Information processing method and device for zero-knowledge proof and storage medium

Abstract

The invention discloses an information processing method and device for zero-knowledge certification and a storage medium, and the method comprises the steps: firstly obtaining a local private key, generating a blinding factor according to the local private key, generating a commitment ciphertext of local sensitive information according to the blinding factor and the local sensitive information, and then transmitting the commitment ciphertext to a certificate issuing party, receiving a verifiable voucher which is generated by the voucher issuer according to the commitment ciphertext and signed and issued by the voucher issuer; when challenge information for the local sensitive information sent by a verification party is received, a certification ciphertext used for representing that the local sensitive information meets the challenge information is generated according to the challenge information, the local sensitive information and a blinding factor, and then the certification ciphertext and a verifiable certificate are sent to the verification party; and the verification party can perform zero-knowledge proof verification on the proof ciphertext according to the verifiable certificate. According to the embodiment of the invention, the additional storage cost of the blinding factor can be reduced. The embodiment of the invention can be applied to various scenes such as zero-knowledge proof based on the block chain.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and in particular to an information processing method, device and storage medium for zero-knowledge proof. Background Art

[0002] Zero-knowledge proof can make the verifier believe that a certain assertion is correct without providing any useful information to the verifier. In actual business scenarios, zero-knowledge proof can not only protect the privacy of users, but also prove the validity of information. At present, the algorithm schemes of zero-knowledge proof include zkSNARK, zkSTARKs, zkBoo, Sonic and BulletProofs. Among them, the zero-knowledge proof algorithm process of BulletProofs (Bulletproof Proof Protocol) can be roughly divided into three stages: the prover submits the commitment information, the prover generates the proof information and the verifier verifies the proof information. In the stage where the prover submits the commitment information, the prover will first randomly generate a blinding factor, and then generate the commitment information based on the blinding factor. However, since the blinding factor is randomly generated and not disclosed to the public, the prover needs to remember or save the blinding factor additionally, and it is necessary to ensure that the blinding factor is not leaked, thereby increasing the prover's additional custody cost for the blinding factor. Summary of the invention

[0003] The following is a summary of the subject matter described in detail herein. This summary is not intended to limit the scope of the claims.

[0004] The embodiments of the present application provide an information processing method, device, and storage medium for zero-knowledge proof, which can reduce the additional storage cost of blinding factors.

[0005] On the one hand, an embodiment of the present application provides an information processing method for zero-knowledge proof, comprising the following steps:

[0006] Obtaining a local private key, and generating a blinding factor according to the local private key;

[0007] Generate a commitment ciphertext of the local sensitive information according to the blinding factor and the local sensitive information, and send the commitment ciphertext to the credential issuer;

[0008] Receiving a verifiable credential generated by the credential issuer based on the commitment ciphertext and issued by the credential issuer;

[0009] When challenge information for the local sensitive information sent by the verifier is received, generating, according to the challenge information, the local sensitive information and the blinding factor, a proof ciphertext for representing that the local sensitive information satisfies the challenge information;

[0010] The proof ciphertext and the verifiable credential are sent to the verification party, so that the verification party verifies the proof ciphertext by zero-knowledge proof according to the verifiable credential.

[0011] On the other hand, an embodiment of the present application further provides an information processing device for zero-knowledge proof, including:

[0012] An information generating unit, configured to obtain a local private key and generate a blinding factor according to the local private key;

[0013] A ciphertext sending unit, configured to generate a commitment ciphertext of the local sensitive information according to the blinding factor and the local sensitive information, and send the commitment ciphertext to a credential issuer;

[0014] A credential receiving unit, configured to receive a verifiable credential generated by the credential issuer according to the commitment ciphertext and issued by the credential issuer;

[0015] a ciphertext generating unit, configured to, upon receiving challenge information for the local sensitive information sent by the verifier, generate, according to the challenge information, the local sensitive information and the blinding factor, a proof ciphertext for indicating that the local sensitive information satisfies the challenge information;

[0016] The information sending unit is used to send the proof ciphertext and the verifiable credential to the verification party, so that the verification party verifies the proof ciphertext by zero-knowledge proof according to the verifiable credential.

[0017] Optionally, the information generating unit is further used for:

[0018] Randomly obtain an encryption string used for information encryption;

[0019] A blinding factor is generated according to the encrypted string and the local private key.

[0020] Optionally, the information generating unit is further used for:

[0021] Randomly obtain an encryption string used for information encryption from multiple local information;

[0022] The local private key is hashed according to the encrypted character string to obtain a blinding factor.

[0023] Optionally, the information generating unit is further used for:

[0024] Fusing the local private key with the encrypted string to obtain a fused private key;

[0025] The fused private key is hashed to obtain a blinding factor.

[0026] Optionally, the verifiable credential includes the local sensitive information; and the information sending unit is further used for:

[0027] Desensitizing the local sensitive information in the verifiable credential to obtain the desensitized verifiable credential;

[0028] The certification ciphertext and the desensitized verifiable credential are sent to the verifier.

[0029] Optionally, the verifiable credential further includes a salt value used to encrypt the local sensitive information; and the information sending unit is further used to:

[0030] Performing hash processing on the local sensitive information according to the salt value to obtain desensitized information;

[0031] The local sensitive information in the verifiable credential is replaced with the desensitized information, and the value of the salt value in the verifiable credential is hidden to obtain the desensitized verifiable credential.

[0032] Optionally, the information sending unit is further used for:

[0033] Concatenate the local sensitive information with the salt value to obtain concatenated information;

[0034] The spliced ​​information is hashed to obtain desensitized information.

[0035] Optionally, the ciphertext generating unit is further used for:

[0036] Receive the identity information sent by the verifier, and obtain the distributed identity identifier of the verifier from the blockchain;

[0037] authenticating the verification party according to the identity information and the distributed identity identifier;

[0038] When the identity authentication succeeds, a proof ciphertext is generated based on the challenge information, the local sensitive information and the blinding factor, which is used to indicate that the local sensitive information satisfies the challenge information.

[0039] Optionally, the ciphertext generating unit is further used for:

[0040] Obtaining the public key of the verifier from the blockchain;

[0041] Using the public key to perform signature verification on the identity information to obtain a signature verification result;

[0042] According to the signature verification result, the identity information is matched with the distributed identity identifier to obtain a matching result;

[0043] The identity authentication result of the authenticator is determined according to the matching result.

[0044] Optionally, the information sending unit is further used for:

[0045] Signing the certification ciphertext and the verifiable credential using the local private key to obtain signature information;

[0046] The signature information is sent to the verification party.

[0047] Optionally, the information sending unit is further used for:

[0048] Packaging the certification ciphertext and the verifiable credential to obtain a verifiable representation;

[0049] The verifiable statement is signed using the local private key to obtain signature information.

[0050] On the other hand, an embodiment of the present application further provides an information processing device for zero-knowledge proof, including:

[0051] at least one processor;

[0052] at least one memory for storing at least one program;

[0053] When at least one of the programs is executed by at least one of the processors, the information processing method for zero-knowledge proof as described above is implemented.

[0054] On the other hand, an embodiment of the present application further provides a computer-readable storage medium, which stores a computer program executable by a processor. When the computer program executable by the processor is executed by the processor, it is used to implement the information processing method for zero-knowledge proof as described above.

[0055] On the other hand, an embodiment of the present application also provides a computer program product, including a computer program or computer instructions, wherein the computer program or the computer instructions are stored in a computer-readable storage medium, and a processor of an information processing device for zero-knowledge proof reads the computer program or the computer instructions from the computer-readable storage medium, and the processor executes the computer program or the computer instructions, so that the information processing device for zero-knowledge proof performs the information processing method for zero-knowledge proof as described above.

[0056] The embodiments of the present application include at least the following beneficial effects: first, a local private key is obtained, and a blinding factor is generated based on the local private key, and then a commitment ciphertext of the local sensitive information is generated based on the blinding factor and the local sensitive information, and then the commitment ciphertext is sent to the credential issuer, and then a verifiable credential generated by the credential issuer based on the commitment ciphertext and signed by the credential issuer is received; after receiving the verifiable credential, when challenge information for the local sensitive information sent by the verifier is received, first, based on the challenge information, the local sensitive information and the blinding factor, a proof ciphertext is generated for characterizing that the local sensitive information satisfies the challenge information, and then the proof ciphertext and the verifiable credential are sent to the verifier, so that the verifier can verify the proof ciphertext of zero-knowledge proof based on the verifiable credential, thereby realizing the entire process of zero-knowledge proof. Among them, since the local private key itself is private and random, the blinding factor generated according to the local private key can also be private and random, thereby reducing the risk of the blinding factor being leaked and improving the security of the blinding factor. Moreover, since the blinding factor can be generated according to the local private key, when the blinding factor is needed, it can be generated according to the local private key, and there is no need to store the blinding factor additionally, thereby reducing the additional storage cost of the blinding factor. In addition, after generating the commitment ciphertext of local sensitive information, by sending the commitment ciphertext to the credential issuer, so that the credential issuer generates and issues a verifiable credential based on the commitment ciphertext, the credential issuer can endorse the verifiable credential, thereby improving the authenticity of the commitment ciphertext in the verifiable credential, and since the credential issuer will also sign the verifiable credential, the commitment ciphertext in the verifiable credential cannot be tampered with, thereby improving the legitimacy of the commitment ciphertext.

[0057] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained through the structures particularly pointed out in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The accompanying drawings are used to provide further understanding of the technical solution of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solution of the present application and do not constitute a limitation on the technical solution of the present application.

[0059] Figure 1 It is a schematic diagram of the zero-knowledge proof algorithm process of BulletProofs in the related art;

[0060] Figure 2 It is a schematic diagram of an implementation environment provided by an embodiment of the present application;

[0061] Figure 3It is a schematic diagram of an application scenario provided by an embodiment of the present application;

[0062] Figure 4 is a schematic diagram of another application scenario provided by an embodiment of the present application;

[0063] Figure 5 is a flowchart of an information processing method for zero-knowledge proof provided by an embodiment of the present application;

[0064] Figure 6 Schematic diagram of the process of obtaining an encrypted string provided in an embodiment of the present application;

[0065] Figure 7 It is a schematic diagram of the process of realizing information fusion by direct splicing provided in an embodiment of the present application;

[0066] Figure 8 It is a schematic diagram of the process of realizing information fusion by breaking up and splicing provided in an embodiment of the present application;

[0067] Fig. 9 is a sample schematic diagram of a verifiable credential provided in an embodiment of the present application;

[0068] Fig.10 This is a sample schematic diagram of a DID document provided in an embodiment of the present application;

[0069] Fig.11 It is a schematic diagram of a process for desensitizing local sensitive information of a verifiable credential provided in an embodiment of the present application;

[0070] Fig.12 It is a sample schematic diagram of a verifiable expression provided by an embodiment of the present application;

[0071] Fig.13 It is a main flow chart of an information processing method for zero-knowledge proof provided by a specific example of this application;

[0072] Fig.14 It is a specific flow chart of an information processing method for zero-knowledge proof provided by a specific example of this application;

[0073] Fig.15 is a flowchart of the steps of an information processing method for zero-knowledge proof provided by a specific example of the present application;

[0074] Fig.16 is a schematic diagram of an information processing device for zero-knowledge proof provided in an embodiment of the present application;

[0075] Fig.17 It is a schematic diagram of another information processing device for zero-knowledge proof provided in an embodiment of the present application. DETAILED DESCRIPTION

[0076] The present application is further described below in conjunction with the accompanying drawings and specific embodiments. The described embodiments should not be regarded as limiting the present application, and all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0077] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0078] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0079] Before further describing the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations.

[0080] 1) Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer and application service layer. Blockchain can include public chain, alliance chain and private chain. Among them, public chain refers to a blockchain that anyone can enter the blockchain network at any time to read data, send data or compete for accounting; alliance chain refers to a blockchain jointly managed by several organizations or institutions; private chain refers to a blockchain with certain centralized control. The write right of the private chain account book is controlled by a certain organization or institution, and the access and use of data are strictly managed by permissions.

[0081] 2) Zero-knowledge proof is an underlying technology in the field of cryptography. The prover can convince the verifier that a certain assertion is correct without providing any useful information to the verifier. In actual business scenarios, zero-knowledge proof can not only protect the privacy of users, but also prove the validity of information. For example, in common asset proof scenarios, asset holders can use zero-knowledge proof to prove to a third party that their assets have reached a certain threshold without exposing their actual asset amount in order to obtain the rights and interests authorized by the third party.

[0082] 3) Verifiable Credentials (VC) is a digital identity verification technology that allows users to show their identity and qualifications to others without having to trust a third party or intermediary. The purpose of verifiable credentials is to improve the authenticity and security of information.

[0083] 4) Verifiable Presentation (VP), which aims to make it easier for users to demonstrate their identity and qualifications.

[0084] In the current related technologies, zero-knowledge proof can make the verifier believe that a certain assertion is correct without providing any useful information to the verifier. In actual business scenarios, zero-knowledge proof can not only protect the privacy of users, but also prove the validity of information. The current zero-knowledge proof algorithm solutions include zkSNARK, zkSTARKs, zkBoo, Sonic and BulletProofs. Figure 1 As shown in the figure, the zero-knowledge proof algorithm process of BulletProofs can be roughly divided into three stages: the proving party submits commitment information, the proving party generates proof information, and the verifier verifies the proof information:

[0085] (1) The prover submits commitment information: The prover generates a random blinding factor, which is not disclosed and is held by the prover. Then, the prover generates a commitment ciphertext Cx using the blinding factor and local sensitive information X (such as the prover’s actual asset amount, etc.), and discloses the commitment ciphertext Cx to the verifier to prevent the prover from changing the local sensitive information X, thereby achieving binding of the commitment ciphertext Cx.

[0086] (2) The prover generates proof information: When the verifier initiates a verification challenge to the prover, it requires the prover to prove that the local sensitive information X is within a certain range, for example, the local sensitive information X is greater than the threshold Y. In order to prove that the local sensitive information X is within the range greater than the threshold Y, the prover uses the blinding factor to generate a proof ciphertext with XY greater than 0, and sends the proof ciphertext to the verifier.

[0087] (3) Verification of proof information by the verifier: After receiving the proof ciphertext, the verifier first subtracts the threshold Y from the commitment ciphertext Cx through homomorphic encryption subtraction to calculate the ciphertext result Cz, and then uses the ciphertext result Cz to verify whether the proof ciphertext is authentic through the proof verification interface. If the verification operation fails, it means that the proof ciphertext is illegal. If the verification operation succeeds and the result of the verification operation is authentic, it means that the local sensitive information X is greater than the threshold Y. Otherwise, the local sensitive information X is less than the threshold Y.

[0088] According to the above-mentioned BulletProofs proof process, when the prover submits the commitment information, the prover needs to randomly generate a blinding factor first, and then generate the commitment information based on the blinding factor. However, since the blinding factor is randomly generated by the prover and is not disclosed to the public, the prover needs to remember or save the blinding factor additionally, and needs to ensure that the blinding factor is not leaked, which will increase the prover's additional custody cost for the blinding factor.

[0089] In order to reduce the additional storage cost of the blinding factor, the embodiments of the present application provide an information processing method for zero-knowledge proof, an information processing device for zero-knowledge proof, a computer-readable storage medium, and a computer program product. The prover first obtains a local private key, and generates a blinding factor based on the local private key, and then generates a commitment ciphertext of the local sensitive information based on the blinding factor and the local sensitive information, and then sends the commitment ciphertext to the credential issuer, and then receives a verifiable credential generated by the credential issuer based on the commitment ciphertext and issued by the credential issuer; after receiving the verifiable credential, when the prover receives challenge information for the local sensitive information sent by the verifier, the prover first generates a proof ciphertext for characterizing that the local sensitive information satisfies the challenge information based on the challenge information, the local sensitive information and the blinding factor, and then sends the proof ciphertext and the verifiable credential to the verifier, so that the verifier can verify the proof ciphertext for zero-knowledge proof based on the verifiable credential, thereby realizing the entire process of zero-knowledge proof. Among them, since the local private key of the prover itself is private and random, the blinding factor generated according to the local private key can also be private and random, thereby reducing the risk of the blinding factor being leaked and improving the security of the blinding factor. Moreover, since the blinding factor can be generated according to the local private key, when the prover needs to use the blinding factor, it only needs to generate the blinding factor according to the local private key, and there is no need to store the blinding factor additionally, thereby reducing the additional storage cost of the blinding factor. In addition, after the prover generates the commitment ciphertext of the local sensitive information, the prover sends the commitment ciphertext to the credential issuer so that the credential issuer generates and issues a verifiable credential based on the commitment ciphertext, which enables the credential issuer to endorse the verifiable credential, thereby improving the authenticity of the commitment ciphertext in the verifiable credential. Moreover, since the credential issuer will also sign the verifiable credential, the prover cannot tamper with the commitment ciphertext in the verifiable credential, thereby improving the legitimacy of the commitment ciphertext.

[0090] Reference Figure 2 , Figure 21 is a schematic diagram of an implementation environment provided by an embodiment of the present application. The implementation environment may include a first terminal 101, a second terminal 102, and a certificate issuing server 103. The first terminal 101 and the certificate issuing server 103 may be directly or indirectly connected via wired or wireless communication, and the first terminal 101 and the second terminal 102 may also be directly or indirectly connected via wired or wireless communication. Among them, the first terminal 101, the second terminal 102, and the certificate issuing server 103 may all be nodes in the blockchain, and this embodiment does not specifically limit this.

[0091] The first terminal 101 and the second terminal 102 may include but are not limited to smart phones, tablets, computers, intelligent voice interaction devices, smart home appliances, vehicle terminals, aircraft, etc. Among them, the first terminal 101 can be used as a prover in the zero-knowledge proof process, and the second terminal 102 can be used as a verifier in the zero-knowledge proof process. The first terminal 101 can generate a blinding factor, and generate a commitment ciphertext of the local sensitive information based on the blinding factor and the local sensitive information; the second terminal 102 can send a challenge message for the local sensitive information to the first terminal 101, so that the first terminal 101 can generate a proof ciphertext for representing that the local sensitive information meets the challenge information based on the challenge information, the local sensitive information and the blinding factor, so that the second terminal 102 can verify the proof ciphertext for zero-knowledge proof based on the commitment ciphertext of the first terminal 101.

[0092] The certificate issuing server 103 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Among them, the certificate issuing server 103 can be used as a trusted third party in the zero-knowledge proof process. For example, the certificate issuing server 103 can be a server deployed in an authoritative organization, which is used to endorse the commitment ciphertext of the first terminal 101.

[0093] Reference Figure 3As shown, in an application scenario, the first terminal 101 (i.e., the prover) stores non-public local sensitive information. The first terminal 101 can first obtain a local private key, and generate a blinding factor that is not disclosed to the public based on the local private key, and then generate a commitment ciphertext of the local sensitive information based on the blinding factor and the local sensitive information, and then send the commitment ciphertext to the credential issuing server 103 (i.e., the credential issuing party) for endorsement; upon receiving the commitment ciphertext sent by the first terminal 101, the credential issuing server 103 generates a verifiable credential based on the commitment ciphertext, signs the verifiable credential, and then signs the signed verifiable credential. The certificate is returned to the first terminal 101; after receiving the verifiable certificate signed by the certificate issuing server 103, when receiving the challenge information for local sensitive information sent by the second terminal 102 (i.e., the verifier), the first terminal 101 generates a proof ciphertext for representing that the local sensitive information meets the challenge information based on the challenge information, the local sensitive information, and the blinding factor, and then sends the proof ciphertext and the verifiable certificate to the second terminal 102; when receiving the proof ciphertext and the verifiable certificate sent by the first terminal 101, the second terminal 102 verifies the proof ciphertext with zero-knowledge proof based on the verifiable certificate. In the process of the second terminal 102 verifying the proof ciphertext with zero-knowledge proof based on the verifiable certificate, if the verification is successful, it means that the local sensitive information of the first terminal 101 meets the challenge information sent by the second terminal 102; if the verification is unsuccessful, it means that the local sensitive information of the first terminal 101 does not meet the challenge information sent by the second terminal 102.

[0094] Reference Figure 4As shown, in another application scenario, the first terminal 101 (i.e., the prover) stores non-public local sensitive information and public local terminal information (such as identity ID, user name, etc.). The first terminal 101 can first obtain the local private key and local terminal information, and generate a blinding factor that is not disclosed to the public based on the local private key and the local terminal information, and then generate a commitment ciphertext of the local sensitive information based on the blinding factor and the local sensitive information, and then send the commitment ciphertext to the credential issuing server 103 (i.e., the credential issuing party) for endorsement; when receiving the commitment ciphertext sent by the first terminal 101, the credential issuing server 103 generates a verifiable credential based on the commitment ciphertext, and Sign the verifiable credential, and then return the signed verifiable credential to the first terminal 101; after receiving the verifiable credential signed by the credential issuing server 103, when receiving the challenge information for the local sensitive information sent by the second terminal 102 (i.e., the verifier), the first terminal 101 generates a proof ciphertext for representing that the local sensitive information meets the challenge information based on the challenge information, the local sensitive information, and the blinding factor, and then sends the proof ciphertext and the verifiable credential to the second terminal 102; when receiving the proof ciphertext and the verifiable credential sent by the first terminal 101, the second terminal 102 verifies the proof ciphertext by zero-knowledge proof according to the verifiable credential. In the process of the second terminal 102 verifying the proof ciphertext by zero-knowledge proof according to the verifiable credential, if the verification is successful, it means that the local sensitive information of the first terminal 101 meets the challenge information sent by the second terminal 102; if the verification is unsuccessful, it means that the local sensitive information of the first terminal 101 does not meet the challenge information sent by the second terminal 102.

[0095] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on the attribute information or attribute information set of the target object (such as a user, etc.) and other data related to the characteristics of the target object, the permission or consent of the target object will be obtained first, and the collection, use and processing of these data will comply with relevant laws, regulations and standards. In addition, when the embodiment of the present application needs to obtain the attribute information of the target object, the separate permission or separate consent of the target object will be obtained through a pop-up window or jump to a confirmation page. After clearly obtaining the separate permission or separate consent of the target object, the relevant data of the target object necessary for the normal operation of the embodiment of the present application is obtained.

[0096] Figure 5This is a flowchart of an information processing method for zero-knowledge proof provided in an embodiment of the present application. The information processing method for zero-knowledge proof can be executed by a single terminal (such as the first terminal mentioned above), or by multiple terminals in cooperation (such as the first terminal and the second terminal mentioned above), or by a terminal and a server in cooperation (such as the first terminal, the second terminal and the certificate issuing server mentioned above). In the embodiment of the present application, the method is described by taking the execution of a single terminal (such as the first terminal mentioned above) as an example. Figure 5 , the information processing method for zero-knowledge proof may include but is not limited to steps 510 to 550.

[0097] Step 510: Obtain a local private key, and generate a blinding factor according to the local private key.

[0098] In the related art, when the prover and the verifier cooperate with each other to perform the process of zero-knowledge proof, the prover needs to first generate a commitment ciphertext bundled with the prover's local sensitive information, and needs to send the commitment ciphertext to the verifier, which can not only enable the verifier to use it in the subsequent steps to verify the proof ciphertext sent by the prover, but also can be used to prevent the prover from changing the local sensitive information during the zero-knowledge proof process, thereby ensuring the fairness of the zero-knowledge proof. Among them, when the prover generates the commitment ciphertext bundled with the local sensitive information, it is necessary to randomly generate a blinding factor first, and then generate the commitment ciphertext based on the blinding factor and the local sensitive information. However, since the blinding factor is randomly generated by the prover and is not disclosed to the outside, the prover needs to remember or save the blinding factor additionally, and needs to ensure that the blinding factor is not leaked, that is, the blinding factor needs to be properly kept to avoid attacks by malicious persons, thereby increasing the prover's additional custody cost for the blinding factor. In order to reduce the prover's additional custody cost for the blinding factor, in this step, the prover first obtains the local private key, and then the local private key generates the blinding factor. Since the local private key of the prover itself is private and random, the blinding factor generated based on the local private key can also be private and random, thereby reducing the risk of the blinding factor being leaked and improving the security of the blinding factor. Moreover, since the blinding factor can be generated based on the local private key, when the blinding factor is needed, it only needs to be generated based on the local private key, and there is no need for additional custody of the blinding factor, thereby reducing the additional custody cost of the blinding factor.

[0099] In one embodiment, the process of generating a blinding factor according to the local private key by the prover may include the following steps:

[0100] Randomly obtain an encryption string used for information encryption;

[0101] Generates a blinding factor based on the encrypted string and the local private key.

[0102] Among them, since the encryption string used for information encryption is obtained randomly, after the blinding factor is generated according to the encryption string and the local private key, the randomness of the blinding factor can be improved, thereby playing a role in preventing collisions.

[0103] In one embodiment, the encryption string used for information encryption can be obtained by random generation, or can be randomly obtained from multiple local information of the prover, which is not specifically limited here. Figure 6 As shown, Figure 6 The following is an example of how to obtain the encrypted string. Figure 6 When the prover randomly obtains the encrypted string for information encryption, it can use the preset random string generation module 610 to randomly generate a string 620, and then use the string 620 as the encrypted string 630 for information encryption; or, it can determine a target local information 650 from the prover's multiple local information 640, and then use the target local information 650 or the local information of the target local information 650 as the encrypted string 630 for information encryption, wherein these local information 640 can include the prover's distributed identity (Decentralized Identifiers, DID), user name, user IP, user age and other information, which are not specifically limited here. When the encrypted string is randomly obtained by the prover from multiple local information, since the encrypted string is the prover's own local information, the prover does not need to save the encrypted string additionally, so there is no need for additional memory cost for the encrypted string, and the additional storage cost of the blinding factor can be reduced.

[0104] In one embodiment, when the prover generates a blinding factor based on the encrypted string and the local private key, the prover may perform a hash process on the local private key based on the encrypted string to obtain the blinding factor. Since the hash process is irreversible, the blinding factor obtained by performing a hash process on the local private key based on the encrypted string is irreversible, thereby avoiding the situation where the local private key is inferred from the blinding factor, thereby improving the security of the blinding factor. In one embodiment, the hash process performed on the local private key based on the encrypted string may be a hash calculation performed on the local private key based on the encrypted string, such as a hash calculation based on the encrypted string based on the SHA256 function, which is not specifically limited here.

[0105] In one embodiment, the process of the prover performing hashing on the local private key according to the encrypted string to obtain the blinding factor may include the following steps:

[0106] The local private key is merged with the encrypted string to obtain a merged private key;

[0107] The fused private key is hashed to obtain the blinding factor.

[0108] Among them, by fusing the local private key with the encrypted string, the obtained fused private key can be made random. Moreover, since the local private key itself is private, after hashing the fused private key, the obtained blinding factor can be made private, random and irreversible at the same time, thereby effectively improving the security of the blinding factor.

[0109] In one embodiment, when the prover fuses the local private key with the encrypted string to obtain the fused private key, the encrypted string can be directly spliced ​​to the back of the local private key to achieve information fusion of the local private key and the encrypted string, or the local private key and the encrypted string can be scattered and then spliced ​​to achieve information fusion of the local private key and the encrypted string, which is not specifically limited here. Figure 7 and Figure 8 As shown, Figure 7 The process of achieving information fusion by directly concatenating the local private key and the encrypted string is given as an example. Figure 8 The process of realizing information fusion by scrambling and splicing the local private key and the encrypted string is given as an example. Figure 7 When the prover fuses the local private key with the encrypted string to obtain the fused private key, the prover may first shift the local private key 710 to the left by the number of bits of the encrypted string 720 to obtain a string 730 consisting of the value of the local private key 710 and a plurality of consecutive 0s, wherein the number of these consecutive 0s is consistent with the number of bits of the encrypted string 720. Then, these consecutive 0s are updated to the value of the encrypted string 720 to achieve direct concatenation of the local private key 710 and the encrypted string 720, i.e., to achieve information fusion of the local private key 710 and the encrypted string 720. At this time, the concatenation result is the fused private key 740. Figure 8 When the prover fuses the local private key with the encrypted string to obtain the fused private key, the prover can first break up the local private key 810 and the encrypted string 820 respectively to obtain multiple local private key sub-parts A and multiple encrypted string sub-parts B, and then randomly splice the multiple local private key sub-parts A and the multiple encrypted string sub-parts B, thereby realizing the information fusion of the local private key 810 and the encrypted string 820. At this time, the splicing result obtained is the fused private key 830.

[0110] Step 520: Generate a commitment ciphertext of the local sensitive information according to the blinding factor and the local sensitive information, and send the commitment ciphertext to the credential issuer.

[0111] In one embodiment, since the blinding factor has been generated based on the local private key, a commitment ciphertext of the local sensitive information can be generated based on the blinding factor and the local sensitive information, and then the commitment ciphertext is sent to the credential issuer, so that the credential issuer can endorse the commitment ciphertext to improve the authenticity of the commitment ciphertext.

[0112] In one embodiment, when the prover generates the commitment ciphertext of the local sensitive information according to the blinding factor and the local sensitive information, the following formula (1) may be used to generate the commitment ciphertext of the local sensitive information:

[0113] C=x·G+r·H (1)

[0114] In the above formula (1), C is the commitment ciphertext of the local sensitive information, x is the local sensitive information, r is the blinding factor, and G and H are randomly generated points on the elliptic curve. Since G and H are randomly generated points on the elliptic curve, x·G and r·H can be regarded as public keys on the elliptic curve, and x and r can be regarded as private keys on the elliptic curve. Therefore, when it is necessary to generate the commitment ciphertext, a specific elliptic curve can be determined first, and then the random generated point G and the random generated point H on the elliptic curve can be determined. Then, the multiplication result of the local sensitive information x and the random generated point G and the multiplication result of the blinding factor r and the random generated point H are added to obtain the commitment ciphertext C of the local sensitive information x.

[0115] Step 530: Receive a verifiable credential generated by the credential issuer based on the commitment ciphertext and signed by the credential issuer.

[0116] In one embodiment, after the prover sends the commitment ciphertext to the credential issuer, the credential issuer can generate a verifiable credential based on the commitment ciphertext, then sign the verifiable credential, and then send the signed verifiable credential to the prover, so that the prover can use the verifiable credential to perform zero-knowledge proof to the verifier after receiving the challenge information sent by the verifier for local sensitive information.

[0117] In one embodiment, the credential issuer is generally an institution with a certain authority. Due to the need to meet compliance requirements, when issuing a verifiable credential to the prover, the credential issuer usually needs to obtain the prover's local sensitive information (such as asset proof or sensitive information such as age), and needs to verify whether the commitment ciphertext is consistent with the local sensitive information. Only when the verification is passed, that is, the verification result is that the commitment ciphertext is consistent with the local sensitive information, will the verifiable credential be issued to the prover; in addition, since the commitment ciphertext is generated by performing an irreversible algorithm on the local sensitive information and the blinding factor, in order to enable the credential issuer to effectively issue a verifiable credential to the prover, the prover needs to send the commitment ciphertext, the blinding factor and the local sensitive information together to the credential issuer. Therefore, when the prover sends the commitment ciphertext to the credential issuer, the commitment ciphertext, the blinding factor and the local sensitive information can be sent together to the credential issuer, so that the credential issuer verifies the commitment ciphertext according to the blinding factor and the local sensitive information, generates a verifiable credential based on the commitment ciphertext and the local sensitive information, and signs the verifiable credential using the credential issuer's own private key. After the credential issuer signs the verifiable credential with its own private key, the credential issuer will send the signed verifiable credential to the proving party. Therefore, after receiving the verifiable credential issued by the credential issuer, the proving party can use the verifiable credential to perform zero-knowledge proof to the proving party when receiving the challenge information for local sensitive information sent by the proving party. When the credential issuer verifies the commitment ciphertext based on the blinding factor and the local sensitive information, it can first generate the commitment verification ciphertext based on the blinding factor and the local sensitive information, and then determine whether the commitment verification ciphertext is consistent with the commitment ciphertext. If they are consistent, it means that the verification of the commitment ciphertext is successful. If they are inconsistent, it means that the verification of the commitment ciphertext is unsuccessful. When the credential issuer generates the verifiable credential based on the commitment ciphertext and the local sensitive information, it can first determine the data structure of the verifiable credential, and then package the commitment ciphertext and the local sensitive information according to the data structure to obtain the verifiable credential.

[0118] In one embodiment, an example of a verifiable credential signed by a credential issuer can be found at Fig. 9 As shown, in Fig. 9In the example shown, the verifiable credential signed by the credential issuer may include different fields such as credentialSubject field 910, signatureValue field 920 and salt field 930. Among them, credentialSubject field 910 is a standard field. The credentialSubject field 910 may include a commitment field and an age field. The content in the commitment field is a zero-knowledge proof commitment (i.e., commitment ciphertext). The content in the age field is local sensitive information. The content in the commitment field and the content in the age field need to be ensured to be consistent by the credential issuer. In addition, signatureValue field 920 is also a standard field. Signature verification of the verifiable credential can be performed through the public key of the credential issuer, so that it can be checked whether the verifiable credential is issued by the credential issuer. In addition, the content in salt field 930 is an encrypted string (or salt value) used to avoid replay attacks.

[0119] According to the zero-knowledge proof algorithm process of BulletProofs described above, it can be known that in the zero-knowledge proof algorithm process of BulletProofs in the related art, there is a lack of identity authentication processing between the participating parties and authenticity verification processing of the commitment ciphertext by the credential issuer. Therefore, the entire zero-knowledge proof process is not friendly in the implementation of actual business scenarios. In order to overcome the above shortcomings, in one embodiment, after the credential issuer receives the commitment ciphertext sent by the prover, before generating a verifiable credential based on the commitment ciphertext, the credential issuer can first verify the DID identity of the prover. When the verification is successful, the credential issuer generates a verifiable credential based on the commitment ciphertext. By first verifying the legitimacy of the DID identity of the prover, it can be ensured that the commitment ciphertext sent by the prover is legal, thereby ensuring the security and reliability of the verifiable credential generated based on the commitment ciphertext.

[0120] In one embodiment, when the credential issuer verifies the DID identity of the proving party, the credential issuer may first request identity information from the proving party. At this time, the proving party will use its own private key to sign the identity information, and then send the signed identity information to the credential issuer; after receiving the signed identity information sent by the proving party, the credential issuer obtains the DID identity of the proving party and the public key of the proving party from the blockchain, and then uses the public key of the proving party to perform signature verification on the signed identity information; if the signature verification fails, it means that the identity information received by the credential issuer is illegal. If the signature verification succeeds, it means that the identity information received by the credential issuer is legal. At this time, the credential issuer will determine whether the identity information sent by the proving party matches the DID identity of the proving party to realize the DID identity verification of the proving party. If the identity information sent by the proving party matches the DID identity of the proving party, it means that the DID identity verification of the proving party is successful. If the identity information sent by the proving party does not match the DID identity of the proving party, it means that the DID identity verification of the proving party is unsuccessful.

[0121] It should be noted that the DID identity is a string of unmemorable characters that does not contain any identity privacy information and cannot be aggregated. For example, "did:tdid:c1:0xd4d131ce58fbe372ce9a6b11f8d3d75b53ffbd62" is an example of a DID identity. By parsing the DID identity, a DID document in json format can be obtained. Among them, the DID document is bound to the authentication public key of the DID identity and stored on the blockchain. Therefore, by adopting an asymmetric encryption algorithm, it is possible to verify whether the data signed by the private key holder matches the public key on the blockchain, thereby proving whether the DID identity is held by the holder.

[0122] In one embodiment, a sample DID document can be found at Fig.10 As shown, in Fig.10 In the example shown, the DID document may include different fields such as the id field 1010 and the verificationMethod field 1020. The id field 1010 is a standard field used to record the DID identity of the identity holder (e.g., the proving party). In addition, the verificationMethod field 1020 is also a standard field, and the content in the verificationMethod field 1020 includes the digital signature method of the holder of the DID identity (e.g., the proving party) and the public key used to verify the digital signature.

[0123] Step 540: When challenge information for local sensitive information sent by the verifier is received, a proof ciphertext is generated based on the challenge information, the local sensitive information and the blinding factor to indicate that the local sensitive information satisfies the challenge information.

[0124] In one embodiment, after receiving the verifiable credential issued by the credential issuer, when the prover receives challenge information regarding local sensitive information from the verifier, it indicates that the verifier requests to perform zero-knowledge proof regarding the local sensitive information. At this time, the prover can generate a proof ciphertext that characterizes that the local sensitive information satisfies the challenge information based on the challenge information, the local sensitive information and the blinding factor, so that subsequent steps can use the proof ciphertext and the received verifiable credential to perform zero-knowledge proof regarding the local sensitive information with the verifier.

[0125] In one embodiment, the challenge information may include challenge content and a challenge threshold, wherein the challenge content describes the size relationship between the local sensitive information and the challenge threshold that needs to be satisfied. For example, the challenge information may be that the local sensitive information is greater than the challenge threshold, or that the local sensitive information is less than the challenge threshold, and so on. No specific limitation is made here.

[0126] Since the zero-knowledge proof algorithm of BulletProofs in the related art lacks identity authentication processing between the participants, it is easy to have security risks. Therefore, in order to solve this problem, the proving party can first perform DID identity authentication on the verifying party in the process of generating a proof ciphertext for representing that the local sensitive information meets the challenge information based on the challenge information, local sensitive information and blinding factor. When the DID identity authentication is successful, the proving party generates a proof ciphertext based on the challenge information, local sensitive information and blinding factor. Therefore, in one embodiment, the process of the proving party generating a proof ciphertext for representing that the local sensitive information meets the challenge information based on the challenge information, local sensitive information and blinding factor can include the following steps:

[0127] Receive the identity information sent by the verifier and obtain the DID identity of the verifier from the blockchain;

[0128] Authentication of the verification party is performed based on the identity information and DID identity identification;

[0129] When the identity authentication succeeds, a proof ciphertext is generated based on the challenge information, the local sensitive information and the blinding factor, which is used to represent that the local sensitive information satisfies the challenge information.

[0130] Among them, when the proving party authenticates the identity of the verifier according to the identity information and the DID identity identifier, the proving party can first obtain the public key of the verifier from the blockchain, and use the public key to perform signature verification on the identity information of the verifier to obtain the signature verification result, and then match the identity information of the verifier with the DID identity identifier of the verifier according to the signature verification result to obtain the matching result, and then determine the identity verification result of the verifier according to the matching result. Specifically, when the signature verification result is unsuccessful, it means that the identity information received by the proving party is illegal. If the signature verification is successful, it means that the identity information received by the proving party is legal. At this time, the proving party will match the identity information sent by the verifier with the DID identity identifier of the verifier to obtain the matching result, so that the DID identity verification of the verifier can be realized according to the matching result. If the matching result is that the identity information sent by the verifier matches the DID identity identifier of the verifier, the DID identity verification result of the verification party can be obtained, and if the matching result is that the identity information sent by the verifier does not match the DID identity identifier of the verifier, the DID identity verification result of the verification party can be obtained.

[0131] In one embodiment, when the prover generates a proof ciphertext for representing that the local sensitive information satisfies the challenge information based on the challenge information, the local sensitive information and the blinding factor, the prover may first generate proof information for representing that the local sensitive information satisfies the challenge information based on the challenge information and the local sensitive information, and then encrypt the proof information using the blinding factor to obtain the proof ciphertext. For example, assuming that the local sensitive information is X, the challenge threshold in the challenge information is Y, and the challenge information is that the local sensitive information X is greater than the challenge threshold Y, then after the prover generates proof information for representing that the local sensitive information satisfies the challenge information based on the challenge information and the local sensitive information, the obtained proof information may be XY>0, and then, after the prover encrypts the proof information using the blinding factor, the obtained proof ciphertext may be P(XY)>0.

[0132] Step 550: Send the proof ciphertext and the verifiable credential to the verification party, so that the verification party can verify the zero-knowledge proof of the proof ciphertext based on the verifiable credential.

[0133] In one embodiment, after the prover generates a proof ciphertext for representing that local sensitive information satisfies the challenge information, the prover may send the proof ciphertext and the verifiable credential to the verifier, so that the verifier can verify the proof ciphertext based on the verifiable credential to perform zero-knowledge proof, thereby completing the entire zero-knowledge proof process.

[0134] In one embodiment, for different application scenarios, the prover may hide or expose the local sensitive information in the verifiable credential, so that the verifiable credential can be applied to different scenario requirements. For example, in some scenarios where zero-knowledge proof is not required, the prover may not hide the local sensitive information in the verifiable credential, so that the verifier can directly obtain the local sensitive information from the verifiable credential to verify the proof ciphertext, thereby improving the efficiency of information verification. For another example, in some scenarios where zero-knowledge proof is required, the prover may hide the local sensitive information in the verifiable credential. At this time, the verifier needs to verify the proof ciphertext by means of zero-knowledge proof, thereby improving the security of the prover's local sensitive information and avoiding the leakage of the prover's local sensitive information. In order to achieve the above purpose, the prover needs to perform corresponding signature processing on the verifiable credential according to the current application scenario before sending the proof ciphertext and the verifiable credential to the verifier, so that the verifiable credential can hide or expose the local sensitive information based on the current application scenario.

[0135] In one embodiment, the verifiable credential may include local sensitive information. In the current application scenario where the local sensitive information in the verifiable credential needs to be hidden, when the proving party sends the proof ciphertext and the verifiable credential to the verifier, the local sensitive information in the verifiable credential may be desensitized to obtain the desensitized verifiable credential, and then the proof ciphertext and the desensitized verifiable credential are sent to the verifier. In this way, since the local sensitive information in the verifiable credential is desensitized, the local sensitive information in the verifiable credential is hidden, so that the scenario requirements of the current application scenario can be met, thereby improving the security of the local sensitive information of the proving party and avoiding leakage of the local sensitive information of the proving party.

[0136] In one embodiment, the verifiable credential may also include a salt value for encrypting local sensitive information, and the salt value may be a randomly generated string. In this case, when the prover desensitizes the local sensitive information in the verifiable credential to obtain the desensitized verifiable credential, the prover may first hash the local sensitive information according to the salt value to obtain the desensitized information, and then replace the local sensitive information in the verifiable credential with the desensitized information, and hide the value of the salt value in the verifiable credential to obtain the desensitized verifiable credential. By replacing the local sensitive information in the verifiable credential with the desensitized information obtained by hashing the local sensitive information according to the salt value, and hiding the value of the salt value in the verifiable credential, the local sensitive information can be hidden more effectively, so that the verifier cannot obtain the local sensitive information of the prover by reverse deduction, thereby more effectively improving the security of the local sensitive information of the prover. Reference Fig.11 As shown, Fig.11The process of desensitizing local sensitive information in verifiable credentials is given as an example. Fig.11 In the example, it is assumed that the verifiable credential includes a name field 1110, an age field 1120, and a salt field 1130, wherein the content in the age field 1120 is local sensitive information that needs to be hidden. The proving party digitally signs the verifiable credential by first hashing each field in the verifiable credential one by one and then hashing the entire field. That is, the signed verifiable credential can be expressed as: sign(hash(name+salt1)+hash(age+salt2)), wherein sign() represents the signature algorithm, hash() represents the hash algorithm, name represents the content in the name field 1110, salt1 represents the salt value of name, age represents the content in the age field 1120, salt2 represents the salt value of age, and the values ​​of salt1 and salt2 are both recorded in the salt field 1130. When it is necessary to hide the content in the age field 1120 (i.e., local sensitive information), the proving party first obtains the value of age from the age field 1120 of the verifiable credential, and obtains the salt value of age (i.e., salt2) in the salt field 1130, and then calculates the formula hash(age+salt2) to obtain the value of hash(age+salt2) as X (i.e., desensitized information). Next, the proving party replaces the value of the age field 1120 in the verifiable credential with X, and hides the value of salt2 in the salt field 1130 (for example, setting it to 0, etc.). At this time, the desensitized verifiable credential can be obtained. When the subsequent verifier verifies the desensitized verifiable credential, since the value recorded in the age field 1120 in the desensitized verifiable credential is X, and the value of salt2 in the salt field 1130 is hidden, the verifier will verify the signature based on the formula sign(hash(name+salt1)+X), so that the verifier can successfully verify the desensitized verifiable credential without leaking the local sensitive information of the prover.

[0137] In one embodiment, when the prover performs hash processing on the local sensitive information according to the salt value to obtain desensitized information, the prover may first concatenate the local sensitive information with the salt value to obtain concatenated information, and then perform hash processing on the concatenated information to obtain desensitized information. By first concatenating the local sensitive information with the salt value to obtain the concatenated information, the concatenated information can be made random and can prevent replay attacks, thereby effectively improving the security of the local sensitive information.

[0138] In one embodiment, when the proving party sends the proof ciphertext and the verifiable credential to the verifying party, the proving party may first use the local private key to sign the proof ciphertext and the verifiable credential to obtain signature information, and then send the signature information to the verifying party. By using the local private key to sign the proof ciphertext and the verifiable credential, the legitimacy of the proof ciphertext and the verifiable credential can be guaranteed, and the proof ciphertext and the verifiable credential can be prevented from being tampered with.

[0139] In one embodiment, when the prover uses the local private key to sign the proof ciphertext and the verifiable credential to obtain the signature information, the prover can first package the proof ciphertext and the verifiable credential to obtain the verifiable statement, and then use the local private key to sign the verifiable statement to obtain the signature information. By using the verifiable statement to carry the proof ciphertext and the verifiable credential, and using the local private key to sign the verifiable statement to realize the confirmation of the prover's behavior in the zero-knowledge proof process, not only can the security and reliability of the proof process be ensured, but also the entire zero-knowledge proof process can be easily implemented in actual business scenarios, thereby providing better operability for the implementation of actual business scenarios. Among them, when the prover packages the proof ciphertext and the verifiable credential to obtain the verifiable statement, the data structure of the verifiable statement can be determined first, and then the proof ciphertext and the verifiable credential are packaged according to the data structure to obtain the verifiable statement. In addition, after the prover signs the verifiable statement using the local private key, the content of the signature will be saved in the verifiable statement.

[0140] In one embodiment, examples of verifiable statements can be found at Fig.12 As shown, in Fig.12In the example shown, the verifiable statement may include different fields such as a commitmentProof field 1210, a verifiableCredential field 1220, a nonce field 1230, a verificationMethod field 1240, and a signatureValue field 1250. Among them, the commitmentProof field 1210 is an extended field used to record the proof ciphertext; the verifiableCredential field 1220 is a standard field used to record the verifiable credential; the nonce field 1230 is a standard field used to record the verification random value to prevent replay attacks; the verificationMethod field 1240 is a standard field used to record the digital signature method of the prover, which is generally the content recorded in the verificationMethod field 1020 in the DID document of the prover; the signatureValue field 1250 is a standard field used to record the digital signature content of the prover. Among them, when the local sensitive information is hidden in the verifiable credential, the content in the commitmentProof field 1210 can be used to prove that the local sensitive information meets the challenge information sent by the verifier.

[0141] In this embodiment, through the information processing method for zero-knowledge proof including the previous steps 510 to 550, the prover first obtains the local private key, generates a blinding factor based on the local private key, and then generates a commitment ciphertext of the local sensitive information based on the blinding factor and the local sensitive information, and then sends the commitment ciphertext to the credential issuer, and then receives the verifiable credential generated by the credential issuer based on the commitment ciphertext and issued by the credential issuer; after receiving the verifiable credential, when the prover receives the challenge information for the local sensitive information sent by the verifier, the prover first generates a proof ciphertext for characterizing that the local sensitive information satisfies the challenge information based on the challenge information, the local sensitive information and the blinding factor, and then sends the proof ciphertext and the verifiable credential to the verifier, so that the verifier can verify the proof ciphertext of zero-knowledge proof based on the verifiable credential, thereby realizing the entire process of zero-knowledge proof. Among them, since the local private key of the prover itself is private and random, the blinding factor generated according to the local private key can also be private and random, thereby reducing the risk of the blinding factor being leaked and improving the security of the blinding factor. Moreover, since the blinding factor can be generated according to the local private key, when the prover needs to use the blinding factor, it only needs to generate the blinding factor according to the local private key, and there is no need to store the blinding factor additionally, thereby reducing the additional storage cost of the blinding factor. In addition, after the prover generates the commitment ciphertext of the local sensitive information, the prover sends the commitment ciphertext to the credential issuer so that the credential issuer generates and issues a verifiable credential based on the commitment ciphertext, which enables the credential issuer to endorse the verifiable credential, thereby improving the authenticity of the commitment ciphertext in the verifiable credential. Moreover, since the credential issuer will also sign the verifiable credential, the prover cannot tamper with the commitment ciphertext in the verifiable credential, thereby improving the legitimacy of the commitment ciphertext.

[0142] The following is a detailed description of the information processing method for zero-knowledge proof provided in the embodiments of the present application using specific examples.

[0143] Reference Fig.13 As shown, Fig.13 This is a main flow chart of the information processing method for zero-knowledge proof provided by a specific example. Fig.13In the example, the proving party 1310, the credential issuer 1320 and the verifier 1330 can all be connected to a protocol module 1340, and the proving party 1310, the credential issuer 1320 and the verifier 1330 can all verify each other's DID identity through the protocol module 1340. In addition, during the interaction between the proving party 1310, the credential issuer 1320 and the verifier 1330, the relevant DID identity and verifiable credentials can be chained to the blockchain network 1350 through the protocol module 1340. Therefore, the proving party 1310, the credential issuer 1320 and the verifier 1330 can all realize decentralized identification and verification of identity through the tamper-proof characteristics of the blockchain network 1350.

[0144] Combine the following Fig.13 The zero-knowledge proof process between the prover 1310 , the credential issuer 1320 , and the verifier 1330 is described in detail.

[0145] The prover 1310 generates a blinding factor based on the local private key, and generates a commitment ciphertext based on the blinding factor and local sensitive information, and then submits the commitment ciphertext to the credential issuer 1320. After receiving the commitment ciphertext, the credential issuer 1320 first performs DID identity authentication on the prover 1310 through the protocol module 1340 and the blockchain network 1350. When the DID identity authentication is successful, the credential issuer 1320 generates a verifiable credential based on the commitment ciphertext, digitally signs the verifiable credential, and then sends the digitally signed verifiable credential to the prover 1310; wherein the verifiable credential contains the DID identity identification and commitment ciphertext of the prover 1310, and since the verifiable credential contains the digital signature of the credential issuer 1320, the prover 1310 cannot tamper with its public commitment ciphertext. When the verifier 1330 initiates a proof challenge to the prover 1310, the prover 1310 first performs DID identity authentication on the verifier 1330 through the protocol module 1340 and the blockchain network 1350. When the DID identity authentication is successful, the prover 1310 generates a proof ciphertext based on BulletProofs, and uses the protocol module 1340 to package the proof ciphertext and the verifiable credential to obtain a verifiable statement, and then uses the local private key to digitally sign the verifiable statement, and then sends the digitally signed verifiable statement to the verifier 1330; wherein the verifiable statement contains the verifiable credential issued by the credential issuer 1320 and the digital signature of the prover 1310, thereby ensuring the integrity of the proof content and that the proof behavior is initiated autonomously by the prover 1310. After receiving the digitally signed verifiable statement, the verifier 1330 first performs DID identity verification on the prover 1310 through the protocol module 1340 and the blockchain network 1350, including verifying whether the verifiable statement is issued by the prover 1310 and verifying whether the verifiable credential is issued by the credential issuer 1320. When the DID identity verification is successful, the verifier 1330 verifies whether the commitment ciphertext in the verifiable credential and the proof ciphertext in the verifiable statement meet the preset proof conditions through the BulletProofs zero-knowledge proof algorithm, thereby completing the entire zero-knowledge proof process.

[0146] Reference Fig.14 As shown, Fig.14 This is a specific flow chart of the information processing method for zero-knowledge proof provided by a specific example. Fig.14 In the embodiment, the prover 1401 is connected to the first protocol module 1402, the credential issuer 1403 is connected to the second protocol module 1404, and the verifier 1405 is connected to the third protocol module 1406. The process in which the prover 1401, the credential issuer 1403, and the verifier 1405 cooperate with each other to implement zero-knowledge proof may include the following steps 1411 to 1418.

[0147] Step 1411: The prover generates a blinding factor using a local private key.

[0148] Step 1412: The prover generates a commitment ciphertext of the local sensitive information based on the blinding factor and the local sensitive information.

[0149] Step 1413: The prover sends the blinding factor, commitment ciphertext, and local sensitive information to the credential issuer.

[0150] Step 1414: The credential issuer verifies the commitment ciphertext using the blinding factor and local sensitive information. When the verification is successful, execute step 1415.

[0151] Step 1415: The credential issuer sends the commitment ciphertext and local sensitive information to the second protocol module.

[0152] Step 1416: The second protocol module generates a verifiable credential based on the commitment ciphertext and the local sensitive information, and sends the verifiable credential to the credential issuer.

[0153] Step 1417: The certificate issuer signs the verifiable certificate using its own private key to obtain the signed verifiable certificate.

[0154] Step 1418: The credential issuer sends the signed verifiable credential to the proving party.

[0155] Step 1419: The verifier sends a challenge message to the prover, requiring the prover to prove that it has local sensitive information with a value greater than the challenge threshold.

[0156] Step 1420: The prover uses the blinding factor, local sensitive information and challenge information to generate a proof ciphertext that represents that the local sensitive information satisfies the challenge information.

[0157] Step 1421: The proving party sends the proving ciphertext and the signed verifiable credential to the first protocol module.

[0158] Step 1422: The first protocol module generates a verifiable statement based on the proof ciphertext and the signed verifiable credential, and sends the verifiable statement to the proving party.

[0159] Step 1423: The prover signs the verifiable statement using the local private key to obtain the signed verifiable statement.

[0160] Step 1424: The prover sends the signed verifiable statement to the verifier.

[0161] Step 1425: The verifier sends the signed verifiable statement to the third protocol module.

[0162] Step 1426: The third protocol module parses and verifies the signed verifiable statement and the verifiable credential in the verifiable statement, obtains the verification result of the verifiable statement and the verification result of the verifiable credential, and sends the verification result of the verifiable statement and the verification result of the verifiable credential to the verifier.

[0163] Step 1427: The verifier obtains the commitment ciphertext from the verifiable credential, and performs a homomorphic encryption subtraction operation on the commitment ciphertext and the challenge threshold in the challenge information to obtain the operation result.

[0164] Step 1428: The verifier verifies the zero-knowledge proof of the proof ciphertext in the verifiable statement based on the calculation result.

[0165] In this embodiment, the information processing method for zero-knowledge proof through the above steps 1411 to 1428 can not only solve the problem of lack of identity authentication and data protocol carrying in the simple zero-knowledge proof algorithm process, but also can quickly realize the zero-knowledge proof process under the trusted infrastructure based on blockchain in actual application scenarios.

[0166] In addition, compared with the pure zero-knowledge proof algorithm in the related art, the information processing method for zero-knowledge proof provided in the embodiment of the present application can also have the following advantages:

[0167] 1. By combining blockchain technology to realize the zero-knowledge proof process, it can have decentralized anti-tampering capabilities.

[0168] 2. Adding the DID identity authentication process to the zero-knowledge proof process can make the proof process more secure and reliable.

[0169] 3. The data volume of proof ciphertext based on BulletProofs is small, which is conducive to reducing the storage cost of blockchain network.

[0170] 4. The commitment ciphertext is endorsed by a third-party authority and can be well integrated with the traditional business model.

[0171] 5. The application scenarios are more flexible. It can be applied to scenarios that do not require zero-knowledge proof, as well as scenarios that require zero-knowledge proof, thus being compatible with the usage requirements of multiple application scenarios.

[0172] 6. The use of DID identity identification can have universal interoperability, which is not only easy to implement and expand, but also conducive to industry promotion.

[0173] Reference Fig.15 As shown, Fig.15 This is a flowchart of the steps of the information processing method for zero-knowledge proof provided by a specific example. Fig.15In the present invention, the information processing method for zero-knowledge proof may include but is not limited to steps 1501 to 1523.

[0174] Step 1501: The prover obtains a local private key and randomly obtains an encryption string used for information encryption.

[0175] In this step, when the prover randomly obtains the encrypted string used for information encryption, he may obtain a randomly generated encrypted string, or he may randomly obtain the encrypted string used for information encryption from multiple local information, which is not specifically limited here.

[0176] Step 1502: The prover fuses the local private key with the encrypted string to obtain a fused private key, and then hashes the fused private key to obtain a blinding factor.

[0177] In this step, when the prover fuses the local private key with the encrypted string, the encrypted string can be directly spliced ​​onto the back of the local private key to achieve information fusion of the local private key and the encrypted string, or the local private key and the encrypted string can be broken up and then spliced ​​together to achieve information fusion of the local private key and the encrypted string. No specific limitation is made here.

[0178] Step 1503: The prover generates a commitment ciphertext of the local sensitive information based on the blinding factor and the local sensitive information, and sends the blinding factor, the local sensitive information and the commitment ciphertext to the credential issuer.

[0179] Step 1504: The credential issuer performs DID identity verification on the certifier. If the verification succeeds, execute step 1506; if the verification fails, execute step 1505.

[0180] In this step, the credential issuer may first request identity information from the prover. At this time, the prover will use its own private key to sign the identity information, and then send the signed identity information to the credential issuer; after receiving the signed identity information sent by the prover, the credential issuer obtains the prover's DID identity and the prover's public key from the blockchain, and then uses the prover's public key to verify the signature of the signed identity information; when the signature verification is successful, the credential issuer determines whether the identity information sent by the prover matches the prover's DID identity to achieve DID identity verification of the prover. If the identity information sent by the prover matches the prover's DID identity, it means that the DID identity verification of the prover is successful. If the identity information sent by the prover does not match the prover's DID identity, it means that the DID identity verification of the prover is unsuccessful.

[0181] Step 1505: The credential issuer sends a notification message of DID identity authentication failure to the certifier, and then executes step 1523.

[0182] Step 1506: The credential issuer verifies the commitment ciphertext based on the blinding factor and local sensitive information. If the verification succeeds, execute step 1508; if the verification fails, execute step 1507.

[0183] In this step, when the credential issuer verifies the commitment ciphertext based on the blinding factor and the local sensitive information, it can first generate a commitment verification ciphertext based on the blinding factor and the local sensitive information, and then determine whether the commitment verification ciphertext is consistent with the commitment ciphertext. If they are consistent, it means that the verification of the commitment ciphertext is successful. If they are inconsistent, it means that the verification of the commitment ciphertext is unsuccessful.

[0184] Step 1507: The certificate issuer sends a notification message of the failure of the commitment ciphertext verification to the certifying party, and then executes step 1523.

[0185] Step 1508: The credential issuer generates a verifiable credential based on the commitment ciphertext and local sensitive information, signs the verifiable credential using its own private key, and then sends the signed verifiable credential to the proving party.

[0186] Step 1509: The prover determines whether it has received the challenge information for the local sensitive information sent by the verifier. If so, execute step 1510; if not, execute step 1509.

[0187] Step 1510: The prover performs DID identity verification on the verifier. If the verification succeeds, execute step 1512; if the verification fails, execute step 1511.

[0188] In this step, the prover may first request identity information from the verifier. At this time, the verifier will use its own private key to sign the identity information, and then send the signed identity information to the prover; after receiving the signed identity information sent by the verifier, the prover obtains the DID identity identifier of the verifier and the public key of the verifier from the blockchain, and then uses the public key of the verifier to verify the signature of the signed identity information; when the signature verification is successful, the prover determines whether the identity information sent by the verifier matches the DID identity identifier of the verifier, so as to realize the DID identity verification of the verifier. If the identity information sent by the verifier matches the DID identity identifier of the verifier, it means that the DID identity verification of the verifier is successful. If the identity information sent by the verifier does not match the DID identity identifier of the prover, it means that the DID identity verification of the verifier is unsuccessful.

[0189] Step 1511: The prover sends a notification message of DID identity authentication failure to the verifier, and then executes step 1523.

[0190] Step 1512: The prover generates a proof ciphertext based on the challenge information, the local sensitive information and the blinding factor, which is used to indicate that the local sensitive information satisfies the challenge information.

[0191] Step 1513: The prover determines whether the current scenario requires hiding the local sensitive information in the verifiable credential. If so, execute step 1514; if not, execute step 1515.

[0192] Step 1514: The proving party concatenates the local sensitive information with the corresponding salt value to obtain concatenated information, and then performs hashing on the concatenated information to obtain desensitized information. Subsequently, the local sensitive information in the verifiable credential is replaced with the desensitized information, and the value of the salt value in the verifiable credential is hidden to obtain the desensitized verifiable credential.

[0193] Step 1515: The proving party packages the proving ciphertext and the verifiable credential to obtain a verifiable statement, and then signs the verifiable statement using the local private key to obtain signature information.

[0194] Step 1516: The prover sends the signature information to the verifier.

[0195] Step 1517: The verifier performs DID identity verification on the prover. If the verification succeeds, execute step 1519; if the verification fails, execute step 1518.

[0196] In this step, the verifier may first request identity information from the prover. At this time, the prover will use its own private key to sign the identity information, and then send the signed identity information to the verifier. After receiving the signed identity information sent by the prover, the verifier obtains the prover's DID identity identifier and the prover's public key from the blockchain, and then uses the prover's public key to verify the signature of the signed identity information. When the signature verification is successful, the verifier determines whether the identity information sent by the prover matches the prover's DID identity identifier to achieve DID identity verification of the prover. If the identity information sent by the prover matches the prover's DID identity identifier, it means that the DID identity verification of the prover is successful. If the identity information sent by the prover does not match the prover's DID identity identifier, it means that the DID identity verification of the prover is unsuccessful.

[0197] Step 1518: The verifier sends a notification message of DID identity authentication failure to the prover, and then executes step 1523.

[0198] Step 1519: The verifier performs signature verification on the signature information. If the signature verification is successful, execute step 1521; if the signature verification is unsuccessful, execute step 1520.

[0199] In this step, when the verifier verifies the signature information, it can first obtain the public key of the prover from the blockchain, and then use the public key of the prover to verify the signature information, so as to determine whether the signature information is a verifiable statement issued by the prover. In addition, when the signature verification of the signature information is successful, the verifier can also obtain the public key of the credential issuer from the blockchain, and then use the public key of the credential issuer to verify the signature of the verifiable credential in the signature information (i.e., the verifiable statement), so as to determine whether the verifiable credential is issued by the credential issuer, thereby improving the security of the verifiable credential and the verifiable statement.

[0200] Step 1520: The verifier sends a notification message of unsuccessful signature verification to the prover, and then executes step 1523.

[0201] Step 1521: The verifier obtains the proof ciphertext and the commitment ciphertext from the signature information, and subtracts the challenge threshold in the challenge information from the commitment ciphertext through homomorphic encryption subtraction to obtain the ciphertext result.

[0202] Step 1522: The verifier uses the ciphertext result to verify the zero-knowledge proof of the proof ciphertext.

[0203] Step 1523: End the process.

[0204] In this embodiment, through the information processing method for zero-knowledge proof of the above steps 1501 to 1523, the prover first obtains the local private key and randomly obtains the encrypted string used for information encryption, and generates a blinding factor based on the local private key and the encrypted string, and then generates a commitment ciphertext of the local sensitive information based on the blinding factor and the local sensitive information, and then sends the commitment ciphertext to the credential issuer, and then receives the verifiable credential generated by the credential issuer based on the commitment ciphertext and issued by the credential issuer; after receiving the verifiable credential, when the prover receives the challenge information for the local sensitive information sent by the verifier, the prover first generates a proof ciphertext for characterizing that the local sensitive information satisfies the challenge information based on the challenge information, the local sensitive information and the blinding factor, and then sends the proof ciphertext and the verifiable credential to the verifier, so that the verifier can verify the proof ciphertext for zero-knowledge proof based on the verifiable credential, thereby realizing the entire process of zero-knowledge proof. Among them, since the local private key of the prover itself is private and random, and the encrypted string is obtained randomly, the blinding factor generated according to the local private key and the encrypted string can also be private and random, thereby reducing the risk of the blinding factor being leaked and improving the security of the blinding factor. Moreover, since the blinding factor can be generated according to the local private key and the encrypted string, when the prover needs to use the blinding factor, it only needs to generate the blinding factor according to the local private key and the encrypted string, and there is no need to store the blinding factor additionally, thereby reducing the additional storage cost of the blinding factor. In addition, after the prover generates the commitment ciphertext of the local sensitive information, the prover sends the commitment ciphertext to the credential issuer so that the credential issuer generates and issues a verifiable credential based on the commitment ciphertext, so that the credential issuer can endorse the verifiable credential, thereby improving the authenticity of the commitment ciphertext in the verifiable credential, and since the credential issuer will also sign the verifiable credential, the prover cannot tamper with the commitment ciphertext in the verifiable credential, thereby improving the legitimacy of the commitment ciphertext.

[0205] The following are some practical examples to illustrate the application scenarios of the embodiments of the present application.

[0206] It should be noted that the information processing method for zero-knowledge proof provided in the embodiment of the present application can be applied to different application scenarios such as service qualification judgment and exclusive service provision. The following is an explanation using the service qualification judgment scenario and the exclusive service provision scenario as examples.

[0207] Scene 1

[0208] The information processing method for zero-knowledge proof provided in the embodiment of the present application can be applied to the service use qualification judgment scenario. For example, assuming that a user wants to use a specific service provided by a merchant, the user initiates an application for use of the specific service to the merchant through the user terminal; upon receiving the use application, the merchant initiates a zero-knowledge proof request for use qualification to the user terminal, requiring the user to prove that he or she has the number of resources to use the specific service; upon receiving the zero-knowledge proof request, the user terminal first obtains the local private key, and generates a blinding factor that is not disclosed to the public based on the local private key, and then generates a commitment ciphertext of the local resource quantity based on the blinding factor and the local resource quantity, and then sends the commitment ciphertext to the credential issuing server Endorsement; when receiving the commitment ciphertext sent by the user terminal, the credential issuing server generates a verifiable credential based on the commitment ciphertext, signs the verifiable credential, and then returns the signed verifiable credential to the user terminal; after receiving the verifiable credential signed by the credential issuing server, when receiving the challenge information for the number of local resources sent by the merchant, the user terminal generates a proof ciphertext for representing that the number of local resources meets the challenge information based on the challenge information, the number of local resources and the blinding factor, and then sends the proof ciphertext and the verifiable credential to the merchant; when receiving the proof ciphertext and the verifiable credential sent by the user terminal, the merchant verifies the proof ciphertext with zero knowledge proof based on the verifiable credential. Among them, when the merchant verifies the proof ciphertext with zero knowledge proof based on the verifiable credential, if the verification is successful, it means that the number of local resources of the user meets the requirements for using the specific service; if the verification is unsuccessful, it means that the number of local resources of the user does not meet the requirements for using the specific service. When the merchant determines that the number of local resources of the user meets the requirements for using the specific service, the merchant provides the specific service to the user.

[0209] Scene 2

[0210] The information processing method for zero-knowledge proof provided in the embodiment of the present application can also be applied to exclusive service provision scenarios. For example, assuming that a securities company hopes to authenticate a user whose asset quantity reaches the target standard as a professional investor, thereby providing the user with exclusive investment rights and interests services, at this time, the securities company initiates a zero-knowledge proof request for the asset quantity to the user terminal; upon receiving the zero-knowledge proof request, the user terminal first obtains the local private key, and generates a blinding factor that is not disclosed to the public based on the local private key, and then generates a commitment ciphertext of the local asset quantity based on the blinding factor and the local asset quantity, and then sends the commitment ciphertext to the credential issuing server for endorsement; upon receiving the zero-knowledge proof request from the user terminal, the user terminal obtains the local private key, and generates a commitment ciphertext of the local asset quantity based on the blinding factor and the local asset quantity, and then sends the commitment ciphertext to the credential issuing server for endorsement. The certificate issuing server generates a verifiable certificate based on the commitment ciphertext, signs the verifiable certificate, and then returns the signed verifiable certificate to the user terminal; after receiving the verifiable certificate signed by the certificate issuing server, when receiving the challenge information for the number of local assets sent by the securities company, the user terminal generates a proof ciphertext for representing that the number of local assets meets the challenge information based on the challenge information, the number of local assets and the blinding factor, and then sends the proof ciphertext and the verifiable certificate to the securities company; when receiving the proof ciphertext and the verifiable certificate sent by the user terminal, the securities company verifies the proof ciphertext with zero knowledge proof based on the verifiable certificate. Among them, when the securities company verifies the proof ciphertext with zero knowledge proof based on the verifiable certificate, if the verification is successful, it means that the number of local assets of the user has reached the target standard; if the verification is unsuccessful, it means that the number of local assets of the user has not reached the target standard. When the securities company determines that the number of local assets of the user has reached the target standard, the securities company certifies the user as a professional investor, thereby providing exclusive investment rights and interests services for the user.

[0211] It is to be understood that, although the steps in the above-mentioned various flow charts are shown in sequence according to the indication of the arrows, these steps are not necessarily performed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in the present embodiment, the execution of these steps does not have a strict order restriction, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the above-mentioned flow charts can include a plurality of steps or a plurality of stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of the steps or stages in other steps or other steps.

[0212] Reference Fig.16 The embodiment of the present application further discloses an information processing device for zero-knowledge proof. The information processing device 1600 can implement the information processing method for zero-knowledge proof in the previous embodiment. The information processing device 1600 includes:

[0213] An information generating unit 1610 is used to obtain a local private key and generate a blinding factor according to the local private key;

[0214] The ciphertext sending unit 1620 is used to generate a commitment ciphertext of the local sensitive information according to the blinding factor and the local sensitive information, and send the commitment ciphertext to the credential issuer;

[0215] The credential receiving unit 1630 is used to receive a verifiable credential generated by the credential issuer according to the commitment ciphertext and issued by the credential issuer;

[0216] The ciphertext generating unit 1640 is configured to generate, upon receiving the challenge information for the local sensitive information sent by the verifier, a proof ciphertext for indicating that the local sensitive information satisfies the challenge information according to the challenge information, the local sensitive information and the blinding factor;

[0217] The information sending unit 1650 is used to send the proof ciphertext and the verifiable credential to the verification party, so that the verification party verifies the proof ciphertext according to the verifiable credential.

[0218] In one embodiment, the information generating unit 1610 is further configured to:

[0219] Randomly obtain an encryption string used for information encryption;

[0220] Generates a blinding factor based on the encrypted string and the local private key.

[0221] In one embodiment, the information generating unit 1610 is further configured to:

[0222] Randomly obtain an encryption string used for information encryption from multiple local information;

[0223] The local private key is hashed according to the encrypted string to obtain the blinding factor.

[0224] In one embodiment, the information generating unit 1610 is further configured to:

[0225] The local private key is merged with the encrypted string to obtain a merged private key;

[0226] The fused private key is hashed to obtain the blinding factor.

[0227] In one embodiment, the verifiable credential includes local sensitive information; the information sending unit 1650 is further used to:

[0228] Desensitizing the local sensitive information in the verifiable credential to obtain the desensitized verifiable credential;

[0229] The proof ciphertext and the desensitized verifiable credentials are sent to the verifier.

[0230] In one embodiment, the verifiable credential further includes a salt value used to encrypt the local sensitive information; the information sending unit 1650 is further used to:

[0231] Hash the local sensitive information according to the salt value to obtain desensitized information;

[0232] The local sensitive information in the verifiable credential is replaced with the desensitized information, and the value of the salt value in the verifiable credential is hidden to obtain the desensitized verifiable credential.

[0233] In one embodiment, the information sending unit 1650 is further configured to:

[0234] Concatenate the local sensitive information with the salt value to obtain concatenated information;

[0235] The spliced ​​information is hashed to obtain desensitized information.

[0236] In one embodiment, the ciphertext generation unit 1640 is further configured to:

[0237] Receive the identity information sent by the verifier and obtain the distributed identity of the verifier from the blockchain;

[0238] Authentication of the verification party is performed based on the identity information and distributed identity identification;

[0239] When the identity authentication succeeds, a proof ciphertext is generated based on the challenge information, the local sensitive information and the blinding factor, which is used to represent that the local sensitive information satisfies the challenge information.

[0240] In one embodiment, the ciphertext generation unit 1640 is further configured to:

[0241] Get the public key of the validator from the blockchain;

[0242] Use the public key to verify the signature of the identity information and obtain the verification result;

[0243] Match the signature verification result with the distributed identity identifier to obtain a matching result;

[0244] The authenticator is authenticated based on the matching result.

[0245] In one embodiment, the information sending unit 1650 is further configured to:

[0246] Use the local private key to sign the proof ciphertext and the verifiable credential to obtain the signature information;

[0247] Send the signature information to the verifier.

[0248] In one embodiment, the information sending unit 1650 is further configured to:

[0249] Pack the proof ciphertext and the verifiable credential to obtain a verifiable statement;

[0250] Use the local private key to sign the verifiable statement to obtain the signature information.

[0251] It should be noted that since the information processing device 1600 for zero-knowledge proof of this embodiment can implement the information processing method for zero-knowledge proof of the previous embodiment, the information processing device 1600 for zero-knowledge proof of this embodiment and the information processing method for zero-knowledge proof of the previous embodiment have the same technical principles and the same beneficial effects, and in order to avoid repetition of content, they will not be repeated here.

[0252] Reference Fig.17 The embodiment of the present application further discloses an information processing device for zero-knowledge proof, and the information processing device 1700 for zero-knowledge proof includes:

[0253] at least one processor 1701;

[0254] At least one memory 1702, used to store at least one program;

[0255] When at least one program is executed by at least one processor 1701 , the above-mentioned information processing method for zero-knowledge proof is implemented.

[0256] An embodiment of the present application further discloses a computer-readable storage medium, which stores a computer program executable by a processor. When the computer program executable by the processor is executed by the processor, it is used to implement the information processing method for zero-knowledge proof as described above.

[0257] An embodiment of the present application also discloses a computer program product, including a computer program or computer instructions, wherein the computer program or computer instructions are stored in a computer-readable storage medium, and a processor of an information processing device for zero-knowledge proof reads the computer program or computer instructions from the computer-readable storage medium, and the processor executes the computer program or computer instructions, so that the information processing device for zero-knowledge proof performs the information processing method for zero-knowledge proof as described above.

[0258] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein, for example. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0259] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0260] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0261] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0262] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0263] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store program codes.

[0264] The step numbers in the above method embodiment are only provided for the convenience of explanation and description, and no limitation is imposed on the order of the steps. The execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

Claims

1. An information processing method for zero-knowledge proof, characterized in that: The following steps are involved: Obtaining a local private key, and generating a blinding factor according to the local private key; Generate a commitment ciphertext of the local sensitive information according to the blinding factor and the local sensitive information, and send the commitment ciphertext to the credential issuer; Receiving a verifiable credential generated by the credential issuer based on the commitment ciphertext and issued by the credential issuer; When challenge information for the local sensitive information sent by the verifier is received, generating, according to the challenge information, the local sensitive information and the blinding factor, a proof ciphertext for representing that the local sensitive information satisfies the challenge information; The proof ciphertext and the verifiable credential are sent to the verification party, so that the verification party verifies the proof ciphertext by zero-knowledge proof according to the verifiable credential.

2. The method according to claim 1, characterized in that The generating a blinding factor according to the local private key includes: Randomly obtain an encryption string used for information encryption; A blinding factor is generated according to the encrypted string and the local private key.

3. The method according to claim 2, characterized in that The randomly obtaining an encrypted string for information encryption includes: Randomly obtain an encryption string used for information encryption from multiple local information; The generating a blinding factor according to the encrypted string and the local private key includes: The local private key is hashed according to the encrypted character string to obtain a blinding factor.

4. The method according to claim 3, characterized in that: The hashing of the local private key according to the encrypted string to obtain a blinding factor includes: Fusing the local private key with the encrypted string to obtain a fused private key; The fused private key is hashed to obtain a blinding factor.

5. The method according to claim 1, characterized in that The verifiable credential includes the local sensitive information; The sending the certification ciphertext and the verifiable credential to the verification party includes: Desensitizing the local sensitive information in the verifiable credential to obtain the desensitized verifiable credential; The certification ciphertext and the desensitized verifiable credential are sent to the verifier.

6. The method according to claim 5, characterized in that The verifiable credential also includes a salt value used to encrypt the local sensitive information; The desensitizing the local sensitive information in the verifiable credential to obtain the desensitized verifiable credential includes: Performing hash processing on the local sensitive information according to the salt value to obtain desensitized information; The local sensitive information in the verifiable credential is replaced with the desensitized information, and the value of the salt value in the verifiable credential is hidden to obtain the desensitized verifiable credential.

7. The method according to claim 6, characterized in that The hashing of the local sensitive information according to the salt value to obtain desensitized information includes: Concatenate the local sensitive information with the salt value to obtain concatenated information; The spliced ​​information is hashed to obtain desensitized information.

8. The method according to claim 1, characterized in that The generating, according to the challenge information, the local sensitive information and the blinding factor, a proof ciphertext for representing that the local sensitive information satisfies the challenge information includes: Receive the identity information sent by the verifier, and obtain the distributed identity identifier of the verifier from the blockchain; authenticating the verification party according to the identity information and the distributed identity identifier; When the identity authentication succeeds, a proof ciphertext is generated based on the challenge information, the local sensitive information and the blinding factor, which is used to indicate that the local sensitive information satisfies the challenge information.

9. The method according to claim 8, characterized in that The performing identity authentication on the verification party according to the identity information and the distributed identity identifier includes: Obtaining the public key of the verifier from the blockchain; Using the public key to perform signature verification on the identity information to obtain a signature verification result; According to the signature verification result, the identity information is matched with the distributed identity identifier to obtain a matching result; The identity verification result of the authenticator is determined according to the matching result.

10. The method according to claim 1, characterized in that The sending the certification ciphertext and the verifiable credential to the verification party includes: Signing the certification ciphertext and the verifiable credential using the local private key to obtain signature information; The signature information is sent to the verification party.

11. The method according to claim 10, characterized in that The using the local private key to sign the certification ciphertext and the verifiable credential to obtain signature information includes: Packaging the certification ciphertext and the verifiable credential to obtain a verifiable representation; The verifiable statement is signed using the local private key to obtain signature information.

12. An information processing device for zero-knowledge proof, characterized in that: include: An information generating unit, configured to obtain a local private key and generate a blinding factor according to the local private key; A ciphertext sending unit, configured to generate a commitment ciphertext of the local sensitive information according to the blinding factor and the local sensitive information, and send the commitment ciphertext to a credential issuer; A credential receiving unit, configured to receive a verifiable credential generated by the credential issuer according to the commitment ciphertext and issued by the credential issuer; a ciphertext generating unit, configured to, upon receiving challenge information for the local sensitive information sent by the verifier, generate, according to the challenge information, the local sensitive information and the blinding factor, a proof ciphertext for indicating that the local sensitive information satisfies the challenge information; The information sending unit is used to send the proof ciphertext and the verifiable credential to the verification party, so that the verification party verifies the proof ciphertext by zero-knowledge proof according to the verifiable credential.

13. An information processing device for zero-knowledge proof, characterized in that: include: at least one processor; at least one memory for storing at least one program; When at least one of the programs is executed by at least one of the processors, the information processing method for zero-knowledge proof according to any one of claims 1 to 11 is implemented.

14. A computer-readable storage medium, characterized in that: A computer program executable by a processor is stored therein, and when the computer program executable by the processor is executed by the processor, it is used to implement the information processing method for zero-knowledge proof as described in any one of claims 1 to 11.

15. A computer program product comprising a computer program or computer instructions, characterized in that The computer program or the computer instructions are stored in a computer-readable storage medium, and the processor of the information processing device for zero-knowledge proof reads the computer program or the computer instructions from the computer-readable storage medium, and the processor executes the computer program or the computer instructions, so that the information processing device for zero-knowledge proof performs the information processing method for zero-knowledge proof as described in any one of claims 1 to 11.

Images