TW201812630A - Block chain identity system - Google Patents

Abstract

A block chain identity system, comprising a client terminal and a cloud terminal, the client terminal being composed of a radio frequency reading module, a computing platform, a touch screen module, a communication module, and a smart identity card, and the cloud terminal being composed of a block chain multi-node network, the block chain multi-node network comprising a data block chain and a multi-node network, the multi-node network being responsible for coordinating with the client terminal to complete an identity generating process and an identity authentication process. The authentication system uses the smart identity card to ensure user identity security, and transmits information to be transmitted after encryption, ensuring that information does not leak during the transmission process, ensuring the effectiveness of two-step authentication, and preventing unnecessary attacks during the authentication process.

Description

Blockchain identity system

The invention relates to identity generation and authentication on the Internet, a blockchain identity system.

In the Internet, blockchain identities need to be issued in the form of network data. Unlike traditional identities, the generation and authentication of identity pairs on the Internet is more difficult. For currently widely used password-based authentication mechanisms or SMS-based authentication, if a password is leaked or the phone is accidentally lost, other users can also use the terminal for authentication transactions. In addition, in recent years, technologies that combine biometric information (such as fingerprints, irises, etc.) to increase authentication security have begun to appear. However, in the current environment, if biometric information such as fingerprints must be accepted before being authenticated by a third-party system, it is not easy for an ordinary user to accept, and users are likely to worry about personal information. leakage. Therefore, there is a great need for a blockchain identity system with high security, high operability and convenience.

In view of this, the present invention provides a blockchain identity system that solves or partially solves the above problems.

In order to achieve the effect of the above technical solution, the technical solution of the present invention is: a blockchain identity system, which includes a client, a cloud, and the client is a radio frequency reading module, a computing platform, a touch screen module, and a communication module. And smart identity cards. The cloud is composed of a blockchain multi-node network. The blockchain multi-node network includes a data blockchain and a multi-node network. The multi-node network is responsible for coordinating the identity generation with the client. Process and identity authentication process;

The computing platform includes a touch screen controller, a communication controller, and a micro-computing chip;

The touch screen controller is used to control the display of the touch screen module, and sends information to be displayed to the touch screen module;

The communication controller dispatches the interactive communication between the RF reading module, the touch screen module and the communication module by means of serial communication;

A micro-computing chip is used to process information in the identity generation process and the identity authentication process;

The smart ID card contains a chip with built-in integrated circuits. The chip contains a user ID number. The user ID number of each smart ID card is unique and is used to identify the user. The production of equipment is non-copyable hardware. The smart ID card is carried by registered legal users. During authentication, the smart ID card must be scanned into the user ID number read by the RF reader module to verify the user's identity;

The touch screen module uses a five-wire resistive screen and relies on the principle of pressure sensing to display and enter the information required during the identity generation process and the identity authentication process;

The communication module is used to receive and send related information, including a network transmission screening program and a dedicated code chip to achieve communication between the computing platform and the cloud, and to receive and send network data in the form of data frames, and It is also necessary to avoid background noise and interference during reception and transmission. The coding method of the data frame is phase coding, and synchronous clock coding technology is adopted. When transmitting data information, the clock synchronization signal is also transmitted to the other party;

In the blockchain multi-node network in the cloud, the data blockchain in the blockchain multi-node network is composed of a series of data blocks connected in chronological order of creation. In the blockchain multi-node network, Multi-node network is a P2P network composed of multiple nodes. Nodes share and transmit information to each other through the network. The data blockchain is open to all the nodes in the multi-node network. Data blocks It consists of a block header and a block body. The block header contains the hash value of the previous data block, the timestamp, and the hash value of the current data block. The hash value of the previous data block is used for different data blocks. Connection, the timestamp records the current connection time of the current data block, the hash value of the current data block is used to ensure that the content of the data block cannot be tampered with, the block body records the account information of the user identity, and the legal user identity Account information: user name, user identity information, encrypted user password, encrypted user ID number, user public key;

The node contains a pseudo-random number generator;

The identity generation process is as follows:

1) The user enters the user name, user identity information, and user password on the touch screen module, and transmits the user name, user identity information, and user password to the multi-node network. The multi-node network verifies that the user name is in the data area. If the block chain exists, if the user name does not exist, proceed to the next step. If the user name exists, send feedback information to the computing platform via the communication module. The computing platform will process the feedback information and display "on the touch screen module" User exists, re-enter ", the user re-enters the user name on the touch screen module, and the multi-node network re-checks whether the user name exists in the data blockchain;

2) The computing platform verifies whether the user password meets the requirements. If the user password meets the requirements, proceed to the next step. If the user password does not meet the requirements, it is transmitted to the touch screen module, and the "touch screen does not match the user password" is displayed on the touch screen module. Request, re-enter ", the user re-enters the user password on the touch screen module;

3) The multi-node network generates random numbers S1, and the random numbers S1 are encrypted by the IDEA encryption algorithm to generate encrypted random numbers S1, and the encrypted random numbers S1 are broadcast to all nodes in the multi-node network. All nodes use The IDEA decryption algorithm decrypts the encrypted random number S1, and the node that first decrypts the random number S1 is used as the node responsible for building the data blockchain;

4) The node responsible for building the data blockchain assigns a user's public key to the user, and generates a unique identity through the hash algorithm, and the node responsible for building the data blockchain will generate the unique identity Digitally sign to generate a unique user ID number, write the user ID number into the smart identity card, encrypt the user's public key to generate an encrypted user ID number, and save the current time as the time stamp of the current data block. The hash value of the data block generates a hash value of the current data block through a secure hash algorithm, and generates an encrypted user password. The specific process of generating an encrypted user password is: The random number generated by the pseudo random number generator in the node is used as the salt value, the salt value is mixed into the user password, and encrypted using the cryptographic hash function to generate an encrypted user password; the user name, user identity information, encryption The user password, encrypted user ID number, and user public key constitute the account information of the user's identity, which is written into the current account along with the generated salt value. Data block block body;

The pseudo-random number generator works as follows:

The pseudo random number generator is based on the data encryption standard and contains a triple data encryption standard algorithm that can generate random numbers cyclically; the variable i represents the i-th random number generation calculation, which mainly has 3 components:

1) an input portion: an input section is two 64-bit pseudo random number and a Date _i V _i, where, _i denotes a Date date and time at the beginning of the i-th wheel is calculated, for each generated after a random number Ri, Date _i need updated, V _i is the i-th generation seed to enter when using random number, which can be arbitrarily set initial value, it is automatically updated after each round of calculation;

2) Key generator: used for each round of specific calculations. Each round of calculation uses triple data algorithm encryption. Each encryption uses two fixed 56-bit keys K1 and K2. These two The key must be kept secret and specified by a pseudo-random number generator;

3) Output part: The output is a 64-bit pseudo-random number Ri and a 64-bit new seed Vi _{+ 1} ; the pseudo-random number generator has a high security strength because it uses a total of 112 bits in length Key and 3 key-encrypted data algorithm encryption. At the same time, it is driven by two pseudo random number inputs. One of the two pseudo random number inputs is the current date and time, Date _i , and the other is generated in the previous round. seed V _i, each round generated random number Ri, but different round seeds, random number generator are not the same, and therefore, the salt value generated for each user is not the same, the salt value can not be generated by the round Infer the salt value produced in the next round;

The authentication process is as follows:

In the first step, the client sends an authentication request to the cloud, reads the user ID number stored in the smart identity card through the radio frequency reading module, and the multi-node network detects whether it exists in the data blockchain. The second step is to end the identity authentication process if it does not exist;

The second step is initial authentication. The cloud feeds back to the computing platform the authentication information via the communication module. The computing platform processes the authentication information. The authentication information is displayed on the touch screen module to prompt the user to input. After the screen module enters the user name and user password, the user is initially verified. Based on the received user name, the multi-node network determines its legitimacy. If it is a legitimate user, it checks whether the user password is correct. Take out the user ’s salt value, mix the salt value into the password entered by the user, and use the cryptographic hash function to encrypt. The comparison result is the same as the encrypted user password stored in the corresponding data block. If they are the same, then the user ’s input is initially determined. If the password is correct, go to the third step. If they are not the same, judge that the passwords entered by the user are inconsistent;

The third step is secondary authentication. The computing platform selects the large prime number p and the integer a, and makes these two numbers public, that is, the two numbers are visible to the client and the multi-node network. Large prime number x, large prime number x satisfies x <p-1, calculate a ^x mod p, the value of large prime number x is confidential, and is only visible to multi-node networks; the user side cascades the user password and the user's salt value , Calculate the hash value Z1, and generate a random number S1, cascade the calculated hash value Z1 with the calculated a ^x mod p value, the random number S1, and perform a hash operation again to obtain a hash value Z2. The user The terminal sends the calculated value of a ^x mod p and the hash value Z2 to the multi-node network together with the random number S1;

In the fourth step, the multi-node network takes out the encrypted user password stored in the data blockchain; cascades the received ^ax mod p with the received random number S1, and then performs a hash operation to obtain a hash value Z3 , Compare with the hash value Z2, continue if they are equal, otherwise the judgment is inconsistent. The multi-node network randomly selects a large prime y, satisfying y <q, calculates a ^y mod p, and keeps the value of the large prime y secret; more The node network cascades the encrypted user password, the random number S1, and the calculated a ^y mod p value again to obtain a hash value Z4, and the hash value Z4 and the calculated a ^y mod The value of p is sent to the client;

In the fifth step, the client will perform the hash operation on the hash value Z1 obtained in the third step, cascade the calculated a ^y mod p and the random number S1, and combine the calculation result with the message received in the fourth step. The hash value Z4 is compared. If they are equal, a response signal to the cloud is returned, otherwise a message of authentication failure is returned.

After the above five steps, the cloud and the client successfully verified the identity of each other;

The communication mode adopted by the blockchain identity system is an open system structured network method. The client first makes a request to the cloud, and the cloud processes the request accordingly and performs the tasks included in the request, and then returns the result to the client. .

The advantages of this blockchain identity system are as follows:

(1) Use smart identity cards to ensure the security of user identity.

(2) Encrypt the password information and the ID information of the smart ID card without transmitting the information in plain text. This way, even if an intruder obtains the transmission information of the channel through network listening and other means, there is no need to worry about the user password and ID information being leaked. .

(3) The identity generation process and identity authentication process use a complex encryption process, which can effectively prevent replay attacks. In addition, the client and the cloud use secondary authentication, which improves the reliability and security during the authentication process.

In order to make the technical problems, technical solutions, and beneficial effects to be more clearly understood by the present invention, the present invention is described in detail below with reference to the accompanying drawings and embodiments. It should be noted that the specific embodiments described here are only used to explain the present invention, and are not intended to limit the present invention. Products that can achieve the same function are equivalent replacements and improvements, and are included in the protection scope of the present invention. The specific method is as follows:

Example 1: Workflow of the authentication system

The authentication system works as follows: The user enters the user name and password in the login window displayed on the touch screen module of the client terminal to log in to the system. After entering the authentication system, the touch screen module displays the card-reading authentication interface and sends The command is given to the RF reading module. The RF reading module reads the information in the user's smart identity card. After the identity of the smart identity card is read into the computing platform, the corresponding cryptography is performed on the processing platform according to the identity authentication protocol. After the calculation, the encrypted authentication request information is obtained. The communication module transmits the encrypted authentication request information to the cloud authentication server through network communication. After a series of authentication interaction processes between the client and the cloud, the cloud obtains Authentication results, and return the corresponding authentication results to the user terminal for display.

Embodiment 2: Identity authentication protocol design

As the key to the security of the identity authentication system, the design of the identity authentication agreement is a key component of the entire system. First introduce the symbol conventions used in this article:

U represents the user;

S indicates a third-party authentication server;

ID represents the identity information read by the RF reading module;

UserN and Password respectively represent the username and corresponding login password;

KuR and KuS represent the public and private keys of mobile users, respectively;

KsR and Kss represent the public and private keys of the authentication server, respectively;

EK (m) means encrypt the plaintext m with the key k;

DK (C) means decrypt the ciphertext c with the key k;

Rl and N2 are random numbers generated by the system;

K is used as the session key after both parties have successfully authenticated.

First, the user must register user information in a third-party registration center. When registering, a third-party registration center is required to have a radio frequency reading module in order to confirm the user's identity information and complete the user registration based on the information read from the radio frequency device. The registration process is performed on the premise that the entire process is completed in a center that the user fully trusts, and the registration information is carried out through a secure channel.

The registration process is as follows:

(1) The user requests registration at an officially designated place with his second-generation resident identity card. The registration center staff uses the radio frequency device of the authentication system to scan the user's smart identity card and read the user's identity ID in the smart identity card. After the authentication system reads the user's ID, the system will automatically query whether the user has registered with the system. If the user has already registered, the system returns prompt information and ends the user registration sub-agreement.

(2) After confirming that the user ID is not registered and meets the registration conditions, the authentication system will request the user to enter a login password. After the user enters the password, the system first uses the user's password information to generate a public key corresponding to the ID, and then uses the user's public key to encrypt the user's password according to the elliptic curve cryptographic algorithm, and then encrypts the user's public key and the public key. Password and encrypted ID information are stored on a third-party authentication server.

(3) After the authentication server stores the user's identity information on the server. The third-party registered personnel transmits the installation program of the authentication system to the user's mobile terminal through a mobile storage device or a secure channel.

After successful registration, you can use the mobile terminal for identity authentication. The specific authentication process is as follows:

Step 1: When authentication starts, you first need to log in at the client to verify the identity of the user and the corresponding password. If there is no such user in the cloud authentication or the username and password do not match, an error message is returned. The user needs to register or re-enter the account and correct password. If the user name and the corresponding password are correct, enter the next authentication process. The network channel in the communication module transmits the authentication user's name and user password information, and the cloud authentication extracts these two information from the database.

Step 2: After logging in successfully, enter the scanning smart identity card authentication phase. User U uses the mobile terminal device to read the identity card ID information obtained by the user ’s ID card into the authentication system. The specific process is as follows:

(1) After the user reads the ID card information ID through the RF card reader, the user first performs the following calculations on the mobile device terminal:

① Use the user's public key KuR to encrypt the identity ID to obtain the encrypted user ID, use a random sequence generator to generate a random number N1, and use the server's public key to calculate the authentication request, and temporarily store the random number R1.

② Send a message authentication request. The authentication request contains the encrypted user ID information and the random number N1, and the random number RI needs to be temporarily stored.

(2) After the server receives the authentication request from the user:

① The private key in the cloud decrypts the authentication request according to the elliptic curve cryptographic algorithm module, and obtains the encrypted ID of the user and the random number Rl sent by the user, and then the server checks whether the encrypted ID information corresponds to the userN user in the authentication database. The EncipherID entries match; if they do not match, error information is returned, and authentication fails, that is, each user name is associated with its identity ID information. Even if the intruder steals the user name and password, the login system cannot scan in with The corresponding ID encrypted information cannot pass the authentication.

② If the ID encrypted information obtained in ① is correct, the server stores the random number N1 sent by the user. At the same time, the server uses a random sequence generator to generate a random number N2, and then uses the elliptic curve cryptographic algorithm module and the user's public key to calculate the response information and sends it to the client for verification.

(3) The user receives the response information from the server and performs the following calculations:

① First, the user decrypts the response information with his private key. At this time, the user compares the obtained N1 with the previously saved R1. If the two are not equal, the user's authentication to the server fails (the server may be impersonated) and the server is rejected. Device, authentication ends.

② If the random numbers N1 are equal, the user authentication server is successful. At the same time, the user generates a session symmetric key K, calculates the response information accompanied by the random number N2, and then sends the response information to the server to request verification.

(4) After receiving the user's response information, the server performs the following calculations:

① First, the server decrypts with its private key to get the random number N2.

② The server first compares the random number N2 with the saved one. If the two are not equal, the server fails to verify the user.

The advantages of this blockchain identity system are as follows:

(1) Use smart identity cards to ensure the security of user identity.

(2) Encrypt the password information and the ID information of the smart ID card without transmitting the information in plain text. This way, even if an intruder obtains the transmission information of the channel through network listening and other means, there is no need to worry about the user password and ID information being leaked .

(3) The identity generation process and identity authentication process use a complex encryption process, which can effectively prevent replay attacks. In addition, the client and the cloud use secondary authentication, which improves the reliability and security during the authentication process.

The above description is only a preferred embodiment of the present invention, and is not intended to limit the protection scope of the patent application scope of the present invention. At the same time, the above description should be understood and implemented by those skilled in the relevant technical field, so other equivalent changes made based on the content disclosed in the present invention should be included in the scope of the patent scope of this application.

no

[Figure 1] is a block diagram of the blockchain identity system.

Claims (1)

A blockchain identity system is characterized in that it includes a client and a cloud. The client is composed of a radio frequency reading module, a computing platform, a touch screen module, a communication module, and a smart identity card. The cloud It consists of a blockchain multi-node network, which includes a data blockchain and a multi-node network. The multi-node network is responsible for completing the identity generation process with the user terminal. And an identity authentication process, in which the data blockchain is invoked; the inside of the computing platform includes a touch screen controller, a communication controller, and a micro-computing chip; the touch screen controller is used to control the The display of the touch screen module sends information to be displayed to the touch screen module; the communication controller dispatches the radio frequency reading module and the touch screen in a serial communication manner. Interactive communication between the module and the communication module; the micro-computing chip is used to process information of the identity generation process and the identity authentication process; the smart identity card A chip for an integrated circuit, the chip stores a user ID number, and the user ID number of each of the smart identity cards is unique and is used to identify a user. The smart identity card is passed by a specialized manufacturer. Special equipment production is non-copyable hardware. The smart identity card is carried by a registered legal user. During authentication, the smart identity card must be scanned and read by the user through the radio frequency reading module. ID number to verify the identity of the user; the touch screen module uses a five-wire resistive screen and relies on the principle of pressure sensing for displaying and inputting the required information during the identity generation process and the identity authentication process Information; the communication module is used to receive and send related information, and includes a network transmission screening program and a dedicated code chip to implement communication between the computing platform and the cloud, and implement the network in the form of data frames To receive and send data, and to avoid background noise and interference when receiving and sending, the coding method of the data frame is phase coding, and synchronous clock coding is adopted. Technology, while transmitting data information, it also transmits clock synchronization signals to each other together; in the blockchain multi-node network, the data blockchain is composed of a series of data blocks connected in chronological order of creation Composition, the multi-node network is a P2P network composed of multiple nodes, the nodes share information and transmit information to each other through the network, and the data block chain connects all the nodes in the multi-node network. The nodes are all open. The data block is composed of a block header and a block body. The block header includes a hash value of the previous data block, a timestamp, and a hash value of the current data block. The hash value of the previous data block is used for connection of different data blocks, the timestamp records the current time when the data block is connected, and the current hash value of the data block is used for To ensure that the content of the data block cannot be tampered with, the block body records the account information of the user identity, and the legal account information of the user identity is: username, user identity information, encrypted user password ,encryption The user ID number and the user public key; each of the nodes includes a pseudo-random number generator; the identity generation process is as follows: 1) the user enters the user name, all addresses on the touch screen module The user identity information, the user password, and transmitting the user name, the user identity information, and the user password to the multi-node network, and the multi-node network verifies that the user name is in the Whether the data exists in the blockchain. If the user name does not exist, go to the next step. If the user name exists, send feedback information to the computing platform via the communication module. Feedback information processing, "user exists, re-enter" is displayed on the touch screen module, the user re-enters the user name on the touch screen module, and the multi-node network re-examines the user Whether the name exists in the data blockchain; 2) the computing platform verifies whether the user password meets the requirements, if the user password meets the requirements, proceed to the next step, and if it does not meet the requirements, Input to the touch screen module, "user password does not meet requirements, re-enter" is displayed on the touch screen module, and the user re-enters the user password on the touch screen module 3) the multi-node network generates a random number S1, and the random number S1 is encrypted by an IDEA encryption algorithm to generate the encrypted random number S1, and the encrypted random number S1 is broadcast to All the nodes in the multi-node network, all the nodes use the IDEA decryption algorithm to decrypt the encrypted random number S1, and the node that first decrypts the random number S1 is used to construct the data block chain. Nodes; 4) The node responsible for building the data blockchain assigns a user public key to the user, and generates a unique identity by the user identity information through a hash algorithm, and the node responsible for building the data blockchain Digitally sign the generated unique identity identifier to generate the unique user ID number, write the user ID number to the smart identity card, and encrypt the user public key to generate the encryption The place The user ID number, save the current time as the timestamp of the current data block, the hash value of the previous data block generates a hash value of the current data block by a secure hash algorithm, and Generating the encrypted user password, and the specific process of generating the encrypted user password is: using the node responsible for constructing the data blockchain and generating random numbers using the pseudo random number generator included therein The random number is used as the salt value of the user, and the salt value of the user is mixed into the user password, and encrypted using a cryptographic hash function to generate the encrypted user password; the user name, the The user identity information, the encrypted user password, the encrypted user ID number, and the user public key constitute account information of the user identity, and are written into the current data area together with the salt value of the user In the block body of the block, the working principle of the pseudo random number generator is as follows: The pseudo random number generator is based on a data encryption standard and includes a triple data encryption standard algorithm, which can cycle real estate Nonce; i is a natural number of variables; means for generating the i-th round denotes the nonce calculation, there are three main components: 1) an input section: the input section is two 64-bit pseudo-random number _i a Date and V _i, wherein, a date _i represents the i-th round calculating date and time at the beginning, after each generate a random number Ri, date _i need to be updated once, V _i is to produce a seed to enter when the i-th random number, which The initial value can be set arbitrarily, and it will be automatically updated in each subsequent round of calculations; 2) Key generator: The specific calculations used for each round, each round of calculations uses triple data algorithm encryption, each encryption uses two fixed 56-bit key K1 and key K2, these two keys must be kept secret and specified by the pseudo-random number generator; 3) output part: the output is a 64-bit random number Ri and a 64-bit The new seed V _{i + 1 of the} element; the pseudo-random number generator has a high security strength, because it uses a 112-bit long key and 3 key-encrypted data algorithm encryption, and also because There are two pseudo random number inputs driven, one of the two pseudo random number inputs is current And time Date _i, and the other is on a seed produced V _i, each round generated random number Ri, but due to the different round seeds, random number generator are not the same, therefore, a random number generated for each user It is also different, so the random number generated in the next round cannot be inferred from the random number generated in the previous round. The identity authentication process is as follows: In the first step, the client sends an authentication request to the cloud to identify the smart identity. The user ID number stored in the card is read in by the radio frequency reading module, and the multi-node network detects whether it exists in the data block chain, and if it exists, the second step is performed, and if it does not exist, Ending the identity authentication process; in the second step, initial authentication, the cloud sends back to the computing platform information for starting authentication via the communication module, the computing platform processes the information for starting authentication, and the authentication starts The information displayed on the touch screen module prompts the user to enter the user name and the user password. After the user enters the touch screen module, the user initially verifies the user. After receiving the input user name, the multi-node network judges its legitimacy. If it is a legitimate user, it checks whether the user password entered is correct, and takes out all the addresses from the blockchain multi-node network. The user's salt value, mixing the user's salt value into the input user password, and encrypting using the cryptographic hash function, comparing the result with the encrypted user password stored in the corresponding data block Whether they are the same, if they are the same, then it is judged that the entered user password is correct, and the process proceeds to the third step; if they are not the same, it is judged that the entered user password is incorrect; the third step, the second authentication, the calculation The platform selects a large prime number p and an integer a, and makes these two numbers public, that is, the two numbers are visible to the client and the multi-node network, and the multi-node network selects a random large prime number x, where the large prime number x satisfies x <p-1, calculate a ^x mod p, and the value of the large prime number x is confidential and only visible to the multi-node network; the user terminal sends the user password And the user's salt value cascade to calculate the hash Value Z1, and generate a random number S1. Cascade the calculated hash value Z1 with the calculated value of a ^x mod p and the random number S1, and perform a hash operation again to obtain a hash value Z2. The client sends the calculated value of the a ^x mod p and the hash value Z2 to the multi-node network together with the random number S1, the fourth step, the multi-node network fetches storage The encrypted user password in the data block chain; concatenating the received random number S1, the calculated value of a ^x mod p, and performing a hash operation to obtain a hash value Z3, Compare with the hash value Z2, continue if they are equal, otherwise the judgment is inconsistent. The multi-node network randomly selects a large prime y, satisfying y <q, calculates a ^y mod p, and compares the large prime y And the multi-node network cascades the encrypted user password, the random number S1, and the calculated value of a ^y mod p to perform a hash operation again to obtain a hash value Z4, and Z4 sends the hash value, the value of the calculation of a ^y mod p to the user terminal; a fifth step, the UE obtained in the third step of the Hash value Z1, the post-calculation of a ^y mod p concatenated value and the nonce S1 and hashed, the hash value calculation result and the fourth Z4 message received in step If the comparison is equal, an authentication response response signal is returned to the cloud, otherwise an authentication failure message is returned; after the above five steps, the cloud and the client successfully verify the identity of each other; the area The communication mode adopted by the blockchain identity system is a network system with an open system structure. The client first makes a request to the cloud, and the cloud processes the request accordingly and executes the request contained in the request. Task, and then return the result to the client.