CN110190971B - JWT token authentication method based on block chain - Google Patents
JWT token authentication method based on block chain Download PDFInfo
- Publication number
- CN110190971B CN110190971B CN201910564982.XA CN201910564982A CN110190971B CN 110190971 B CN110190971 B CN 110190971B CN 201910564982 A CN201910564982 A CN 201910564982A CN 110190971 B CN110190971 B CN 110190971B
- Authority
- CN
- China
- Prior art keywords
- verification code
- token
- jwt
- verification
- block chain
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
- H04L63/0838—Network architectures or network communication protocols for network security for authentication of entities using passwords using one-time-passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0872—Generation of secret information including derivation or calculation of cryptographic keys or passwords using geo-location information, e.g. location data, time, relative position or proximity to other entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
- H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
- H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Business, Economics & Management (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Accounting & Taxation (AREA)
- Finance (AREA)
- Development Economics (AREA)
- Economics (AREA)
- Marketing (AREA)
- Strategic Management (AREA)
- Technology Law (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
The invention provides a JWT token authentication method based on a block chain, which belongs to the technical field of JWT token authentication and comprises three steps of 1) obtaining a verification code, 2) writing the verification code and 3) issuing a JWT token.
Description
Technical Field
The invention relates to a JWT token authentication technology, in particular to a JWT token authentication method based on a block chain.
Background
In an interconnected mobile world, the need to protect user identities from identity theft and fraud is very strong.
Today, everything has been interconnected from wearable devices, cameras, home electronics and doors, to automobiles and medical devices, etc., and this interconnection will accelerate deeper, especially as 5G enters the market, we will see more intelligent interconnected devices — all of which have the capability to communicate and exchange data with each other.
Thus, our lives are served around various interconnected devices, and these technologies bring our convenience to multiples.
However, often when new technologies are widely used, the chances of malicious attacks inevitably increase, and therefore, the network security needs to be improved continuously.
In a rapidly changing digital world, convenience is often the greatest expectation of users, rather than being viewed as "something more and more like" a word.
This means that the security management of the user identity is not only a big concern but also a significant challenge.
JWT (JSON Web token) is a JSON-based open standard (RFC7519) that defines a compact, self-contained approach and, because it is digitally signed, is often used as a user identity credential between an identity provider and a service provider in Web applications. The block chain technology has the characteristics of non-tampering and traceability, and a set of trusted token authentication system is established by combining with a JWT standard protocol.
Disclosure of Invention
According to the content, the invention provides a JWT token authentication method based on a block chain, aiming at improving the safety, the credibility and the traceability of a token authentication system.
The technical scheme of the invention is as follows:
a JWT token authentication method based on a block chain,
the implementation process comprises three steps:
1) acquiring a verification code: after receiving a verification code acquisition request, the JWT token service inquires the current block height of a block chain, and generates an unpredictable random code by taking the current block height and a current timestamp as random seeds;
2) verification code writing chain: a user signs a verification code write chain transaction at a block chain client, and then submits the write chain transaction to a block chain for verification during token issuing;
3) JWT token issuance: when the JWT token is generated by the JWT token service, the verification code is also written into the token, the token service initiates the transaction of the verification code check block chain, the verification of the verification code and the user is carried out by the token authentication intelligent contract, if the verification is passed, the relation between the verification code and the JWT token is written into the block chain, then the JWT token is issued to the user by the token service, and if the verification fails, the chain is not written.
The overall system is divided into five parts, 1) building a block chain network, 2) deploying JWT token service, 3) applying JWT tokens and 4) verifying the JWT tokens.
Further, in the above-mentioned case,
1) building block chain network
Building a block chain network by using a HyperLegger Fabric framework to provide a runtime environment for an intelligent contract; and then deploying a token authentication intelligent contract to realize verification code verification and write chain functions.
Further, in the above-mentioned case,
2) deploying JWT token services
And deploying a JWT token service, and realizing the issuing of the JWT token and the receiving and checking service of the verification code request.
Further, in the above-mentioned case,
3) JWT token application
Firstly, a user sends a request for acquiring a verification code to a JWT token service, and the JWT token service generates a random verification code and returns the random verification code to the user;
then, the user signs the verification code uplink transaction by using the block chain client and sends the verification code uplink transaction to the block chain network, and the block chain network writes the verification code into the block chain after receiving the transaction request;
after the verification code writing chain is successful, a user sends a token obtaining request to the JWT token service by using the verification code, after the JWT token service receives the request, the JWT token is firstly generated by using the HS256 encryption type of JWT, the token signature uses a unified secret key, and then the token and the verification code are used as a parameter to call a token authentication intelligent contract of the block chain to initiate a verification code checking request;
and finally, the JWT token service judges whether to return the JWT token to the user according to the verification result of the verification code.
In a still further aspect of the present invention,
and verifying the verification code, namely inquiring the write chain transaction of the verification code by the intelligent contract, and comparing whether the signature public key of the write chain transaction of the verification code is consistent with the signature public key of the verification code verification transaction: if not, the verification fails; if the JWT token is consistent with the verification code, the verification is passed, and the association relation of the JWT token and the verification code is subjected to write chain operation.
Further, in the above-mentioned case,
4) JWT token validation
And the JWT token service uses the unified secret key of the signature token to perform signature verification operation and returns a signature verification result.
The invention has the advantages that
1) Trusted
Based on the block chain technology, each token issuing transaction is signed by a user private key to carry out the uplink transaction, and the method has non-repudiation.
2) Traceability
Based on the blockchain technology, the token issuing transaction history can not be deleted or changed due to the non-tampering characteristic.
Drawings
FIG. 1 is a diagram of JWT token issuance of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer and more complete, the technical solutions in the embodiments of the present invention will be described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention, and based on the embodiments of the present invention, all other embodiments obtained by a person of ordinary skill in the art without creative efforts belong to the scope of the present invention.
The invention discloses a JWT token authenticator based on a block chain, which has the technical implementation scheme as follows:
1) building block chain network
Building a block chain network by using a HyperLegger Fabric framework to provide a runtime environment for an intelligent contract; and then deploying a token authentication intelligent contract to realize verification code verification and write chain functions.
2) Deploying JWT token services
And deploying a JWT token service, and realizing the issuing of the JWT token and the receiving and checking service of the verification code request.
3) JWT token application
Firstly, a user sends a request for acquiring a verification code to a JWT token service, and the JWT token service generates a random verification code and returns the random verification code to the user;
then, the user signs the verification code uplink transaction by using the block chain client and sends the verification code uplink transaction to the block chain network, and the block chain network writes the verification code into the block chain after receiving the transaction request;
and after the verification code writing chain is successful, the user uses the verification code to send a token acquisition request to the JWT token service.
After receiving the request, the JWT token service firstly generates a JWT token by utilizing the HS256 encryption type of JWT, a unified secret key is used for token signature, and then the token and a verification code are used as a parameter to call a token authentication intelligent contract of a block chain to initiate a verification code check request;
the intelligent contract inquires the write chain transaction of the verification code, and compares whether the signature public key of the verification code write chain transaction is consistent with the signature public key of the verification code verification transaction:
if not, the verification fails; if the JWT token is consistent with the verification code, the verification is passed, and the association relation between the JWT token and the verification code is subjected to write chain operation;
and finally, the JWT token service judges whether to return the JWT token to the user according to the verification result of the verification code.
4) JWT token validation
And the JWT token service uses the unified secret key of the signature token to perform signature verification operation and returns a signature verification result.
The above description is only a preferred embodiment of the present invention, and is only used to illustrate the technical solutions of the present invention, and not to limit the protection scope of the present invention. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention shall fall within the protection scope of the present invention.
