Cross-mechanism user sensitive data authentication privacy protection method based on block chain technology

Abstract

According to the cross-mechanism user sensitive data authentication privacy protection method based on the block chain technology, a block chain trusted execution computing environment and a selective disclosure algorithm based on bilinear mapping are combined; a data circulation process is divided into a user service application, a service party confirms the user application, a user generates an authentication certificate, and a third party verifies an authentication result. And the privacy data circulation range of the user is limited, so that the cross-mechanism authentication service full-process safety traceability, the encryption algorithm process verifiability and the encryption result calculation safety are realized.

Description

Technical Field

[0001] The present invention relates to the field of blockchain and data sharing security, and in particular to a method for protecting privacy of cross-institutional user sensitive data authentication based on blockchain. Background Art

[0002] As the country promotes new industrialization through digital transformation, various regions are further accelerating the deep integration of digital technology and the real economy. New generation information technologies such as blockchain, big data and the Internet of Things are playing an increasingly important role in the fields of intelligent manufacturing, finance and healthcare. While these technologies have brought great convenience to people's lives, they have also exacerbated the hidden dangers of sensitive data leakage of personal users. How to ensure that the user's personal sensitive privacy data is circulated within the smallest scope and to the minimum extent has become a focus of attention. How to perform compliance certification of user personal privacy data (such as economic status, medical history, etc.) without disclosing the user's personal privacy data in a cross-institutional authentication scenario and protect the user's sensitive information has also become one of many research issues.

[0003] Blockchain technology has become an ideal solution to the user data sharing problem in this research scenario. Blockchain has the characteristics of decentralization and immutability. It can effectively solve the problems of cross-platform, cross-regional and secure records in data sharing. Blockchain is a decentralized distributed ledger, and there is no single centralized organization controlling all identity data. This means there is no single point of failure and no centralized data storage, which improves the security and reliability of the system. At the same time, once the relevant record information of identity authentication is stored on the blockchain, it cannot be tampered with. Each block contains the hash value of the previous block, and this linking method makes it very difficult to tamper with the data in the blockchain. Therefore, the storage of identity authentication information on the blockchain is safe and reliable, which can effectively prevent users from maliciously forging their own identity information and maliciously defrauding the verifier.

[0004] Blockchain technology provides a technical means to solve privacy compliance and ensures compliance certification of user privacy, but there are still certain risks in the leakage of user sensitive information. In the existing blockchain authentication scheme, although the information content recorded on the blockchain cannot be tampered with, the authenticity of the data still needs to be authenticated, otherwise once the wrong information is recorded on the blockchain, it cannot be tampered with; at the same time, the information recorded on the blockchain is visible to nodes in the entire network segment. In the process of verifying the user's sensitive information, how to mask the user's sensitive information to ensure that the user's real sensitive information will not be leaked, while still being able to verify the correctness of the user's sensitive information and prevent the user from forging identity information is also a difficult problem in the current blockchain privacy protection scenario. At the same time, how to ensure the principle of minimum knowledge, the user's sensitive identity information will not be leaked in the cross-institutional authentication scenario, and how to prevent other institutions from obtaining additional information about the user to infer the user's identity also needs to be considered.

[0005] Selective disclosure is a cryptographic algorithm based on elliptic curves, bilinear mappings, and discrete logarithm problems. Based on asymmetric cryptography, it can realize the selective disclosure of any subset of signed messages by digitally signing multiple message fields and generate a single digital signature of constant size, realizing selective disclosure of data information, unlinkability of original data, and proof of data ownership validity. It allows users to disclose only the minimum necessary information during identity authentication, effectively limits the sharing scope of sensitive data, reduces the risk of exposure and abuse of sensitive information, ensures data security during transmission and use, and provides an effective solution to problems in cross-institutional authentication scenarios. It avoids the verification party from recording and inferring the user's personal privacy after obtaining the user's personal authentication information, effectively ensuring the minimum circulation scope of the user's personal sensitive data. Summary of the invention

[0006] In response to the needs of user sensitive data authentication in cross-institutional scenarios, the present invention proposes a cross-institutional user sensitive data authentication privacy protection method based on blockchain technology. This method applies the selective disclosure algorithm to blockchain technology to specifically solve the problems of user identity authentication information anti-forgery in cross-institutional scenarios of user sensitive data, the problem of sensitive data authenticity verifiability, the problem of the verifier inferring the user's personal privacy, and the problem of the minimum scope of circulation of user personal sensitive data.

[0007] The cross-institutional user sensitive data authentication privacy protection method based on blockchain technology includes the following steps:

[0008] Step 1, initialization settings: The user first performs initialization settings in the system, enters the public security parameters predefined by the system, sets parameters for the specific implementation method of personal information processing in subsequent links, and generates the user's corresponding asymmetric encryption key;

[0009] Step 2, service application: This process is that the user requests the issuer to provide a credential service for personal sensitive information verification; the user sends an application request to the issuer, requests the personal information required by the user, indicates the relevant information that needs to be disclosed during the authentication process and shields other sensitive information, and requires the issuer to provide a selective disclosure authentication credential service;

[0010] Step 3, confirm the application: This process is for the issuer to confirm the user's request and return the user's personal information. After receiving the request from the user and verifying the authenticity of the user's identity, the issuer will pre-sign the personal information in the name of the issuer according to the user's request and the user information stored in the system, and return the processed data to the user;

[0011] Step 4, generate credentials: This process is for the user to use the selective disclosure cryptography technology to generate an authentication certificate for the processed data returned by the issuer, and send it to the verifier for further verification. In this process, the user processes the selectively disclosed data and the undisclosed data, and generates a verification certificate, which is sent to the verifier for verification;

[0012] Step 5, verification result: After receiving the verification certificate sent by the user, the verifier parses and verifies the certificate to confirm the legitimacy of the user's identity, and further confirms whether the certificate provided by the user about his or her own sensitive data is correct, and returns the verification result to the user; if the identity authentication is successful, the corresponding service or resource is provided to the user; if the identity authentication fails, the user's request is rejected.

[0013] The beneficial effects achieved by this method are:

[0014] (1) Limit the scope of circulation of users' private data, realize the security and traceability of the entire cross-institutional authentication business process, verify the encryption algorithm process, and ensure the security of encryption result calculation.

[0015] (2) The security and reliability of the system are improved through the design of blockchain.

[0016] (3) By applying the selective disclosure algorithm to blockchain technology, the user identity authentication information can be prevented from being forged in cross-institutional scenarios where user sensitive data exists. At the same time, the authenticity of sensitive data can be verified, and the verifier will not infer the user's personal privacy, thus achieving the minimum circulation of user personal sensitive data.

[0017] (4) A prototype system for privacy authentication of user sensitive data in cross-institutional identity authentication scenarios was implemented.

[0018] (5) Through the system's user verification process, users are guaranteed to be aware of and have control over the content of their own authentication information. The authentication process only collects and processes the minimum data required for the authentication process, which can effectively prevent user data from being leaked, tampered with, and lost. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 Schematic diagram of a data sharing solution in an embodiment of the present invention.

[0020] Figure 2 Schematic diagram of blockchain for cross-institutional user identity authentication in an embodiment of the present invention.

[0021] Figure 3 Schematic diagram of data flow in an embodiment of the present invention.

[0022] Figure 4 Schematic diagram of signature calculation in the application confirmation phase in an embodiment of the present invention.

[0023] Figure 5 A schematic diagram of calculating intermediate variables in the user-generated identity credential environment in an embodiment of the present invention.

[0024] Figure 6 A schematic diagram of main calculation variables for generating identity credentials for a user in an embodiment of the present invention.

[0025] Figure 7 Schematic diagram of main calculation variables for generating identity credentials for users in embodiments of the present invention Figure 2 . DETAILED DESCRIPTION

[0026] The technical solution of the present invention is further described in detail below in conjunction with the accompanying drawings.

[0027] The main structure diagram of the privacy protection method is as follows Figure 1 As shown, there are three main entity roles and five data circulation links. The entity roles are user, issuer, and verifier. The data circulation links are initialization settings, service application, confirmation application, credential generation, and verification results. The specific corresponding role identities are as follows:

[0028] User: A user is an independent entity, often corresponding to a natural person in real life. In a cross-institutional authentication scenario, the user stores his or her own sensitive personal information at the issuing party and needs to be verified at the verifying party. The user provides his or her own identity information to prove his or her identity to the issuing party and obtain his or her own personal information data. The user also needs to selectively disclose his or her identity information to the verifying party to meet the authentication requirements of different institutions. In this process, users need to protect their privacy and ensure that too much sensitive information is not disclosed during the authentication process.

[0029] Issuer: The issuer is the institution responsible for verifying and confirming the user's identity. It is usually an authoritative and credible institution, such as a government department or financial institution. The issuer often stores some of the user's sensitive personal information. Before the issuer issues an identity certificate or authentication credential to the user, it needs to verify the user's identity information. The authentication information of the issuer provides a trust basis for the user in the authentication process of the verifier, making it easier for the user to be accepted during the authentication.

[0030] Verifier: The verifier is the organization responsible for verifying the user's identity. It is usually the organization whose services or resources the user needs to use, such as a bank or social platform. The verifier authenticates and confirms the user's identity based on the identity information provided by the user to ensure that the user's identity is authentic, legal and valid. The verifier is the organization that provides services or resources to the user. After the user passes the identity verification, the verifier provides the user with the corresponding services or resources.

[0031] The specific data flow process is as follows:

[0032] Initialization settings: Users first need to perform initialization settings in the system. By entering the public security parameters predefined by the system, they set the parameters for the specific implementation methods of personal information processing in subsequent links, and generate the user's corresponding asymmetric encryption key to facilitate further operations in subsequent links.

[0033] Service application: This process is for users to request the issuer to provide a credential service for personal sensitive information verification. Users send an application request to the issuer, requesting the personal information they need, and further specifying the relevant information that needs to be disclosed during the authentication process and shielding other sensitive information, requiring the issuer to provide a selective disclosure authentication credential service.

[0034] Confirmation of application: This process is for the issuer to confirm the user's request and return the user's personal information. After receiving the request from the user and verifying the authenticity of the user's identity, the issuer will pre-process the personal information based on the user's request and the user information stored in the system, and sign it in the name of the issuer according to the user's specific request requirements, and return the processed data to the user.

[0035] Generate credentials: This process is for the user to generate an authentication certificate based on the algorithm flow using cryptographic techniques such as selective disclosure of the processed data returned by the issuer, and send it to the verifier for further verification. In this process, the user processes the selectively disclosed data and undisclosed data, generates a verification certificate, and sends it to the verifier for verification.

[0036] Verification result: After receiving the verification certificate sent by the user, the verifier parses and verifies the certificate to confirm the legitimacy of the user's identity, and further confirms whether the certificate provided by the user about his or her sensitive data is correct, and returns the verification result to the user. If the identity authentication is successful, the user will be provided with the corresponding service or resource; if the identity authentication fails, the user's request will be rejected.

[0037] Specific implementation plans such as Figure 2 As shown in the figure, by pre-building a blockchain for cross-institutional user identity authentication, a trusted execution environment is initially formed. All parties in the authentication scenario, such as government agencies, non-governmental organizations, enterprises, and individual users, access the blockchain network through initialization settings. After accessing the blockchain network, authentication credentials are transmitted and authentication information is confirmed on the chain by building special transaction transactions.

[0038] In this embodiment, a cross-institutional user sensitive data authentication privacy protection method based on blockchain technology is designed. Figure 3 The following is a suggested schematic diagram of the entire privacy data flow process. The specific implementation of this method is as follows:

[0039] Initialization settings:

[0040] 1) Input the system initialization parameter λ.

[0041] 2) Select two multiplicative cyclic groups (G1, G2) of prime order p as the authentication key pair.

[0042] 3) Construct a large prime number p containing λ bits. g1,g2 are generators of (G1,G2). Then It is λ-bit secure.

[0043] When accessing the blockchain system, the following operations should be performed:

[0044] 1) Calculate the user's address key pair (sk, pk).

[0045] 2) Calculate the user's account address addr: = H(pk), where H is the agreed hash algorithm.

[0046] 3) Generate a random vector group V = (v0, v1, ..., v L )

[0047] 4) Generate an authentication key pair (sk', pk') based on the prime number p and the multiplication cyclic group.

[0048] The multiplication cyclic group selected in steps 3 and 4 is the multiplication cyclic group corresponding to the BLS12-381 curve, where the curve function of G1 is y^2=x^3+4, and the curve function of G2 is y^2=x^3+4(1+i).

[0049] In the third step, the vector group is randomly selected. In the fourth step, the private key sk is randomly generated in G1. pk is the mapping of sk in G2. The mapping function is (x, y)->(x / u^2, y / u^3), where u=(1+i)^-1.

[0050] Service Application:

[0051] 1) The address addr of the issuing party where the user obtains the required personal information A .

[0052] 2) Construct the user's service request R, using the issuing party's public key pk B encryption.

[0053] 3) Construct special transactions on the blockchain and send the constructed transaction information to the blockchain network.

[0054] Confirmation of application:

[0055] 1) The issuer parses the special transaction constructed by the user service application and obtains the specific details of the transaction constructed by the user.

[0056] 2) Confirm the user source through the transaction address source, using their own private key sk B to parse.

[0057] 3) According to the user's request, find out the user's overall personal information M containing some selectively disclosed data requested by the user.

[0058] 4) For each piece of information m in the user's overall personal information M i The issuer selects the parameter e and the random number s, and uses the issuer's own signature private key x to calculate Construct signature σ B =(A,e,s).

[0059] 5) The issuer constructs a special transaction on the blockchain and sends the information to the blockchain.

[0060] Generate credentials:

[0061] 1) The user parses the special transaction returned by the issuer to obtain the specific details of the transaction constructed by the issuer.

[0062] 2) The user first verifies the signature information returned by the issuer, using the generators g1 and g2 of the multiplication cyclic group to construct a bilinear map to verify the correctness of the signature:

[0063]

[0064] 3) After confirming that the verification information is correct, the user randomly selects r1 and r2, calculates the modular inverse of r1, r3, and calculates the verification certificate A', D and C.

[0065] 4) Calculation

[0066] 5) Calculation

[0067] 6) Calculation

[0068] 7) Information not included in the selective disclosure index calculate

[0069] 8) The user generates his / her own user identity credentials, constructs a special transaction on the blockchain, and sends the information on the blockchain.

[0070] Verification results:

[0071] 1) The verifier parses the special transaction sent by the user and obtains the specific details of the transaction constructed by the issuer.

[0072] 2) The verifier obtains the user-generated user authentication credentials published by the user in the transaction.

[0073] 3) The verifier verifies the parameters and calculates the equation Is it true?

[0074] 4) The verifier further verifies the equation Is it true? For information i within the selective disclosure range index.

[0075] The verifier further verifies the equation:

[0076]

[0077] Is it true?

[0078] 5) If all the above equations are verified, the user is deemed to have successfully authenticated his / her identity information and the corresponding services or resources are provided to the user; otherwise, the user request is rejected.

[0079] The main calculation diagram in the confirmation application and verification result stage is as follows Figures 4 to 7 shown.

[0080] The above description is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiment. Any equivalent modifications or changes made by ordinary technicians in this field based on the contents disclosed by the present invention should be included in the protection scope recorded in the claims.

Claims

1. A cross-institutional user sensitive data authentication and privacy protection method based on blockchain technology, characterized by: The method comprises the following steps: Step 1, initialization settings: The user first performs initialization settings in the system, enters the public security parameters predefined by the system, sets parameters for the specific implementation method of personal information processing in subsequent links, and generates the user's corresponding asymmetric encryption key; Step 2, service application: This process is that the user requests the issuer to provide a credential service for personal sensitive information verification; the user sends an application request to the issuer, requests the personal information required by the user, indicates the relevant information that needs to be disclosed during the authentication process and shields other sensitive information, and requires the issuer to provide a selective disclosure authentication credential service; Step 3, confirm the application: This process is for the issuer to confirm the user's request and return the user's personal information. After receiving the request from the user and verifying the authenticity of the user's identity, the issuer will pre-sign the personal information in the name of the issuer according to the user's request and the user information stored in the system, and return the processed data to the user; Step 4, generate credentials: This process is for the user to use the selective disclosure cryptography technology to generate an authentication certificate for the processed data returned by the issuer, and send it to the verifier for further verification. In this process, the user processes the selectively disclosed data and the undisclosed data, and generates a verification certificate, which is sent to the verifier for verification; Step 5, verification result: After receiving the verification certificate sent by the user, the verifier parses and verifies the certificate to confirm the legitimacy of the user's identity, and further confirms whether the certificate provided by the user about his or her sensitive data is correct, and returns the verification result to the user; if the identity authentication is successful, the corresponding service or resource is provided to the user; if the identity authentication fails, the user's request is rejected.

2. According to claim 1, the cross-institutional user sensitive data authentication privacy protection method based on blockchain technology is characterized by: In step 1, the initialization setup includes the following sub-steps: 1) Input the system initialization parameter λ; set the system's elliptic curve BLS12-381; 2) Select two multiplicative cyclic groups (G1, G2) of prime order p as the authentication key pair; the curve function of G1 is y 2 =x 3 +4, the curve function of G2 is y 2 =x 3 +4(1+i); 3) Construct a large prime number p containing λ bits; g1, g2 are generators of (G1, G2); then It is λ-bit secure.

3. The cross-institutional user sensitive data authentication privacy protection method based on blockchain technology according to claim 1 is characterized by: In step 1, a trusted execution environment is initially formed by pre-building a blockchain for cross-institutional user identity authentication. All parties in the authentication scenario, such as government agencies, non-governmental organizations, enterprises, and individual users, access the blockchain network through initialization settings. After accessing the blockchain network, authentication credentials are transmitted and authentication information is confirmed on the chain by building special transaction transactions.

4. The cross-institutional user sensitive data authentication privacy protection method based on blockchain technology according to claim 3 is characterized by: When accessing the blockchain system, the following operations should be performed: 1) Calculate the user's address key pair (sk, pk); 2) Calculate the user's account address addr: = H(pk), where H is the agreed hash algorithm; 3) Generate a random vector group V = (v0, v1, ..., v L ), L is the specific length of the field group into which the message to be processed in the system is divided; 4) Generate the authentication key pair (sk', pk') based on the prime number p and the multiplication cyclic group, where sk' is a randomly selected point on G1, and pk' is the mapping of sk' on G2. The mapping function is u=(1+i) -1 .

5. The cross-institutional user sensitive data authentication privacy protection method based on blockchain technology according to claim 1 is characterized by: In step 2, the service application includes the following sub-steps: 1) The address addr of the issuing party where the user obtains the required personal information A ; 2) Construct the user's service request R, using the issuing party's public key pk B encryption; 3) Construct special transactions on the blockchain and send the constructed transaction information to the blockchain network.

6. The cross-institutional user sensitive data authentication privacy protection method based on blockchain technology according to claim 1 is characterized by: In step 3, confirming the application includes the following sub-steps: 1) The issuing party analyzes the special transaction constructed by the user's service application and obtains the specific details of the transaction constructed by the user; 2) Confirm the user source through the transaction address source, using their own private key sk B Perform analysis; 3) according to the user's request, find out the user's overall personal information M containing some selectively disclosed data requested by the user; 4) For each piece of information m in the user's overall personal information M i The issuer selects the parameter e and the random number s, and uses the issuer's own signature private key x to calculate Construct signature σ B =(A,e,s); 5) The issuer constructs a special transaction on the blockchain and sends the information to the blockchain.

7. The cross-institutional user sensitive data authentication privacy protection method based on blockchain technology according to claim 1 is characterized by: In step 4, generating credentials includes the following sub-steps: 1) The user parses the special transaction returned by the issuer to obtain the specific details of the transaction constructed by the issuer; 2) The user first verifies the signature information returned by the issuer, using the generators g1 and g2 of the multiplication cyclic group to construct a bilinear map to verify the correctness of the signature: 3) After confirming that the verification information is correct, the user randomly selects r1 and r2 and calculates the modular inverse of r1, r3 = r1 -1 , calculate the certificate for construction verification A', D and C; 4) Calculation 5) Calculation 6) Calculation 7) Information not included in the selective disclosure index calculate s = s - r2·r3; index is the message index that the user specifies in the signature request process that needs to be selectively disclosed; s' is the intermediate calculation value required in the restoration verification process of the random number s used in the signature link, where s'=s-r2*r3, where r3 is the modular inverse of r1; It is the ordinal number of the field among all the information fields that the user has not chosen to disclose; 8) The user generates his / her own user identity credentials, constructs a special transaction on the blockchain, and sends the information on the blockchain.

8. The cross-institutional user sensitive data authentication privacy protection method based on blockchain technology according to claim 1 is characterized by: In step 5, the verification result includes the following sub-steps: 1) The verifier parses the special transaction sent by the user and obtains the specific details of the transaction constructed by the issuer; 2) The verifier obtains the user-generated user identity verification credentials published by the user in the transaction; 3) The verifier verifies the parameters and calculates the equation whether it is established; 4) The verifier further verifies the equation whether it is established; The verifier further verifies the equation: whether it is established; 5) If all the above equations are verified, the user is deemed to have successfully authenticated his / her identity information and the corresponding services or resources are provided to the user; otherwise, the user request is rejected.

Images