Privacy generation method for anonymous voucher identifier associated with user identity information

Abstract

The invention particularly relates to an anonymous voucher identifier privacy generation method associated with user identity information. The method comprises the steps that a user generates a Pedersen commitment; the user sends the Pedersen commitment to a user identity information provider for verification and signature; the user broadcasts the signed Pedersen commitment to all members of the voucher issuing committee, and sends the identity information fragments to each member of the committee through a secure channel; the committee member verifies the correctness of the identity information fragment and jointly calculates an anonymous certificate identifier; the committee checks the uniqueness of the anonymous voucher identifier, and if the identifier exists, the process is stopped; if not, storing the identifier into the data structure and continuously issuing the anonymous certificate; and when a malicious user is found, the fragment information is aggregated to recover the identity of the user by disclosing the fragment information and verifying the correctness of the fragment. According to the method, the unique binding of the anonymous certificate and the user identity information can be realized on the premise of not leaking the user information, and the identity Sybil attack is effectively resisted.

Description

Technical Field

[0001] The present invention relates to the field of information security, and more particularly to a method for generating anonymous credential identity privacy associated with user identity information. Background Art

[0002] In the Internet environment, identity authentication, as the first line of defense against network malicious attacks, ensures that only authorized users can access the system or resources, and can effectively prevent hackers and criminals from stealing and misusing others' identity information for illegal operations. However, traditional identity authentication methods often require users to provide a large amount of personal information, which may be stolen or misused by criminals during the transmission and storage processes, and users' behaviors are easily monitored by various tracking technologies, resulting in a huge risk of user information abuse. How to protect the privacy information of users from being leaked during the identity authentication process has become a hot issue. In addition, users' awareness of data privacy protection during the use of Internet services is increasing day by day, and supporting users to independently choose to disclose personal information has become a trend in identity authentication. In this context, anonymous credential technology, as an advanced identity authentication technology, has gradually been adopted by the industrial community. Anonymous credential technology allows users to prove to service providers that the identity credentials they possess meet their access requirements without revealing their true identities or sensitive information, while ensuring the non-forgeability and anonymity of the credentials.

[0003] Existing anonymous credential technologies mainly use technologies such as blind signatures and zero-knowledge proofs, so that when users present credentials, they do not need to disclose their true identities or sensitive information, while ensuring the non-forgeability and anonymity of the credentials. However, current related technologies have not fully considered the identity sybil attacks initiated by malicious users, that is, malicious users can arbitrarily generate identity attribute information related to them, create and control multiple false identities and obtain anonymous credentials corresponding to the false identities, and gain disproportionate influence in different Internet applications, such as affecting the correctness of voting or consensus mechanisms, manipulating the market or transactions.

[0004] It should be noted that the information disclosed in the above background art section is only used to enhance the understanding of the background of the present invention, and thus may include information that does not constitute the prior art known to those of ordinary skill in the art. Summary of the Invention

[0005] The present invention provides a method for generating anonymous credential identity privacy associated with user identity information, which can achieve the unique binding of anonymous credentials and user identity information without disclosing user information, and effectively resist identity sybil attacks.

[0006] Other features and advantages of the present invention will become apparent through the following detailed description, or be learned in part through the practice of the present invention.

[0007] According to the first aspect of the present invention, there is provided a method for generating an anonymous credential identifier for associating user identity information, the method comprising:

[0008] The user generates a public key / private key pair, maps the identity identifier into a specific domain through a hash function, and generates a Pedersen commitment;

[0009] The user sends the Pedersen commitment to the user identity information provider for verification and signature;

[0010] The user broadcasts the signed Pedersen commitment to all members of the credential issuing committee, and sends the sharded identity information to each committee member through a secure channel;

[0011] The committee members verify the correctness of the sharded identity information, and jointly calculate the anonymous credential identifier through secure multi-party computation and zero-knowledge proof techniques;

[0012] The committee checks the uniqueness of the anonymous credential identifier. If the identifier already exists, the process is aborted; if not, the identifier is stored in the data structure and the anonymous credential is continued to be issued;

[0013] When a malicious user is detected, the shard information is made public and the correctness of the shards is verified, and the shard information is aggregated to recover the user identity.

[0014] In some exemplary embodiments, the step of the user generating the Pedersen commitment includes:

[0015] The user uses the hash function H to map the identity identifier into a specific domain to obtain

[0016] The user calculates the Pedersen commitment of v id,u where g and h are generators and r is a random number. id,u for

[0017] In some exemplary embodiments, the step of the committee members jointly calculating the anonymous credential identifier includes:

[0018] The committee members locally calculate the combined value of the sharded identity information and the key shards, and generate the corresponding Pedersen commitment;

[0019] The committee members jointly calculate the intermediate value of the anonymous credential identifier through secure multi-party computation technology;

[0020] The committee members use zero-knowledge proof technology to verify the correctness of the intermediate value and generate the final anonymous credential identifier.

[0021] In some exemplary embodiments, the step of the committee checking the uniqueness of the anonymous credential identifier includes:

[0022] Committee members maintain a data structure to store the anonymous credential identifier and its corresponding credential information;

[0023] Committee members check whether the newly generated anonymous credential identifier already exists in the data structure;

[0024] If the identifier already exists, mark the user and abort the process; if not, store the identifier in the data structure and continue to issue the anonymous credential.

[0025] In some exemplary embodiments, the steps of user identity recovery include:

[0026] When a malicious user is detected, committee members disclose the identity information shards and their Pedersen commitments;

[0027] Committee members verify the correctness of the shards and aggregate the shard information to recover the user identity;

[0028] By traversing the hash values, find the user identity information that matches the aggregated value.

[0029] According to the second aspect of the present invention, there is provided a privacy generation system for an anonymous credential identifier associated with user identity information, including:

[0030] A user module, configured to generate a public key / private key pair, calculate a Pedersen commitment, and interact with the user identity information provider;

[0031] A user identity information provider module, configured to verify the Pedersen commitment submitted by the user and perform a signature;

[0032] A credential issuing committee module, configured to receive the Pedersen commitment and shard information broadcast by the user, jointly calculate the anonymous credential identifier, and check the uniqueness of the identifier;

[0033] A data structure module, configured to store the anonymous credential identifier and its corresponding credential information;

[0034] A secure multi-party computing module, configured for secure computing and zero-knowledge proof verification among committee members.

[0035] According to the third aspect of the present invention, there is provided a storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the method for generating the privacy of the anonymous credential identifier associated with user identity information described in the first aspect above.

[0036] According to a fourth aspect of the present invention, there is provided a computer program product having a computer program stored thereon, and when the computer program is executed by a processor, it implements the method for generating an anonymous credential identifier privacy associated with user identity information described in the first aspect above.

[0037] According to a fifth aspect of the present invention, there is provided an electronic device, comprising:

[0038] a processor; and

[0039] a memory for storing executable instructions of the processor;

[0040] wherein the processor is configured to implement the method for generating an anonymous credential identifier privacy associated with user identity information described in the first aspect above when executing the executable instructions.

[0041] The method for generating an anonymous credential identifier privacy associated with user identity information provided by the embodiments of the present invention further improves the calculation efficiency of the anonymous credential identifier on the premise of ensuring security, thereby reducing the calculation overhead for resisting the identity sybil attack. This method has a simple design and low computational complexity, and is applicable to secure multi-party computing in a distributed system and has the ability to resist single-point failures. By researching and adopting an identity calculation method friendly to secure computing, the unique binding of user privacy identity information and anonymous credentials is realized, and then a more secure, robust, efficient and feasible anonymous credential solution is constructed.

[0042] Compared with the prior art, it has the following advantages:

[0043] 1. Effectively defend against identity sybil attacks: By adopting an identity calculation method friendly to secure computing, the unique binding of user identity information and anonymous credentials is realized, ensuring that each anonymous credential corresponds to a unique user identity, thereby effectively resisting identity sybil attacks and enhancing the security of the system.

[0044] 2. Improve calculation efficiency and reduce overhead: The present invention designs a simple and efficient calculation method, reducing the computational complexity and resource consumption in the process of generating anonymous credential identifiers, reducing the calculation and storage overhead of the system, and improving the efficiency of credential management and generation.

[0045] 3. Enhance system robustness and avoid single-point failures: Through a distributed credential issuance mechanism, the dependence on a single authentication server is avoided, enhancing the anti-attack ability and fault tolerance of the system. Even if some nodes fail, the system can still operate normally, avoiding service interruption caused by single-point failures.

[0046] 4. Simplify the identity calculation process and have strong feasibility: The new identity calculation method friendly to secure computing has low complexity, is simple and easy to use, and is convenient for large-scale deployment and application of the solution in the actual production environment.

[0047] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and do not limit the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The accompanying drawings herein are incorporated into the specification and form a part of the specification, showing embodiments consistent with the present invention, and are used together with the specification to explain the principles of the present invention. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention, and those of ordinary skill in the art can obtain other drawings based on these drawings without creative efforts.

[0049] Figure 1 Schematic diagram of the system structure of an exemplary embodiment of the present invention;

[0050] Figure 2 Schematic diagram of the process of a method for generating an anonymous credential identifier privacy associated with user identity information in an exemplary embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0051] Example embodiments will now be described more fully with reference to the accompanying drawings. However, the example embodiments can be implemented in various forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the present invention will be more complete and comprehensive, and will fully convey the concept of the example embodiments to those skilled in the art. The features, structures, or characteristics described can be combined in any suitable manner in one or more embodiments.

[0052] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and thus their repeated description will be omitted. Some of the block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0053] In related technologies, with the rapid development of decentralized technologies and the continuous improvement of privacy protection requirements, the deficiencies of traditional identity authentication systems have gradually emerged. Especially in scenarios such as decentralized finance (DeFi), electronic voting, and privacy-protected access control, the balance between user identity authentication and privacy protection has become the core challenge that current technologies urgently need to address. On the one hand, centralized identity authentication mechanisms have exposed problems such as data leakage, privacy infringement, and single-point failures, making it difficult to meet the requirements for security, privacy, and verifiability in decentralized systems. On the other hand, how to achieve the anonymity and uniqueness of user identities while ensuring the effectiveness of identity verification has become an important technical problem in promoting the implementation of decentralized applications.

[0054] Alberto Sonnino et al. proposed the anonymous credential technology Coconut based on blind signatures. In Coconut, the issuance of credentials depends on a credential issuance committee consisting of multiple members. Through blind signatures and zero-knowledge proofs, users obtain the signatures of user attribute information from the credential issuance committee. The signature process uses the signature scheme given in the literature Short randomizable Signatures. During the process of obtaining the signature, the members of the credential issuance committee can only determine that the user's attributes meet the credential issuance requirements, but cannot obtain the specific values of the user's attributes. When users use the credentials, they first randomize them and then use zero-knowledge proof technology to meet the access requirements of service providers while hiding the user attribute values. The greatest advantage of Coconut lies in the convenience of verifying anonymous credentials. However, in the credential application stage, the credential issuance committee cannot verify the information submitted by users, and thus cannot resist identity sybil attacks.

[0055] Deepak Maram et al. proposed the anonymous credential scheme CanDID to resist identity Sybil attacks. In CanDID, credential issuance still relies on the credential issuance committee, where a user's anonymous credential consists of a primary credential and a derived credential. First, the user applies to the credential issuance committee to obtain the primary credential. Meanwhile, based on secure multi-party technology, the credential identifier containing the user's identity information is calculated among committee members to ensure the one-to-one correspondence between the user's identity information (such as ID number, phone number, etc.) and the primary credential, and to enable the recovery of the user's identity information and timely tracing of the user in case of malicious behavior by the user. When the user accesses an Internet application, based on the user's primary credential, the user applies to the credential issuance committee to obtain the derived credential for accessing the application. Here, zero-knowledge proof is used to ensure the privacy association between the primary credential and the derived credential. In CanDID, secure multi-party computing technology is used among the members of the credential issuance committee to jointly calculate the message authentication code of the user's identity information, which is used as the identifier of the user's anonymous credential. By checking whether this identifier exists in the identifier database, the unique binding relationship between the user and the anonymous credential is ensured to resist identity Sybil attacks. However, when calculating the message authentication code of the user's identity information, due to the complexity of the calculation process, the computational overhead is too large, which to a certain extent affects the convenient use of anonymous credentials.

[0056] Michael Rosenberg et al. proposed zk-creds based on zero-knowledge proof. In zk-creds, different from the above two schemes, the generation of anonymous credentials does not rely on the credential issuance committee. Any entity with the user's attribute information can play the role of the credential issuer. This requires the entity to publish the cryptographic commitment of the user's attribute information (as the user's credential) on a public bulletin board. When the user accesses an Internet application, zero-knowledge proof technology is required to prove that the credential exists on the bulletin board and that the user attribute information contained in the credential meets the access requirements. In this process, the proof of the existence of the credential on the bulletin board does not disclose the credential corresponding to the user, thus ensuring anonymity. However, in this scheme, the entity playing the role of the credential issuer needs to be incorporated into the entire anonymous credential system, which limits the feasibility of actual deployment. And once the credential issuer is controlled by an attacker, the entire credential system will fail.

[0057] Wei-Zhu Yeoh et al. proposed FIDO-AC based on FIDO2. By expanding its functions on the basis of FIDO2, it can support users' anonymous credentials and achieve a more secure and privacy-friendly identity authentication. FIDO-AC provides a scheme that is anonymous but can verify identity information by combining the FIDO2 authentication process and electronic identity documents (eID, such as the biometric passport ePassport). On the basis of FIDO2 authentication, a user attribute verification mechanism is introduced, the minimization of data during the identity authentication process is ensured, and users are given control over their own data, thus realizing a more secure and private identity authentication mechanism. FIDO-AC combines existing FIDO2 security tokens and trusted electronic identity documents, which not only improves the security and reliability of identity authentication but also has strong compatibility. Although the FIDO-AC scheme has many advantages, it still faces challenges such as identity document dependence, increased authentication complexity, computational performance overhead, and trust management issues, and may need further optimization in identity credential management and computational efficiency.

[0058] In summary, the existing anonymous credential schemes generally have the following problems in generating anonymous credential identifiers that conceal privacy based on user identity information: either they fail to fully consider how to effectively resist identity sybil attacks, or they have excessive computational overhead or insufficient system security when defending against such attacks, or they lack feasibility and deployability in actual production environments, or they are vulnerable to attacks, resulting in single points of failure and weak system robustness.

[0059] In view of the disadvantages and deficiencies of the existing technologies, in this exemplary embodiment, a method for generating anonymous credential identifier privacy associated with user identity information is provided, aiming to achieve the unique binding of anonymous credentials and user identity information, while improving computational efficiency and reducing the computational overhead of resisting identity sybil attacks.

[0060] First, the principle of the present invention is explained, specifically from four aspects: two-party multiplication calculation function, non-interactive sigma protocol, multi-party secure calculation multiplication equality test, anonymous credentials, and zero-knowledge proof.

[0061] (1) Two-party multiplication calculation function

[0062] Function input: Committee members with x i and committee members with y j ;

[0063] Function output: Committee members obtain w ij and committee members obtain w ji and wij +w ji =x i ·y j ;

[0064] Calculation process:

[0065] 1. Committee members and pre - generate multiplication triples, where has (a i , b i , c i ), has (a j , b j , c j ), and

[0066] c i +c j =(a i +a j )·(b i +bj)

[0067] 2. Committee members randomly select x from ii and x ij , such that x i =x ii +x ij mod p, and send x ij to

[0068] 3. Committee members randomly select y from ji and y jj , such that y j =y ji +y jj mod p, and send y ji to

[0069] 4. Locally calculate u i =x ii +a i and v i =y ji +b i , and send u i and v i to

[0070] 5. Locally calculate u j =xij +a j and v j =y jj +b j , and send u j and v j to

[0071] 6. With jointly calculate u = u i +u j and v = v i +v j ;

[0072] 7. Committee members calculate according to the following formula to obtain

[0073] w ij = vx ii + uy ji + c i - uv

[0074] 8. Committee members calculate according to the following formula to obtain

[0075] w ji = vx ij + uy jj + c j

[0076] (2) Use non - interactive sigma protocol to verify the correctness of Pedersen commitment

[0077] Input: Prover's private input (v, r) and public parameter Pedersen commitment C

[0078] Output: Zero - knowledge proof π, proving that Persen commitment C is calculated from the given (v, r)

[0079] Purpose: Generate zero - knowledge proof π to ensure that its values satisfy without leaking v and r:

[0080] C = g v h r

[0081] Calculation process:

[0082] 1. Generate common parameters, including generator g, hash function H, secure group G, etc

[0083] 2. The prover randomly selects b, s in Z q ; Calculate the commitment value: X = gb h s

[0084] 3. Prover generation: e = H(C, X)

[0085] And calculate

[0086] z = b + e·a

[0087] t = s + e·r

[0088] After that, the prover sends π = (X, z, t) to the verifier

[0089] 4. The verifier verifies whether the following equation holds:

[0090] g t h z = X + e·C

[0091] (3) Anonymous Credential

[0092] In the decentralized identity authentication design of the system, anonymous credential is an important tool for protecting user privacy and achieving secure identity authentication. It allows users to prove that their identities have been verified and they possess certain specific qualifications without exposing their true identities, thus meeting the system's requirements in terms of privacy protection, identity deduplication, and security. As a cryptographic tool, anonymous credential has the following characteristics:

[0093] a. Anonymity: The credential holder can prove the legitimacy of their identity without revealing their specific identity information.

[0094] b. Verifiability: The credential is generated by a trusted party (such as a distributed committee), and the service provider can verify its authenticity and validity

[0095] c. Non - modifiability: Once the credential is generated, it cannot be tampered with or forged

[0096] d. Decentralization: The generation and verification processes of the credential do not rely on a single trusted center, which is suitable for distributed system design.

[0097] Through anonymous credential, the system can implement the "minimum disclosure principle" of identity authentication, that is, while providing services, only the necessary authentication results are exposed, without revealing the user's true identity information.

[0098] The generation and verification of anonymous credential are based on zero - knowledge proof and digital signature technologies in cryptography to ensure anonymity and security.

[0099] (4) Zero - knowledge Proof

[0100] Zero-Knowledge Proof (ZKP) is a cryptographic technique that allows a prover to prove the truth of a statement to a verifier without revealing any actual information. Zero-Knowledge Proof has a wide range of applications in decentralized identity authentication, privacy protection, and distributed systems, especially in this system to ensure the privacy and security of user identity information and the correctness of the deduplication mechanism. The types of Zero-Knowledge Proof can be divided into interactive Zero-Knowledge Proof and non-interactive Zero-Knowledge Proof; interactive Zero-Knowledge Proof is the traditional way of Zero-Knowledge Proof, where the prover and the verifier exchange information through multiple rounds of interaction, and the verifier tests whether the prover can correctly prove the claim through some challenge questions; in non-interactive Zero-Knowledge Proof, there is no need for multiple rounds of interaction between the prover and the verifier, but the proof is transmitted in a single message. This method is usually completed by constructing a Common Reference String (CRS).

[0101] The present invention is dedicated to the application of anonymous credentials, realizing the privacy binding of user identity information and anonymous credentials, ensuring the unique association between anonymous credentials and users, so as to resist identity sybil attacks. During this process, the sensitive identity information of users is not leaked, and the user identity information can be restored when the user behavior is abnormal, so as to achieve the traceability of abnormal users.

[0102] As Figure 1 shown, this system includes 3 main roles: User (u), User Information Provider (UIP), and Committee ( ) for identity information authentication and anonymous credential issuance.

[0103] The method of the present invention includes several stages: initialization, user identity information acquisition, user identity information sharding and verification, user identity information deduplication, and user identity information traceability.

[0104] Refer to Figure 2 shown, specifically, it can include the following steps:

[0105] Step S1, the user generates a public key / private key pair, maps the identity identifier to a specific domain through a hash function, and generates a Pedersen commitment;

[0106] Step S2, the user sends the Pedersen commitment to the user identity information provider for verification and signature;

[0107] Step S3: The user broadcasts the signed Pedersen commitment to all members of the credential issuing committee, and sends the sharded identity information to each committee member through a secure channel;

[0108] Step S4: The committee members verify the correctness of the sharded identity information, and jointly calculate the anonymous credential identifier through secure multi-party computation and zero-knowledge proof technology;

[0109] Step S5: The committee checks the uniqueness of the anonymous credential identifier. If the identifier already exists, the process is aborted; if not, the identifier is stored in the data structure and the anonymous credential is continued to be issued;

[0110] Step S6: When a malicious user is detected, the user identity is restored by publicly revealing the shard information and verifying the shard correctness, and aggregating the shard information.

[0111] Next, each step of the anonymous credential identifier privacy generation method for associating user identity information in this exemplary embodiment will be described in more detail with reference to the accompanying drawings and embodiments.

[0112] (1) Initialization

[0113] User u generates a public key / private key pair (pk u , sk u );

[0114] The user identity information provider UIP generates its public key / private key pair (pk UIP , sk UIP ) for confirming the user identity information;

[0115] The committee members for anonymous credential issuance generate key shards for privacy binding of user identity information with the corresponding public key being pk ID ; In addition, for any committee member generate a private key for distributed signature

[0116] (2) User Identity Information Acquisition

[0117] User u uses the hash function H to map its identity identifier (such as ID number, passport number, etc.) to a specific domain to obtain Calculate v id,u 's Pedersen commitment C id,u using the following formula:

[0118]

[0119] where g and h are generators, and rid,u is a random number within a specific domain randomly selected

[0120] User u sends (C id,u , r id,u , pk u ) to the User Identity Provider (UIP);

[0121] After UIP verifies the correctness of C id,u , it uses the private key sk UIP to sign C id,u and obtains σ id,u , then sends it to user u

[0122] (3) The user's public key pk u is privately associated with the identity

[0123] User u broadcasts (C id,u , σ id,u ) to all members of the committee ;

[0124] For i ∈ [1, |C|], user u generates where and are randomly selected from and satisfy

[0125]

[0126] User u broadcasts to all members of the committee and sends to committee member

[0127] via a secure channel Based on the committee member verifies the correctness of to ensure the correctness of the shards

[0128] (4) All members in the committee jointly calculate the anonymous credential identifier of user u

[0129] 4-1) The committee member locally calculates (owns and )

[0130]

[0131] where

[0132]

[0133] and broadcast it among committee members;

[0134] 4 - 2) Committee members calculate β i (generate shares of β)

[0135] Committee members randomly select β from i and and calculate

[0136] generate a zero - knowledge proof to achieve ensuring its value satisfies i and without leaking β

[0137]

[0138] Broadcast it to committee members

[0139] 4 - 3) For all committee members calculate ρ i such that The calculation method is:

[0140] calculate δ ii =β i τ i

[0141] For and calculate where δ ij is secretly saved by and δ ji is secretly saved by ; where δ ij +δ ji =β i ·τ j ;

[0142] calculate

[0143] 4 - 4) All committee members jointly verify the generated ρ ifor correctness without leaking β i (i = 1, …, n) and τ i (i = 1, …, n), verify the following equation:

[0144]

[0145] to check if it holds. The following is the specific process:

[0146] For committee members Each member has and where for

[0147]

[0148] and random factors generated for committee nodes, used to generate Pedersen commitments and

[0149]

[0150] Committee members randomly select a private key share e q in Z i , calculate the ElGamal public key share and then use zero - knowledge proof to prove the correctness of the ElGamal public key ; Committee nodes publish E i , calculate the shared public key

[0151] Committee members for τ i , β i , ρ i calculate the ElGamal commitment

[0152]

[0153] Use zero - knowledge proof to prove that the ElGamal commitment and the Pedersen commitment commit to the same values (τ i , β i , ρ i ), and then broadcast among committee members.

[0154] Calculate

[0155]

[0156] Verify with zero - knowledge proof After verifying the correctness of the calculation, it is made public among the committee members

[0157] The committee calculates

[0158]

[0159] where

[0160] Committee members Randomly select Calculate

[0161]

[0162] This step is to protect the value of ∑τ i ·∑β i -∑ρ i from being leaked. If The committed value ∑τ i ·∑β i -∑ρ i ≠0, then after randomization The committed value Because The random result is unpredictable; then verify through zero - knowledge proof is calculated by and then is made public among the committee members

[0163] Aggregate commitment Calculate

[0164]

[0165] where

[0166] Let where

[0167]

[0168] Committee members The ElGamal private - key share is e i and calculate

[0169]

[0170] Give a zero - knowledge proof to verify that the formula holds; each committee member makes W i public and calculate

[0171] Since At this time

[0172]

[0173] If ∑τ i ·∑β i -∑ρ i = 0, then

[0174]

[0175] Therefore, at this time, verify whether the equation holds. If it holds, it means that ∑τ i ·∑β i -∑ρ i = 0, that is

[0176] 4 - 5) After the verification passes, the committee members disclose ρ i to obtain ρ;

[0177] 4 - 6) The committee members calculate η i = ρ -1 ·β i , and calculate and broadcast it to other committee members;

[0178] At this time,

[0179] (5) Uniqueness determination of voucher identifier and applicant user identity information

[0180] After the calculation is obtained , the committee checks the maintained data structure ID table. This data structure stores anonymous voucher identifiers idx(v id,u ) and the corresponding anonymous voucher information in the form of key - value pairs. Check whether the key values in the ID table are unique. If it is found through retrieval that idx(v id,u ) already exists, it means that this user has applied for an anonymous voucher before. Mark this user and abort the process; if it does not exist, it means that the user is applying for the first time. After storing idx(v id,u ) into the ID table, continue with the subsequent anonymous voucher issuance process.

[0181] After the calculation is obtained , the committee checks the maintained list of anonymous voucher identifiers IDtable. This data structure stores anonymous voucher identifiers idx(v id,u) and the corresponding anonymous credential information, check whether the key value in the ID table is unique. If it is retrieved and found that idx(v id,u ) already exists, it means that the user has applied for an anonymous credential before, mark the user and abort the process; if not, it means that the user is applying for the first time. After storing idx(v id,u ) into the ID table, continue with the subsequent anonymous credential issuance process.

[0182] (6) User tracing

[0183] When it is found that the malicious user credential identifier idx(v id,u ) already exists in the ID table, each committee shard and its Pedersen commitment will be made public, verify the shard correctness, and after passing the verification, aggregate to obtain v id,u . Since in this scheme, the user's identity attribute information is mapped through a hash function, and the user's identity attribute information (such as ID number, passport number, etc.) has certain regularity and limitations, the value matching the aggregated user identity hash value v id,u of each committee node can be found through traversal, and then the user's identity information can be traced to achieve the restoration of identity information.

[0184] The present invention realizes the unique binding of anonymous credentials and user identity information by introducing a privacy generation method for anonymous credential identifiers that is friendly to secure computing. While ensuring the security of the system, it reduces the computational and storage overheads, making the anonymous credential scheme easier to deploy and apply in actual production environments. The new scheme does not rely on a single credential issuer, but rather all members of a committee organization collaborate and reach a consensus to generate, compare, maintain, and issue anonymous credentials. The system has strong robustness; in addition, by effectively defending against identity sybil attacks, the system can avoid ineffective services and responses to false users, improving user satisfaction and trust in the system.

[0185] The present invention has the characteristics of low computational complexity and easy implementation. The design is simple and efficient, friendly to secure computing, and at the same time applicable to distributed systems, avoiding system dependence on a single credential issuer, having the ability to resist single-point failures, and ensuring the robustness of the system. Through the uniquely bound anonymous credential identifiers, duplicate processing of potential false identity information is carried out, enhancing the robustness and reliability of the system.

[0186] The present invention breaks through the technical bottleneck of existing anonymous credential schemes in defending against identity sybil attacks. By researching and adopting an identity calculation method friendly to secure computing, the unique binding of users' private identity information and anonymous credentials is achieved. On the premise of ensuring security, this method improves the calculation efficiency of anonymous credential identities and reduces the calculation overhead of resisting identity sybil attacks. Meanwhile, the design is simple and efficient, applicable to secure multi-party calculation in distributed systems, and has strong anti-single-point failure ability.

[0187] It should be noted that, on the other hand, the present application also provides a storage medium, which may be included in an electronic device; or may exist alone without being assembled into the electronic device. The above storage medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device is caused to implement the methods described in the following embodiments. For example, the electronic device may implement each step of the method as Figure 2 shown.

[0188] In one embodiment, the present application provides a computer program product, including a computer program, which when executed by a processor implements the steps in the above method embodiments.

[0189] In addition, the above drawings are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present invention, rather than for limiting purposes. It is easy to understand that the processes shown in the above drawings do not indicate or limit the time sequence of these processes. Additionally, it is also easy to understand that these processes may be executed synchronously or asynchronously in, for example, multiple modules.

[0190] Those skilled in the art will readily think of other embodiments of the present invention after considering the specification and practicing the invention herein. The present application aims to cover any variations, uses, or adaptive changes of the present invention, which follow the general principles of the present invention and include well-known common general knowledge or conventional technical means in the technical field not disclosed in the present invention. The specification and embodiments are only regarded as exemplary, and the true scope and spirit of the present invention are pointed out by the claims.

[0191] It should be understood that the present invention is not limited to the exact structures described above and shown in the drawings, and various modifications and changes can be made without departing from its scope. The scope of the present invention is only defined by the appended claims.

Claims

1. A method for generating anonymous credential identifier privacy associated with user identity information, characterized in that: The method comprises: The user generates a public / private key pair and maps the identity to a specific domain through a hash function to generate a Pedersen commitment; The user sends the Pedersen commitment to the user identity provider for verification and signing; The user broadcasts the signed Pedersen commitment to all members of the credential issuance committee and sends the identity information shards to each committee member through a secure channel; Committee members verify the correctness of the identity information shards and jointly calculate anonymous credential identification through secure multi-party computing and zero-knowledge proof technology; The committee checks the uniqueness of the anonymous credential identifier. If the identifier already exists, the process is terminated; if not, the identifier is stored in the data structure and the anonymous credential is issued. When a malicious user is found, the shard information is made public and verified to be correct, and the shard information is aggregated to restore the user's identity.

2. The method according to claim 1, characterized in that The steps for the user to generate a Pedersen commitment include: The user uses the hash function H to identify Mapping to a specific domain In, get User Computingv id,u The Pedersen Commitment Among them, g and h are generators, r id,u Is a random number.

3. The method according to claim 1, characterized in that The steps of the committee members jointly calculating the anonymous credential identifier include: The committee members locally calculate the combined value of the identity information shard and the key shard, and generate the corresponding Pedersen commitment; The committee members jointly calculate the intermediate value of the anonymous credential identifier through secure multi-party computing technology; Committee members use zero-knowledge proof technology to verify the correctness of the intermediate value and generate the final anonymous credential identification.

4. The method according to claim 1, characterized in that The committee checks the uniqueness of anonymous credential identifiers by: Committee members maintain a data structure that stores anonymous credential identifiers and their corresponding credential information; The committee member checks whether the newly generated anonymous credential identifier already exists in the data structure; If the identity already exists, the user is marked and the process is aborted; if not, the identity is stored in the data structure and anonymous credentials are issued.

5. The method according to claim 1, characterized in that The steps of restoring the user identity include: When a malicious user is discovered, committee members publicly disclose the identity shard and its Pedersen commitment; Committee members verify the correctness of the shards and aggregate shard information to restore user identities; By traversing the hash values, find the user identity information that matches the aggregate value.

6. A system for implementing the method according to claims 1-5, characterized in that: include: User module, used to generate public / private key pairs, calculate Pedersen commitments, and interact with user identity information providers; The user identity information provider module is used to verify and sign the Pedersen commitment submitted by the user; The credential issuance committee module is used to receive the Pedersen commitment and sharding information broadcast by the user, jointly calculate the anonymous credential identifier, and check the uniqueness of the identifier; A data structure module, used to store anonymous credential identifiers and their corresponding credential information; Secure multi-party computing module for secure computing and zero-knowledge proof verification between committee members.

7. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the anonymous credential identifier privacy generation method for associated user identity information according to any one of claims 1 to 5 is implemented.

8. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the anonymous credential identifier privacy generation method for associated user identity information according to any one of claims 1 to 5 is implemented.

9. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the anonymous credential identification privacy generation method associated with user identity information according to any one of claims 1 to 5 by executing the executable instructions.

Images