Privacy authentication method and device based on zero-knowledge proof, equipment and medium

Abstract

The invention discloses a privacy authentication method and device based on zero knowledge proof, equipment and a medium, and relates to the technical field of information security, and the method comprises the steps: sending a user attribute comprising a fingerprint attribute value corresponding to first fingerprint information of a user side to a certificate issuing center, determining a polynomial commitment value by the certificate issuing center based on a first preset polynomial constructed by the user attributes, and signing the polynomial commitment value to obtain a signature value; respectively determining a fingerprint encryption value corresponding to the fingerprint attribute value and an attribute encryption value corresponding to the user strategy attribute, determining an overall challenge based on the fingerprint encryption value, the attribute encryption value and the polynomial commitment value, and constructing an attribute proof package based on the overall challenge and the polynomial commitment value; and uploading the attribute certification package and the signature value to the smart contract, so that the smart contract verifies the signature value and the attribute certification package, and monitoring a verification result through the server to determine the access authority of the user side. And privacy information exposure in user privacy authentication is prevented.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and particularly to a privacy authentication method, device, equipment and medium based on zero-knowledge proof. Background Art

[0002] With the development of information technology and the enhancement of personal privacy information protection awareness, how to authenticate that a user meets a certain policy without exposing the user's privacy information has become a social need. Existing solutions either rely on various newly proposed signature schemes or rely on complex zero-knowledge proofs based on circuit encoding. Signature schemes often have complex mathematical structures and algorithm designs, making them difficult to implement and deploy, and the signature schemes are not compatible with many existing systems and cannot work in cooperation with the systems; while the complex zero-knowledge proof technology based on circuit encoding has a high technical threshold and requires a large amount of calculation and communication to generate and verify proofs, which will not only increase the computational load of the system but also occupy a large amount of network bandwidth.

[0003] As can be seen from the above, how to prevent the exposure of privacy information in user privacy authentication and overcome the deficiencies such as complexity, poor compatibility, and high overhead in the authentication process is an urgent problem to be solved at present. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a privacy authentication method, device, equipment and medium based on zero-knowledge proof, which can prevent the exposure of privacy information in user privacy authentication and overcome the deficiencies such as complexity, poor compatibility, and high overhead in the authentication process. The specific solutions are as follows:

[0005] In a first aspect, the present application provides a privacy authentication method based on zero-knowledge proof, which is applied to a client and includes:

[0006] Determine a fingerprint attribute value based on the first fingerprint information corresponding to the user side, and send the user attribute including the fingerprint attribute value to the certificate authority, so that the certificate authority constructs a first preset polynomial based on the user attribute, and determines a polynomial commitment value by using the first preset polynomial and a randomly generated second preset polynomial, signs the polynomial commitment value, and sends the obtained signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value to the client;

[0007] Send an access authentication request including a random string to the server, so that the server determines the target upload method of the first fingerprint information based on the access authentication request;

[0008] When a contract upload event including the random string is monitored in the smart contract, obtain the target upload method and the authentication attribute policy, use the target upload method to obtain second fingerprint information, determine a corresponding fingerprint collection commitment value based on the second fingerprint information, and upload the fingerprint collection commitment value and the random string to the smart contract;

[0009] Respectively determine a fingerprint encryption value corresponding to the fingerprint attribute value and an attribute encryption value corresponding to the user policy attribute, determine an overall challenge based on the fingerprint encryption value, the attribute encryption value, and the polynomial commitment value, use the overall challenge to determine an attribute policy challenge, and then construct an attribute proof package based on the attribute policy challenge, the polynomial commitment value, and using zero-knowledge proof technology;

[0010] Upload the attribute proof package and the signature value to the smart contract, so that the smart contract can parse and verify the signature value and the attribute proof package, and listen to the verification result through the server to determine the access permission of the user terminal.

[0011] Optionally, before determining the fingerprint attribute value based on the first fingerprint information corresponding to the user terminal and sending the user attribute including the fingerprint attribute value to the certificate authority, it further includes:

[0012] Obtain a public string determined by the key generation center based on the generator in the group of bilinear mappings and the target numerical values in the preset integer set, make the public string public, and then delete the target numerical values;

[0013] Obtain the public key and private key of the key generation center, make the public key public, and then send the private key to the certificate authority through a secure channel.

[0014] Optionally, determining the fingerprint attribute value based on the first fingerprint information corresponding to the user terminal and sending the user attribute including the fingerprint attribute value to the certificate authority, so that the certificate authority constructs a first preset polynomial based on the user attribute, uses the first preset polynomial and a randomly generated second preset polynomial to determine a polynomial commitment value, signs the polynomial commitment value, and sends the obtained signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value to the client, includes:

[0015] Collect the first fingerprint information for the user terminal, and process the first fingerprint information based on a fuzzy extractor to obtain a first fingerprint template;

[0016] Determine the first fingerprint template as the fingerprint attribute value, and then determine the user attribute based on the fingerprint attribute value and other attributes of the user terminal;

[0017] Send the user attributes to the certificate authority so that, after receiving the user attributes, the certificate authority constructs a point set of the user attributes based on the indexes of each attribute name and the byte arrays of each attribute value in the user attributes, constructs a first preset polynomial passing through all points in the point set, and records the corresponding first preset polynomial coefficients. Then, randomly generate a second preset polynomial and record the corresponding second preset polynomial coefficients. Determine a polynomial commitment value based on the generator, the target value, the first preset polynomial coefficients, and the second preset polynomial coefficients. Then, sign the polynomial commitment value, and send the obtained signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value to the client.

[0018] Optionally, when it is monitored that there is a contract upload event including the random string in the smart contract, obtain the target upload method and the authentication attribute policy, and use the target upload method to obtain second fingerprint information. Determine a corresponding fingerprint acquisition commitment value based on the second fingerprint information, and upload the fingerprint acquisition commitment value and the random string to the smart contract, including:

[0019] When it is monitored that there is a contract upload event including the random string in the smart contract, obtain the target upload method, and use the target upload method to obtain second fingerprint information;

[0020] Use the fuzzy extractor to convert the second fingerprint information into a second fingerprint template, and determine a fingerprint acquisition commitment value based on the second fingerprint template and the generator. Then, upload the fingerprint acquisition commitment value and the random string to the smart contract;

[0021] Determine a set of attribute values to be hidden based on the authentication attribute policy in the smart contract; the set of attribute values includes policy attribute values.

[0022] Optionally, the separately determining a fingerprint encryption value corresponding to the fingerprint attribute value and an attribute encryption value corresponding to the user policy attribute includes:

[0023] Use the first fingerprint information corresponding to the fingerprint attribute value to determine the position number of the first fingerprint information among all attributes to obtain a fingerprint attribute index, and determine a fingerprint encryption value based on the fingerprint attribute value, the fingerprint attribute index, the second preset polynomial, and the generator;

[0024] Determine a first fingerprint attribute polynomial and the corresponding first fingerprint attribute polynomial coefficients based on the first preset polynomial, the fingerprint attribute index, and the fingerprint attribute value;

[0025] Determine the second fingerprint attribute polynomial coefficients corresponding to the second fingerprint attribute polynomial by using the second preset polynomial, the fingerprint attribute index, and the fingerprint attribute value;

[0026] Determine the fingerprint commitment voucher based on the generator, the target value, the first fingerprint attribute polynomial coefficients, and the second fingerprint attribute polynomial coefficients;

[0027] Obtain the user policy attribute and the corresponding policy attribute value input by the client, and determine the attribute encryption value based on the policy attribute index corresponding to the user policy attribute, the policy attribute value, the second preset polynomial, and the generator;

[0028] Determine the first policy attribute value polynomial and the corresponding first policy attribute value polynomial coefficients based on the first preset polynomial, the policy attribute index, and the policy attribute value;

[0029] Determine the second policy attribute value polynomial and the corresponding second policy attribute value polynomial coefficients by using the second preset polynomial, the policy attribute index, and the policy attribute value;

[0030] Determine the attribute commitment voucher based on the generator, the target value, the first policy attribute value polynomial coefficients, and the second policy attribute value polynomial coefficients.

[0031] Optionally, determine the overall challenge based on the fingerprint encryption value, the attribute encryption value, and the polynomial commitment value, and use the overall challenge to determine the attribute policy challenge. Then, construct the attribute proof package based on the attribute policy challenge, the polynomial commitment value, and using the zero-knowledge proof technology, including:

[0032] Determine the fingerprint attribute commitment based on the first random number and the generator, and determine the simulation commitment by using the second random number, the third random number, and the attribute encryption value;

[0033] Determine the policy attribute commitment by using the generator and the fourth random number, and determine the overall challenge based on the polynomial commitment value, the fingerprint attribute commitment, the simulation commitment, the policy attribute commitment, the fingerprint encryption value, the attribute encryption value, and using the hash algorithm;

[0034] Determine the policy attribute challenge based on the overall challenge, and determine the fingerprint attribute response value by using the first random number, the second random number, the overall challenge, the second preset polynomial, and the fingerprint attribute index;

[0035] Determine the policy attribute response value by using the fourth random number, the policy attribute challenge, the policy attribute index, and the second polynomial;

[0036] Construct an attribute proof package based on the fingerprint encryption value, the attribute encryption value, the fingerprint attribute commitment, the simulation commitment, the fingerprint attribute response value, the policy attribute response value, the overall challenge, the fingerprint acquisition commitment value, and the polynomial commitment value.

[0037] Optionally, uploading the attribute proof package and the signature value to the smart contract, so that the smart contract parses and verifies the signature value and the attribute proof package, and listens to the verification result through the server to determine the access permission of the client, including:

[0038] Upload the attribute proof package and the signature value to the smart contract, so that the smart contract parses the signature value and the attribute proof package to obtain the fingerprint encryption value, the attribute encryption value, the fingerprint attribute commitment, the simulation commitment, the fingerprint attribute response value, the policy attribute response value, the overall challenge, the fingerprint acquisition commitment value, and the polynomial commitment value, and then uses the public key to verify the validity of the signature value. If the verification passes, determine whether the fingerprint commitment certificate and the attribute commitment certificate are in the polynomial commitment value. If so, determine a fingerprint attribute matching equation based on the generator, the fingerprint attribute response value, the fingerprint attribute commitment, the fingerprint acquisition commitment value, and the overall challenge. If the fingerprint attribute matching equation holds, determine a policy attribute verification equation based on the simulation commitment, the generator, the second random number, the attribute encryption value, the attribute value set, and the overall challenge. If the policy attribute verification equation holds, determine whether the overall challenge is equal to the sum of the corresponding challenge values. If they are equal, it indicates that the verification result is successful. When the server listens to a successful verification result, open the corresponding access permission to the client.

[0039] In a second aspect, the present application provides a privacy authentication device based on zero-knowledge proof, which is applied to a client and includes:

[0040] A polynomial commitment value signature module, which is used to determine a fingerprint attribute value based on the first fingerprint information corresponding to the client, send the user attributes including the fingerprint attribute value to the certificate authority, so that the certificate authority constructs a first preset polynomial based on the user attributes, determines a polynomial commitment value by using the first preset polynomial and a randomly generated second preset polynomial, signs the polynomial commitment value, and sends the obtained signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value to the client;

[0041] A target upload method determination module, configured to send an access authentication request including a random string to a server, so that the server determines a target upload method of the first fingerprint information based on the access authentication request;

[0042] A fingerprint commitment value determination module, configured to, when detecting a contract upload event including the random string in a smart contract, obtain the target upload method and an authentication attribute policy, obtain second fingerprint information by using the target upload method, determine a corresponding fingerprint acquisition commitment value based on the second fingerprint information, and upload the fingerprint acquisition commitment value and the random string to the smart contract;

[0043] An overall challenge determination module, configured to respectively determine a fingerprint encryption value corresponding to the fingerprint attribute value and an attribute encryption value corresponding to a user policy attribute, determine an overall challenge based on the fingerprint encryption value, the attribute encryption value, and the polynomial commitment value, determine an attribute policy challenge by using the overall challenge, and then construct an attribute proof package based on the attribute policy challenge, the polynomial commitment value, and by using a zero-knowledge proof technique;

[0044] A verification result monitoring module, configured to upload the attribute proof package and the signature value to the smart contract, so that the smart contract parses and verifies the signature value and the attribute proof package, and monitors the verification result through the server to determine the access permission of the client.

[0045] In a third aspect, the present application provides an electronic device, including:

[0046] A memory, configured to store a computer program;

[0047] A processor, configured to execute the computer program to implement the foregoing privacy authentication method based on zero-knowledge proof.

[0048] A polynomial commitment value signature module, configured to determine a fingerprint attribute value based on first fingerprint information corresponding to a client, send a user attribute including the fingerprint attribute value to a certificate authority, so that the certificate authority constructs a first preset polynomial based on the user attribute, determine a polynomial commitment value by using the first preset polynomial and a randomly generated second preset polynomial, sign the polynomial commitment value, and send the obtained signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value to the client;

[0049] A target upload method determination module, configured to send an access authentication request including a random string to a server, so that the server determines a target upload method of the first fingerprint information based on the access authentication request;

[0050] A fingerprint commitment value determination module, configured to, when it monitors a contract upload event including the random string in the smart contract, obtain the target upload method and the authentication attribute policy, obtain second fingerprint information by using the target upload method, determine a corresponding fingerprint collection commitment value based on the second fingerprint information, and upload the fingerprint collection commitment value and the random string to the smart contract;

[0051] An overall challenge determination module, configured to respectively determine a fingerprint encryption value corresponding to the fingerprint attribute value and an attribute encryption value corresponding to the user policy attribute, determine an overall challenge based on the fingerprint encryption value, the attribute encryption value, and the polynomial commitment value, determine an attribute policy challenge by using the overall challenge, and then construct an attribute proof package based on the attribute policy challenge, the polynomial commitment value, and by using zero-knowledge proof technology;

[0052] A verification result monitoring module, configured to upload the attribute proof package and the signature value to the smart contract, so that the smart contract parses and verifies the signature value and the attribute proof package, and monitors the verification result through the server to determine the access permission of the client.

[0053] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein when the computer program is executed by a processor, the foregoing privacy authentication method based on zero-knowledge proof is implemented.

[0054] This application determines a fingerprint attribute value based on the first fingerprint information corresponding to the user terminal, and sends the user attributes including the fingerprint attribute value to the certificate authority, so that the certificate authority constructs a first preset polynomial based on the user attributes, and determines a polynomial commitment value by using the first preset polynomial and a randomly generated second preset polynomial, signs the polynomial commitment value, and sends the obtained signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value to the client; sends an access authentication request including a random string to the server, so that the server determines the target upload method of the first fingerprint information based on the access authentication request; when it is monitored that there is a contract upload event including the random string in the smart contract, obtains the target upload method and the authentication attribute policy, and obtains the second fingerprint information by using the target upload method, determines a corresponding fingerprint collection commitment value based on the second fingerprint information, and uploads the fingerprint collection commitment value and the random string to the smart contract; respectively determines a fingerprint encryption value corresponding to the fingerprint attribute value and an attribute encryption value corresponding to the user policy attribute, determines an overall challenge based on the fingerprint encryption value, the attribute encryption value, and the polynomial commitment value, and determines an attribute policy challenge by using the overall challenge, and then constructs an attribute proof package based on the attribute policy challenge, the polynomial commitment value, and by using the zero-knowledge proof technology; uploads the attribute proof package and the signature value to the smart contract, so that the smart contract parses and verifies the signature value and the attribute proof package, and monitors the verification result through the server to determine the access permission of the user terminal.

[0055] As can be seen from the above, this application determines the user attributes based on the first fingerprint information of the user terminal and sends the user attributes to the certificate authority, so that the certificate authority determines the polynomial commitment value based on the user attributes, signs the polynomial commitment value and sends it back to the client, ensuring that the user identity attributes are accurately collected and recorded, laying a foundation for subsequent authentication; then sends an access authentication request containing a random string to the server to determine the fingerprint upload method. When the client monitors the contract upload event and obtains the target upload method and authentication attribute policy of the first fingerprint information, it collects the second fingerprint information and uploads the determined fingerprint collection commitment value to the smart contract. The random string increases the authentication security and prevents the access authentication request from being maliciously intercepted; then determines the overall challenge through the fingerprint encryption value, attribute encryption value and the polynomial commitment value, and constructs an attribute proof package using zero-knowledge proof technology to protect user privacy. The smart contract parses and verifies the attribute proof package, and the server listens to the verification result to determine the access permission of the user terminal. In this way, by automatically verifying the signature value and the attribute proof package through the smart contract, it effectively ensures that the attribute values required for authentication by the user terminal are not leaked, avoids the large overhead brought by using complex zero-knowledge proofs based on circuit encoding, and improves the authentication efficiency and user experience. Description of the Drawings

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only the embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained according to the provided drawings.

[0057] Figure 1 Flowchart of a privacy authentication method based on zero-knowledge proof disclosed in this application;

[0058] Figure 2 Schematic diagram of fingerprint information collection provided by this application;

[0059] