Disclosure of Invention
The invention aims to solve the problems of the prior art, and provides a hardware module identification method based on a blockchain technology, so as to solve the technical problems of the identity identification method of the existing hardware chip module and the uniqueness, the safety and the verifiability of the identity identification method.
The above purpose is realized by the following technical scheme:
A hardware module identification method based on a blockchain technology comprises the following steps:
based on the module chip ID and the custom random number rule, generating a seed random number by a random number generator;
carrying out hash calculation on the seed random number to obtain a private key, and calculating the private key through an asymmetric encryption algorithm to obtain a public key;
Hash calculation is carried out on the public key to obtain a Hash1, the first 20 bytes of the Hash1 are intercepted and recorded as a Hash2, DID type bytes are added before the Hash2 to generate a Hash3, hash calculation is carried out on the Hash3 to obtain a Hash4, base58 coding is carried out on the Hash4 to obtain a DID, and the DID is used as a unique DID identifier of a hardware module.
Further, the unique DID identification of the hardware module is stored in a flash of the device, and the unique DID identification of the hardware module and a DID document containing detailed information of the DID are subjected to uplink consensus through a blockchain.
Further, the DID verification comprises a module management platform, a hardware module and equipment;
the module management platform is used as an issuer of a VC certificate, and performs digital signature on the DID document of the hardware module to prove the authenticity of the DID attribute of the hardware module;
The hardware module is used as a holder of the VC certificate, and is used for signing the verification of the VC certificate and sending the VP obtained after signing to the equipment;
The device is used as a verifier for verifying the integrity and the source of the received VP, and after passing verification and confirming the identity security of the module, the device transmits data.
Further, the module chip ID is a unique identifier on the module chip, and is used to distinguish between different module chips, so as to ensure that each module chip has a unique identity.
Further, the hash calculation adopts a Sha-512 algorithm.
Further, the asymmetric encryption algorithm adopts Secp k1 elliptic curve algorithm.
Further, the DID format is as follows:
did:<example>:<identifier>
Wherein the DID is fixed, identifying this is a DID identifier, < sample > specifies the resolution method of the DID, < identifier > represents a unique identifier that distinguishes between different DIDIs and remains unique in the context of the corresponding method.
The hardware module identification method based on the blockchain technology can effectively solve the problems that the identity identification method of the existing hardware chip module cannot identify identity, safety authentication and the like, and can provide basic guarantee for safety communication among devices.
Detailed Description
The invention is described in further detail below with reference to the drawings and examples. The described embodiments are only some, but not all, embodiments of the invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
As shown in fig. 1, a hardware module identification method based on a blockchain technology includes:
Step (1) seed generation is based on a module chip ID and a custom random number rule, and a seed random number is generated through a random number generator;
In particular, in computer science and programming, seed is commonly used for random number generators to ensure repeatability and predictability of random number sequences (given the same seed), which is an initial value that is used by the random number generator to generate a series of random numbers.
It should be noted that, in this embodiment, the module chip ID is a unique identifier on the module chip, which is used to distinguish between different module chips, and ensure that each module chip has a unique identity, and is usually designed by the manufacturer, and includes some basic information about the chip, such as the manufacturer, the type of chip, the date of production, etc., and is an identifier (for example, a chip model or serial number) that is physically embedded in the chip during the chip manufacturing process, and is unique in any case and not allowed to be modified. For the internal ID of the chip in the embedded system, the internal ID is usually stored in a specified memory address of the chip, and different memory addresses of the chip are different, so that the specific memory address can be read according to a chip manual to obtain the chip ID.
Generating a public and private key, carrying out hash calculation on the seed random number to obtain a private key, and calculating the private key through an asymmetric encryption algorithm to obtain a public key;
specifically, since the private key cannot be disclosed externally, the custom rule for generating Seed needs to ensure randomness and be difficult to crack. The public key is disclosed externally, the public key is obtained by calculation from the private key according to an asymmetric encryption algorithm, and a third party can verify the signature and other operations by using the public key.
And (3) generating a DID, carrying out Hash calculation on the public key to obtain a Hash1, intercepting the first 20 bytes of the Hash1, recording the obtained Hash1 as a Hash2, adding a DID type byte before the Hash2 to generate a Hash3, carrying out Hash calculation on the Hash3 to obtain a Hash4, carrying out Base58 coding on the Hash4 to obtain a DID, and taking the DID as a unique DID identifier of a hardware module.
Specifically, the embodiment uses the public key to generate the unique DID identifier of the hardware module, so that the module can be verified independently of any centralized entity, authority or third party. The security of the public key can be further enhanced by performing hash computation on the public key for a plurality of times. By applying the SHA-512 algorithm for multiple times, the difficulty of recovering the original data by an attacker through brute force cracking or collision attack can be increased, so that the safety of the data is improved.
In the scheme, the unique DID identification of the hardware module is generated based on an asymmetric encryption algorithm and a hash algorithm, and the unique DID identification is specifically:
The hash algorithm used is an algorithm that converts input data of arbitrary length into fixed-length output. Even a slight change in the input data of the hash algorithm causes a significant change in the output data, and thus the data output by the hash algorithm has uniqueness. Furthermore, the length of the output of the hash algorithm is fixed. Most importantly, the hash algorithm has irreversibility, namely the original data cannot be reversely deduced through the hash value, so that the security and the irreversibility of the unique DID are ensured.
In this embodiment, the hash computation uses the Sha-512 algorithm, which can generate a 512-bit hash value, typically represented as a string of 128-character hexadecimal digits. The SHA-512 process on the public key is typically performed to obtain a fingerprint (fingerprint) of the public key, which can be used to identify and verify the uniqueness of the public key.
The asymmetric encryption algorithm employed is an important cryptographic tool that uses a pair of related keys, the public key and the private key, as compared to the symmetric encryption algorithm. There is a special mathematical relationship between these two keys, the public key can be used to encrypt the data, and the private key can be used to decrypt the data.
In this embodiment, the asymmetric encryption algorithm uses Secp k1 elliptic curve algorithm for public key generation.
In the embodiment, the unique DID identifier of the hardware module is stored in the flash of the device, and the unique DID identifier of the hardware module and the DID document containing the detailed information of the DID are uplink consensus through the blockchain.
Wherein, the DID format is as follows:
did:<example>:<identifier>
Wherein the DID is fixed, identifying this is a DID identifier, < sample > specifies the resolution method of the DID, < identifier > represents a unique identifier that distinguishes between different DIDIs and remains unique in the context of the corresponding method.
And the DID document is a detailed description of the DID, after the DID document is generated, the DID and the DID document are uploaded to a blockchain for verification, and after the uploading is successful, all people can inquire the DID and the DID document.
As a specific embodiment of the DID document in this aspect, the DID document is exemplified as follows:
{
the/DID document format and field specification address
"@context": "https://w3id.org/did/v1",
"DID", globally unique
"id": "DID:module:7f8ca8982f6cc6e8ea087bd9457ab8024bd2",
The first creation of a 1 for the version number, and subsequent updates or deletions are added with 1 based on the previous operation
"version": 1,
Type of operation, create, update, delete
"operation": "create",
Time of creation
"created": "2023-02-02 16:02:20",
Time of update
"updated": "2023-02-03 16:02:20",
Public key information of main/standby
"publicKey": [
{
/(Public key ID)
"id": "DID:module:7f8ca8982f6cc6e8ea087bd9457ab8024bd2#keys-1",
Type of/(generated public key)
"type": "Secp256k1",
Public key
"publicKeyHex": "02b97c30de767f084ce3080168ee293053ba33b235d7116a3263d29f1450936b71"
},
{
"id": "DID:module:7f8ca8982f6cc6e8ea087bd9457ab8024bd2#keys-2",
"type": "Secp256k1",
"publicKeyHex": "e3080168ee293053ba33b235d7116a3263d29f1450936b71"
}
],
Public key ID used by the holder
"authentication": "DID:module:7f8ca8982f6cc6e8ea087bd9457ab8024bd2#key-1",
Ultrami public key ID usable for reset
"recovery": [
"DID:module:7f8ca8982f6cc6e8ead9457ab8024bd2#key-2"
],
Signing document using private key corresponding to public key ID of authentication field (signatureValue field excluded)
"signatureValue": "02b97c30de767f084ce3080168ee293053ba33b235d7116a3263d29f1450936b71qwe"
}
As a specific embodiment of the scheme, it is assumed that there is a hardware module whose CPU chip ID is 0x0F8BFBFF00050657, and if there is a hardware random number generator, the 64-bit value generated is read as a random number (if there is no, the time elapsed since the system was started up is the lower 32 bits according to the current period time as the upper 32 bits), and the read value is 0x0768BB4EAD2C139F. The two numbers are then concatenated as a 16 byte sequence, i.e. a 128bits number, which is the Seed. Inputting the private key sk into the SHA512 hash function, and calculating the private key sk:
sk=sha512 (0 x0F8BFBFF00050657 |0 x0768BB4EAD2C139 f|0 x 00000000) =
5daea052dcc51832f4cd2b23a85b7348c4b3e175c1d0647dcbd417b8e4f81ad61ff454eb0faef275f7f29e34d4a1b61f60f6c6734b4abf3d8b058174ccd74cef
Note that (1) the symbol indicates that two numbers are concatenated in a byte sequence from high significant bits to low significant bits to form a new one
Byte sequence of (a). For the example herein, even if one input byte sequence is formed:
0F 8B FB FF 00 05 06 57 07 68 BB 4E AD 2C 13 9F 00 00 00 00
(2) The last 4 bytes in the input are the calculation iteration factors, avoiding the calculation result as part of the private key
When the non-0 and within the limits of the defined domain requirements of the encryption algorithm are not met, add 1 to it, recalculate,
Until the requirements are met.
The result of the calculations given above is 128 16 bins, 512 bits, arranged from low byte to high byte.
Taking its lower 256bits as its private key sk, i.e. 64 16 digits starting from the left hand side of the number, i.e.
sk = 5daea052dcc51832f4cd2b23a85b7348c4b3e175c1d0647dcbd417b8e4f81ad6
Based on the private key sk, the public key pk is calculated based on the SECP256k1 algorithm:
Then pk= DerivePublicKey (sk) =
038D66ADC909AE996F9B4EB39C6A5DB02C62F9B79F27D222EBA08294A5DF1373FB
The DID is calculated from the public key pk, steps and results are as follows:
(1) Hash1 = SHA512(pk) =
0fd7c6cf703ff4b54e384df4e75d9270afb10524783d1e1d7d1750bbdfd85548b0195d470f18f859af78f3a47006a57ccb9e67acbbea0ef490e8a38d292e1aaf
(2) Hash2 = Hash1[0 .. 19] = 0fd7c6cf703ff4b54e384df4e75d9270afb10524
Note [.] indicates that a value in a certain range of its byte sequence is taken, numbered from left to right, starting from 0
(3) Hash 3=did type byte (02) |hash 2=020 fd7c6cf703ff4b54e384df4e75d9270afb10524
Note that the DID type byte is used to describe the value of the DID type, which can be any value, here we assume it is 02
(4) Hash4 = SHA512(Hash3) =
49892d7883cbd56618a1ff84dad51cd4718e038eb2a0db1d7739f41f587bbcf8a2a8e6e0b6637f8bc2e7c069af3557aa55e39abb28ac86893965faf71eb09508
(5) DID = Base58(Hash4) =
wczewgmX3G8oMWjLFQ8MzbNspeD9KML49j2XrazVNRn9Ze9iHKPnRZi8EBcoQqN65xqsEaCkNogGBVq58Jored98zosba。
As shown in fig. 2, the present solution also provides DID verification, including a module management platform, a hardware module, and a device;
The module management platform is used as an issuer of VC (Verifiable Credential) certificates, and is used for digitally signing the DID document of the hardware module to prove the authenticity of the DID attribute of the hardware module;
The hardware module is used as a holder of VC (Verifiable Credential) certificates and is used for signing the verification of the VC (Verifiable Credential) certificates and sending VP (Verifiable Presentation) obtained after signing to the equipment;
The device is used as a verifier for verifying the integrity and the source of the received VP (Verifiable Presentation), and after passing verification and confirming the identity security of the module, the device transmits data. The device is an embedded device.
The above description is for the purpose of illustrating the embodiments of the present invention and is not to be construed as limiting the invention, but is intended to cover all modifications, equivalents, improvements and alternatives falling within the spirit and principle of the invention.