Claims (6)
1. A JWT token authentication method based on a block chain,
the implementation process comprises three steps:
1) acquiring a verification code: after receiving a verification code acquisition request, the JWT token service inquires the current block height of a block chain, and generates an unpredictable random code by taking the current block height and a current timestamp as random seeds;
2) verification code writing chain: a user signs a verification code write chain transaction at a block chain client, and then submits the write chain transaction to a block chain for verification during token issuing;
3) JWT token issuance: when the JWT token is generated by the JWT token service, the verification code is also written into the token, the token service initiates the transaction of the verification code check block chain, the verification of the verification code and the user is carried out by a token authentication intelligent contract, if the verification is passed, the relation between the verification code and the JWT token is written into the block chain, then the JWT token is issued to the user by the token service, and if the verification fails, the chain is not written;
in particular, the method comprises the following steps of,
firstly, a user sends a request for acquiring a verification code to a JWT token service, and the JWT token service generates a random verification code and returns the random verification code to the user;
then, the user signs the verification code uplink transaction by using the block chain client and sends the verification code uplink transaction to the block chain network, and the block chain network writes the verification code into the block chain after receiving the transaction request;
after the verification code writing chain is successful, the user uses the verification code to send a token acquisition request to the JWT token service;
finally, the JWT token service judges whether to return the JWT token to the user according to the verification result of the verification code;
and verifying the verification code, namely inquiring the write chain transaction of the verification code by the intelligent contract, and comparing whether the signature public key of the write chain transaction of the verification code is consistent with the signature public key of the verification code verification transaction: if not, the verification fails; if the JWT token is consistent with the verification code, the verification is passed, and the association relation of the JWT token and the verification code is subjected to write chain operation.
2. The method of claim 1,
the overall system is divided into five parts, 1) building a block chain network, 2) deploying JWT token service, 3) applying JWT tokens and 4) verifying the JWT tokens.
3. The method of claim 2,
1) building block chain network
Building a block chain network by using a HyperLegger Fabric framework to provide a runtime environment for an intelligent contract; and then deploying a token authentication intelligent contract to realize verification code verification and write chain functions.
4. The method of claim 2,
2) deploying JWT token services
And deploying a JWT token service, and realizing the issuing of the JWT token and the receiving and checking service of the verification code request.
5. The method of claim 1,
after receiving the request, the JWT token service firstly generates a JWT token by using the HS256 encryption type of JWT, the token signature uses a uniform secret key, and then the token and the verification code are used as a parameter to call a token authentication intelligent contract of a block chain to initiate a verification code check request.
6. The method of claim 2,
4) JWT token validation
And the JWT token service uses the unified secret key of the signature token to perform signature verification operation and returns a signature verification result.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910564982.XA CN110190971B (en) | 2019-06-27 | 2019-06-27 | JWT token authentication method based on block chain |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910564982.XA CN110190971B (en) | 2019-06-27 | 2019-06-27 | JWT token authentication method based on block chain |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110190971A CN110190971A (en) | 2019-08-30 |
| CN110190971B true CN110190971B (en) | 2022-03-15 |
Family
ID=67723666
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910564982.XA Active CN110190971B (en) | 2019-06-27 | 2019-06-27 | JWT token authentication method based on block chain |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110190971B (en) |
Families Citing this family (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111625800A (en) * | 2020-06-05 | 2020-09-04 | 光载互联(杭州)科技有限公司 | Digital identity authentication method and system based on in-vivo detection |
| CN112632164B (en) * | 2020-12-21 | 2022-09-13 | 杭州云象网络技术有限公司 | Universal cross-chain programming interface method for realizing trusted authority access |
| CN112277881B (en) * | 2020-12-25 | 2021-04-06 | 上海银基信息安全技术股份有限公司 | Identity authentication method and device, vehicle and user equipment |
| CN113452677A (en) * | 2021-05-28 | 2021-09-28 | 济南浪潮数据技术有限公司 | Request processing method, system, equipment and medium |
| CN114266574A (en) * | 2021-09-30 | 2022-04-01 | 西南电子技术研究所（中国电子科技集团公司第十研究所） | Method for checking authority among service systems based on block chain platform |
| CN114944947B (en) * | 2022-05-13 | 2023-07-28 | 平安科技（深圳）有限公司 | Authority authentication method, device, equipment and storage medium of client |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108833081A (en) * | 2018-06-22 | 2018-11-16 | 中国人民解放军国防科技大学 | A block chain-based device network authentication method |
| WO2019013773A1 (en) * | 2017-07-10 | 2019-01-17 | Intuit Inc. | Secure token passing via blockchains |
| AU2019202395A1 (en) * | 2016-09-15 | 2019-05-02 | Accenture Global Solutions Limited | Method and system for secure communication of a token and aggregation of the same |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107306183B (en) * | 2016-04-22 | 2021-12-21 | 索尼公司 | Client, server, method and identity verification system |
| US10255342B2 (en) * | 2017-04-12 | 2019-04-09 | Vijay K. Madisetti | Method and system for tuning blockchain scalability, decentralization, and security for fast and low-cost payment and transaction processing |
| US10749677B2 (en) * | 2017-04-18 | 2020-08-18 | Samsung Electronics Co., Ltd. | Method and apparatus for access control in distributed blockchain-based internet of things (IoT) network |
| US10642967B2 (en) * | 2017-11-28 | 2020-05-05 | American Express Travel Related Services Company, Inc. | Single sign-on solution using blockchain |
-
2019
- 2019-06-27 CN CN201910564982.XA patent/CN110190971B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| AU2019202395A1 (en) * | 2016-09-15 | 2019-05-02 | Accenture Global Solutions Limited | Method and system for secure communication of a token and aggregation of the same |
| WO2019013773A1 (en) * | 2017-07-10 | 2019-01-17 | Intuit Inc. | Secure token passing via blockchains |
| CN108833081A (en) * | 2018-06-22 | 2018-11-16 | 中国人民解放军国防科技大学 | A block chain-based device network authentication method |
Non-Patent Citations (4)
| Title |
|---|
| "Document Certification Through the Blockchain";martin stellnberger;《https://www.martinstellnberger.co/document-certification-through-the-blockchain》;20161205;全文 * |
| "JWT令牌：轻量级基于令牌的身份验证";企鹅号-爱码农;《https://cloud.tencent.com/developer/news/406226》;20190608;全文 * |
| "Personal cloud interoperability";Jose G. Faisca;《2016 IEEE 17th International Symposium on A World of Wireless, Mobile and Multimedia Networks (WoWMoM)》;20160728;全文 * |
| NJaho ."基于token的鉴权机制 — JWT介绍".《https://www.cnblogs.com/Jaho/p/9275986.html》.2018, * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110190971A (en) | 2019-08-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110190971B (en) | JWT token authentication method based on block chain | |
| CN111429254B (en) | Business data processing method and device and readable storage medium | |
| CN112039909B (en) | Authentication method, device, equipment and storage medium based on unified gateway | |
| CN108012268B (en) | SIM card for ensuring safe use of application software on mobile phone terminal | |
| US8112787B2 (en) | System and method for securing a credential via user and server verification | |
| US6073237A (en) | Tamper resistant method and apparatus | |
| Hammood et al. | A review of user authentication model for online banking system based on mobile IMEI number | |
| CN113301022B (en) | Internet of things equipment identity security authentication method based on block chain and fog calculation | |
| US20160006567A1 (en) | Cryptographic Device that Binds an Additional Authentication Factor to Multiple Identities | |
| CN105357186B (en) | A kind of secondary authentication method based on out-of-band authentication and enhancing OTP mechanism | |
| CN111027035B (en) | Multi-identity authentication method and system based on block chain | |
| CN1799018A (en) | Securing access to an application service based on a proximity token | |
| CN103269270A (en) | Real-name authentication safe login method and system based on cell phone number | |
| JPH10336169A (en) | Authenticating method, authenticating device, storage medium, authenticating server and authenticating terminal | |
| CN101257489A (en) | Method for protecting account number safety | |
| CN109039652B (en) | Digital certificate generation and application method | |
| CN103747036A (en) | Trusted security enhancement method in desktop virtualization environment | |
| CN107592308A (en) | A kind of two server multiple-factor authentication method towards mobile payment scene | |
| KR20140098872A (en) | security system and method using trusted service manager and biometric for web service of mobile nfc device | |
| CN112765626A (en) | Authorization signature method, device and system based on escrow key and storage medium | |
| KR20190114433A (en) | Method for oauth service through blockchain, and terminal and server using the same | |
| KR20190114432A (en) | Method for oauth service through blockchain, and terminal and server using the same | |
| CN113595985A (en) | Internet of things security cloud platform implementation method based on state cryptographic algorithm security chip | |
| CN109525565A (en) | A kind of defence method and system for SMS interception attack | |
| CN110572392A (en) | Identity authentication method based on HyperLegger network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |