored in the trust alliance blockchain, and the mutual authentication between the nodes in the alliance trust model is used to realize the mutual authentication between the domains; Domain authentication, the information of successful authentication is written into the trust alliance blockchain as the authentication credential, and the authentication credential is used to realize fast re-authentication.

The concrete steps of the present invention are as follows:

(1) Build a trust alliance blockchain:

(1a) Set the number of public key infrastructure PKI domains and identity-based cryptosystem IBC domains respectively according to the number of node servers in the trust alliance that the blockchain communication capability can accommodate;

(1b) Use the certificate server in each public key infrastructure PKI domain and the domain proxy server in each identity-based cryptography IBC domain as the node server of the trust alliance blockchain;

(1c) The certificate server in the public key infrastructure PKI domain issues certificates for the domain proxy server in the identity-based cryptography IBC domain;

(1d) Select a hash function according to the size of the certificate, and generate the hash value of the certificate;

(1e) Take the hash value of the certificate as the first block and save it in the block to obtain the trust alliance blockchain;

(2) Authentication of the identity of the user accessing the server in the public key infrastructure PKI domain:

(2a) The user requesting access in the IBC domain of the identity-based cryptosystem uses its own private key and the SM9 signature algorithm of the domestic identification password to calculate the signature authentication application generated by its own identification ID, and send the signature authentication application to the proxy server in the domain. ;

(2b) The domain proxy server in the identity-based cryptosystem IBC domain verifies whether the identity of the user requesting access is legal, if so, execute step (2c), otherwise, execute step (2f);

(2c) judge whether the certificate server in the public key infrastructure PKI domain and the identity-based cryptosystem IBC domain proxy server satisfy the mutual trust condition, if so, execute step (2d), otherwise execute step (2f);

(2d) Use the method of issuing temporary identities to construct the secure communication between the user request server and the visiting user in the public key infrastructure PKI domain;

(2e) The certificate server in the PKI domain of the public key infrastructure stores the authentication credentials by writing the authentication credentials into the trust alliance blockchain;

(2f) end the certification;

(3) Authentication of the identity of the user accessing the server in the IBC domain of the identity-based cryptosystem:

(3a) The user requesting access in the PKI domain of the public key infrastructure sends an authentication application to the certificate server;

(3b) The public key infrastructure PKI domain certificate server, query the certificate status of the visiting user on the trust alliance blockchain, if the certificate status is declared, execute step (3c), if the certificate status is revoked, execute step (3f) ;

(3c) judge whether the certificate server in the public key infrastructure PKI domain and the identity-based cryptosystem IBC domain proxy server satisfy the mutual trust condition, if so, execute step (3d), otherwise execute step (3f);

(3d) Use the method of issuing temporary certificates to construct secure communication between users accessing servers and requesting access users in the public key infrastructure PKI domain;

(3e) The identity-based cryptographic system IBC domain proxy server adopts the method of writing the authentication credentials into the trust alliance blockchain to store the authentication credentials;

(3f) end the certification;

(4) Set the valid time of the authentication certificate:

(4a) According to the security level of the user's server in the public key infrastructure PKI domain, the authentication credential stored on the trust alliance blockchain is used as the valid time corresponding to the security level;

(4b) According to the security level of the user's server in the IBC domain of the identity-based cryptosystem, the authentication credential stored on the trust alliance blockchain is used as the valid time corresponding to the security level;

(5) Re-authenticate the identity of the user accessing the server in the PKI domain of the public key infrastructure;

(5a) Other users in the IBC domain of the identity-based cryptosystem send identity signature applications and access applications to the domain proxy server;

(5b) judge whether the certificate server in the public key infrastructure PKI domain and the identity-based cryptosystem IBC domain proxy server satisfy the mutual trust condition, if so, execute (5c), otherwise, execute step (5g);

(5c) The identity-based cryptosystem IBC domain proxy server uses the identity information ID of the user access server in the public key infrastructure PKI domain to generate authentication credentials;

(5d) The IBC domain proxy server of the identity-based cryptography system queries the authentication credential on the trust alliance blockchain. If the authentication credential is queried and the authentication credential is within the valid time, the access is allowed, and step (5g) is executed, Otherwise, go to step (5e);

(5e) Use the method of issuing temporary identities to construct the secure communication between the user access server and the access user in the public key infrastructure PKI domain;

(5f) The certificate server in the PKI domain of the public key infrastructure stores the authentication credentials by writing the authentication credentials into the trust alliance blockchain;

(5g) end the certification;

(6) Re-authenticate the identity of the user accessing the server in the IBC domain of the identity-based cryptosystem:

(6a) Other users in the public key infrastructure PKI domain send access requests to the certificate server;

(6b) judge whether the certificate server in the public key infrastructure PKI domain and the identity-based cryptosystem IBC domain proxy server satisfy the mutual trust condition, if so, execute (6c), otherwise execute step (6g);

(6c) The certificate server in the public key infrastructure PKI domain, using the identity information ID of the user access server in the cryptographic system IBC domain, to generate the authentication certificate;

(6d) The certificate server in the PKI domain of the public key infrastructure queries the authentication credential on the trust alliance blockchain. If the authentication credential is queried, and the authentication credential is within the valid time, the access is allowed, otherwise, execute (6e):

(6e) Use the method of issuing temporary certificates to construct an identity-based cryptosystem for secure communication between users accessing the server and accessing users in the IBC domain;

(6f) An identity-based cryptographic system IBC domain proxy server, which uses the method of writing the authentication credentials into the trust alliance blockchain to store the authentication credentials;

(6g) End authentication.

Compared with the prior art, the present invention has the following advantages:

First, since the present invention builds a consortium trust blockchain, and realizes inter-domain mutual authentication through mutual trust between nodes in the consortium trust blockchain, it overcomes the maintenance burden caused by the need to maintain trust in the bridge center system in the prior art. The added problem makes the present invention have the advantages of better practicability and scalability in the server cross-domain authentication method.

Second, since the present invention saves the authentication credential of the user accessing the server, the node server in the consortium trust blockchain queries the authentication credential of the user accessing the server to realize re-authentication, which overcomes the need to access the same server multiple times in the prior art, resulting in repeated authentication. The problem of increased computing and communication burden on the node server makes the present invention have the advantage of faster efficiency in the server cross-domain authentication method.

Third, since the present invention builds a consortium trust blockchain, and realizes inter-domain mutual authentication through mutual trust among nodes in the consortium trust blockchain, it overcomes the need to perform inter-domain identity authentication on visiting users in the prior art, which leads to access problems. The problem that the user end bears a large computational and communication burden makes the present invention more suitable for mainstream mobile user terminals with limited resources in the server cross-domain authentication method.

Description of drawings

Figure 1 is a flow chart of the present invention.

Detailed ways

The present invention will be further described below in conjunction with FIG. 1 .

Step 1, build a trust alliance blockchain.

According to the number of node servers in the trust alliance that the blockchain communication capability can accommodate, the number of public key infrastructure PKI domains and identity-based cryptosystem IBC domains are set respectively.

The certificate server in each public key infrastructure PKI domain and the domain proxy server in each identity-based cryptography IBC domain are used as node servers for trusting the consortium blockchain.

The certificate server in the public key infrastructure PKI domain issues certificates for the domain proxy server in the identity-based cryptography IBC domain.

Select a hash function based on the size of the certificate to generate the hash value of the certificate.

The hash value of the certificate is taken as the first block and stored in the block to obtain the trust alliance blockchain.

Step 2: Authenticate the identity of the user accessing the server in the PKI domain of the public key infrastructure.

The user requesting access in the IBC domain of the identity-based cryptosystem uses its own private key and the SM9 signature algorithm of the domestic identification password to calculate the signature authentication application generated by its own identification ID, and send the signature authentication application to the proxy server in the domain.

The domain proxy server in the IBC domain of the identity-based cryptosystem verifies whether the identity of the user requesting access is legal, and if so, judges whether the certificate server in the public key infrastructure PKI domain and the proxy server in the IBC domain of the identity-based cryptosystem meet the mutual trust conditions , otherwise, the authentication ends.

For the public key of the user requesting access, the signature authentication application is verified by the domestic identification password SM9 signature verification algorithm, and the signature authentication application that has passed the verification is a legitimate user.

Determine whether the certificate server in the PKI domain and the proxy server in the IBC domain of the identity-based cryptosystem meet the mutual trust conditions. If so, use the method of issuing a temporary identity to construct the user request server and access to the public key infrastructure PKI domain. User's secure communication, otherwise authentication fails.

The mutual trust condition refers to a situation where both of the following conditions are satisfied simultaneously:

Condition 1, the public key infrastructure PKI domain certificate server queries the certificate of the domain proxy server in the identity-based cryptosystem IBC domain on the trust alliance blockchain, and the certificate status is declared;

Condition 2, the domain proxy server in the IBC domain of the identity-based cryptography system queries the certificate of the public key infrastructure PKI domain certificate server on the trust alliance blockchain, and the certificate status is declared.

The certificate server in the public key infrastructure PKI domain stores the authentication credentials by writing the authentication credentials into the trust consortium blockchain.

The specific steps of the method for issuing a temporary identity are as follows:

Step 1, the domain proxy server in the IBC domain of the identity-based cryptosystem generates the temporary identity information of the user access server in the public key infrastructure PKI domain, and sends the temporary identity information to the public key infrastructure PKI domain certificate server;

Step 2, the certificate server in the public key infrastructure PKI domain forwards the temporary identity information to the server accessed by the user;

In the third step, the server providing the service in the public key infrastructure PKI domain saves the temporary identity information, and uses the temporary identity information to securely communicate with the user requesting the service in the identity-based cryptography IBC domain.

The specific steps of the method for writing the authentication credential into the trust alliance blockchain are as follows:

Step 1, the node server in the trust alliance blockchain will successfully authenticate the identity information ID of the user to access the server to generate an authentication certificate;

In the second step, the node server in the trust alliance blockchain selects the hash function according to the size of the authentication certificate, uses the hash operation to generate the hash value of the authentication certificate, and writes the hash value into the blockchain.

End authentication.

Step 3, authenticate the identity of the user accessing the server in the identity-based cryptography IBC domain.

A user who requests access in the PKI domain of the public key infrastructure sends an authentication request to the certificate server.

The certificate server in the public key infrastructure PKI domain queries the certificate status of the visiting user on the trust alliance blockchain. If the certificate status is declared, it determines the certificate server in the public key infrastructure PKI domain and the proxy server in the identity-based cryptosystem IBC domain domain. Whether the mutual trust conditions are met, and if the certificate status is revoked, the authentication ends.

Determine whether the certificate server in the public key infrastructure PKI domain and the proxy server in the IBC domain of the identity-based cryptosystem meet the mutual trust conditions. Access the user's secure communication, otherwise end the authentication.

The mutual trust condition refers to a situation where both of the following conditions are satisfied simultaneously:

Condition 1, the public key infrastructure PKI domain certificate server queries the certificate of the domain proxy server in the identity-based cryptosystem IBC domain on the trust alliance blockchain, and the certificate status is declared;

Condition 2, the domain proxy server in the IBC domain of the identity-based cryptography system queries the certificate of the public key infrastructure PKI domain certificate server on the trust alliance blockchain, and the certificate status is declared.

The specific steps of the method for issuing a temporary certificate are as follows:

Step 1, the public key infrastructure PKI domain certificate server generates a temporary certificate for the user access server in the identity-based cryptosystem IBC domain, and sends the temporary certificate to the identity-based cryptosystem IBC domain domain proxy server;

Step 2: In the identity-based cryptosystem IBC domain, the domain proxy server forwards the temporary certificate to the user access server;

Step 3: In the identity-based cryptosystem IBC domain, the user accesses the server to save the temporary certificate, and uses the identity information in the temporary certificate to communicate securely with the requesting service user in the public key infrastructure PKI domain.

The identity-based cryptosystem IBC domain proxy server uses the method of writing the authentication credentials into the trust alliance blockchain to store the authentication credentials.

The specific steps of the method for writing the authentication credential into the trust alliance blockchain are as follows:

Step 1, the node server in the trust alliance blockchain will successfully authenticate the identity information ID of the user to access the server to generate an authentication certificate;

In the second step, the node server in the trust alliance blockchain selects the hash function according to the size of the authentication certificate, uses the hash operation to generate the hash value of the authentication certificate, and writes the hash value into the blockchain.

End authentication.

Step 4: Set the valid time of the authentication credential.

According to the security level of the user's server in the public key infrastructure PKI domain, the authentication credential stored on the trust alliance blockchain is used as the valid time corresponding to the security level.

According to the security level of the user's server in the IBC domain of the identity-based cryptosystem, the authentication credential stored in the trust alliance blockchain is used as the valid time corresponding to the security level.

Step 5, re-authenticate the identity of the user accessing the server in the public key infrastructure PKI domain;

Other users in the IBC domain of the identity-based cryptosystem send identity signature requests and access requests to the domain proxy server.

Determine whether the certificate server in the PKI domain and the proxy server in the IBC domain of the identity-based cryptosystem meet the mutual trust conditions. ID of the server's identity information to generate authentication credentials, otherwise, end the authentication.

The mutual trust condition refers to a situation where both of the following conditions are satisfied simultaneously:

Condition 1, the public key infrastructure PKI domain certificate server queries the certificate of the domain proxy server in the identity-based cryptosystem IBC domain on the trust alliance blockchain, and the certificate status is declared;

Condition 2, the domain proxy server in the IBC domain of the identity-based cryptography system queries the certificate of the public key infrastructure PKI domain certificate server on the trust alliance blockchain, and the certificate status is declared.

Identity-based cryptographic system IBC domain domain proxy server queries the authentication certificate on the trust alliance blockchain. If the authentication certificate is queried and the authentication certificate is within the valid time, the access is allowed and the authentication is over. Otherwise, the temporary identity issued The method constructs the secure communication between the user access server and the access user in the public key infrastructure PKI domain.

The specific steps of the method for issuing a temporary identity are as follows:

Step 1: The proxy server in the IBC domain of the identity-based cryptosystem generates the temporary identity information of the user access server in the PKI domain of the public key infrastructure, and sends the temporary identity information to the certificate server in the PKI domain of the public key infrastructure;

Step 2, the certificate server in the public key infrastructure PKI domain forwards the temporary identity information to the server accessed by the user;

In the third step, the server providing the service in the public key infrastructure PKI domain saves the temporary identity information, and uses the temporary identity information to securely communicate with the user requesting the service in the identity-based cryptography IBC domain.

The certificate server in the public key infrastructure PKI domain stores the authentication credentials by writing the authentication credentials into the trust consortium blockchain.

The specific steps of the method for writing the authentication credential into the trust alliance blockchain are as follows:

Step 1, the node server in the trust alliance blockchain will successfully authenticate the identity information ID of the user to access the server to generate an authentication certificate;

In the second step, the node server in the trust alliance blockchain selects the hash function according to the size of the authentication certificate, uses the hash operation to generate the hash value of the authentication certificate, and writes the hash value into the blockchain.

End authentication.

Step 6, re-authenticate the identity of the user accessing the server in the identity-based cryptography IBC domain.

Other users in the public key infrastructure PKI domain, send access requests to the certificate server.

Determine whether the certificate server in the PKI domain and the proxy server in the IBC domain of the identity-based cryptosystem meet the mutual trust conditions. The identification information ID is used to generate an authentication credential; otherwise, the authentication is terminated.

The mutual trust condition refers to a situation where both of the following conditions are satisfied simultaneously:

Condition 1, the public key infrastructure PKI domain certificate server queries the certificate of the domain proxy server in the identity-based cryptosystem IBC domain on the trust alliance blockchain, and the certificate status is declared;

Condition 2, the domain proxy server in the IBC domain of the identity-based cryptography system queries the certificate of the public key infrastructure PKI domain certificate server on the trust alliance blockchain, and the certificate status is declared.

The certificate server in the PKI domain of the public key infrastructure queries the authentication certificate on the trust alliance blockchain. If the authentication certificate is queried and the authentication certificate is within the valid time, the access is allowed and the authentication is over. Otherwise, the method of issuing a temporary certificate is adopted. , to build an identity-based cryptosystem for secure communication between users accessing the server and accessing users in the IBC domain.

The specific steps of the method for issuing a temporary certificate are as follows:

Step 1, the public key infrastructure PKI domain certificate server generates a temporary certificate for the user access server in the identity-based cryptosystem IBC domain, and sends the temporary certificate to the identity-based cryptosystem IBC domain domain proxy server;

Step 2: In the identity-based cryptosystem IBC domain, the domain proxy server forwards the temporary certificate to the user access server;

Step 3: In the identity-based cryptosystem IBC domain, the user accesses the server to save the temporary certificate, and uses the identity information in the temporary certificate to communicate securely with the requesting service user in the public key infrastructure PKI domain.

The identity-based cryptosystem IBC domain proxy server uses the method of writing the authentication credentials into the trust alliance blockchain to store the authentication credentials.

The specific steps of the method for writing the authentication credential into the trust alliance blockchain are as follows:

Step 1, the node server in the trust alliance blockchain will successfully authenticate the identity information ID of the user to access the server to generate an authentication certificate;

In the second step, the node server in the trust alliance blockchain selects the hash function according to the size of the authentication certificate, uses the hash operation to generate the hash value of the authentication certificate, and writes the hash value into the blockchain.

End authentication.

Claims (5)

1. A cross-domain server identity authentication method based on trust consortium blockchain, characterized in that building a trust consortium blockchain, and validating the certificates of all node servers in the trust consortium blockchain and the public key infrastructure PKI domain. The user's certificate is stored in the trust consortium blockchain, and the trust consortium blockchain is used to realize cross-domain authentication of the server identity. The successful authentication information is used as the authentication credential, which is saved in the trust consortium blockchain, and the authentication credential is used to realize re-authentication ; The concrete steps of the method include the following: (1) Build a trust alliance blockchain: (1a) Set the number of public key infrastructure PKI domains and identity-based cryptosystem IBC domains respectively according to the number of node servers in the trust alliance that the blockchain communication capability can accommodate; (1b) Use the certificate server in each public key infrastructure PKI domain and the domain proxy server in each identity-based cryptography IBC domain as the node server of the trust alliance blockchain; (1c) The certificate server in the public key infrastructure PKI domain issues certificates for the domain proxy server in the identity-based cryptography IBC domain; (1d) Select a hash function according to the size of the certificate, and generate the hash value of the certificate; (1e) Take the hash value of the certificate as the first block and save it in the block to obtain the trust alliance blockchain; (2) Authentication of the identity of the user accessing the server in the public key infrastructure PKI domain: (2a) The user requesting access in the IBC domain of the identity-based cryptography system uses its own private key and the domestic identification password SM9 signature algorithm to calculate and generate a signature authentication application for its own identity ID, and send the signature authentication application to the domain proxy server; (2b) The domain proxy server in the identity-based cryptosystem IBC domain verifies whether the identity of the user requesting access is legal, if so, execute step (2c), otherwise, execute step (2f); (2c) judge whether the certificate server in the public key infrastructure PKI domain and the domain proxy server in the identity-based cryptosystem IBC domain satisfy the mutual trust condition, if so, execute step (2d), otherwise, execute step (2f); (2d) Use the method of issuing temporary identities to construct the secure communication between the user request server and the visiting user in the public key infrastructure PKI domain; (2e) The certificate server in the PKI domain of the public key infrastructure stores the authentication credentials by writing the authentication credentials into the trust alliance blockchain; (2f) end the certification; (3) Authentication of the identity of the user accessing the server in the IBC domain of the identity-based cryptosystem: (3a) The user requesting access in the PKI domain of the public key infrastructure sends an authentication application to the certificate server; (3b) The certificate server in the public key infrastructure PKI domain queries the certificate status of the visiting user on the trust alliance blockchain, and if the certificate status is declared, execute step (3c), and if the certificate status is revoked, execute step ( 3f); (3c) judge whether the certificate server in the public key infrastructure PKI domain and the domain proxy server in the identity-based cryptosystem IBC domain satisfy the mutual trust condition, if so, execute step (3d), otherwise execute step (3f); (3d) Use the method of issuing temporary certificates to construct secure communication between users accessing servers and requesting access users in the public key infrastructure PKI domain; (3e) The domain proxy server in the IBC domain of the identity-based cryptosystem adopts the method of writing the authentication credentials into the trust alliance blockchain to store the authentication credentials; (3f) end the certification; (4) Set the valid time of the authentication certificate: (4a) According to the security level of the user accessing the server in the public key infrastructure PKI domain, the valid time of the authentication certificate stored on the trust alliance blockchain is correspondingly set; (4b) According to the security level of the user accessing the server in the IBC domain of the identity-based cryptosystem, the valid time of the authentication certificate stored on the trust alliance blockchain is correspondingly set; (5) Re-authenticate the identity of the user accessing the server in the PKI domain of the public key infrastructure; (5a) Other users in the IBC domain of the identity-based cryptosystem send identity signature applications and access applications to the domain proxy server; (5b) judge whether the certificate server in the public key infrastructure PKI domain and the domain proxy server in the identity-based cryptosystem IBC domain satisfy the mutual trust condition, if so, execute step (5c), otherwise, execute step (5g); (5c) The domain proxy server in the IBC domain of the identity-based cryptosystem uses the identity information ID of the user access server in the public key infrastructure PKI domain to generate authentication credentials; (5d) The domain proxy server in the IBC domain of the identity-based cryptography system queries the authentication credential on the trust alliance blockchain. If the authentication credential is queried and the authentication credential is within the valid time, the access is allowed, and the step (5g) is executed. ), otherwise go to step (5e); (5e) Use the method of issuing temporary identities to construct the secure communication between the user access server and the access user in the public key infrastructure PKI domain; (5f) The certificate server in the PKI domain of the public key infrastructure stores the authentication credentials by writing the authentication credentials into the trust alliance blockchain; (5g) end the certification; (6) Re-authenticate the identity of the user accessing the server in the IBC domain of the identity-based cryptosystem: (6a) Other users in the public key infrastructure PKI domain send access requests to the certificate server; (6b) Determine whether the certificate server in the public key infrastructure PKI domain and the domain proxy server in the identity-based cryptosystem IBC domain satisfy the mutual trust condition, if so, allow this access, and execute step (6c), otherwise, execute step (6g); (6c) The certificate server in the public key infrastructure PKI domain uses the identity information ID of the user access server in the cryptographic system IBC domain to generate authentication credentials; (6d) The certificate server in the PKI domain of the public key infrastructure queries the authentication credential on the trust alliance blockchain. If the authentication credential is queried and the authentication credential is within the valid time, the access is allowed, otherwise, step (6e) is performed. : (6e) Use the method of issuing temporary certificates to construct an identity-based cryptosystem for secure communication between users accessing the server and accessing users in the IBC domain; (6f) The domain proxy server in the IBC domain of the identity-based cryptosystem adopts the method of writing the authentication credentials into the trust alliance blockchain to store the authentication credentials; (6g) end the certification; The specific steps of the method for writing the authentication credential into the trust alliance blockchain described in step (2e), step (3e), step (5f) and step (6f) are as follows: The first step, the node server in the trust alliance blockchain will successfully authenticate the identity information ID of the user to access the server to generate an authentication certificate; In the second step, the node server in the trust alliance blockchain selects the hash function according to the size of the authentication certificate, uses the hash operation to generate the hash value of the authentication certificate, and writes the hash value into the blockchain. 2. the cross-domain server identity authentication method based on trust alliance block chain according to claim 1, is characterized in that, the user identity legality described in step (2b) refers to, utilizes the public key of the user who requests access, The signature verification application is verified by the domestic identification password SM9 signature verification algorithm, and the signature verification application that has passed the verification is a legitimate user identity. 3. The cross-domain server identity authentication method based on trust consortium blockchain according to claim 1, characterized in that, described in step (2c), step (3c), step (5b) and step (6b) Mutual trust conditions refer to situations where both of the following conditions are met: Condition 1, the certificate server in the public key infrastructure PKI domain queries the certificate of the domain proxy server in the identity-based cryptosystem IBC domain on the trust alliance blockchain, and the certificate status is declared; Condition 2, the domain proxy server in the IBC domain of the identity-based cryptosystem queries the certificate of the certificate server in the public key infrastructure PKI domain on the trust alliance blockchain, and the certificate status is declared. 4. the cross-domain server identity authentication method based on trust alliance block chain according to claim 1, is characterized in that, the concrete steps of the method for issuing temporary identity described in step (2d), step (5e) are as follows: In the first step, the domain proxy server in the IBC domain of the identity-based cryptosystem generates the temporary identity information of the user access server in the public key infrastructure PKI domain, and sends the temporary identity information to the public key infrastructure PKI domain certificate server; In the second step, the certificate server in the PKI domain of the public key infrastructure forwards the temporary identity information to the server accessed by the user; In the third step, the server providing the service in the PKI domain of the public key infrastructure saves the temporary identity information, and uses the temporary identity information to securely communicate with the requesting service user in the IBC domain of the identity-based cryptosystem. 5. the cross-domain server identity authentication method based on trust alliance block chain according to claim 1, is characterized in that, the concrete steps of the method for issuing temporary certificate described in step (3d), step (6e) are as follows: The first step, the certificate server in the public key infrastructure PKI domain, generates a temporary certificate for the user access server in the identity-based cryptography IBC domain, and sends the temporary certificate to the domain proxy server in the identity-based cryptography IBC domain; In the second step, in the identity-based cryptosystem IBC domain, the domain proxy server forwards the temporary certificate to the user access server; In the third step, in the identity-based cryptosystem IBC domain, the user accesses the server to save the temporary certificate, and uses the identity information in the temporary certificate to communicate securely with the requesting service user in the public key infrastructure PKI domain.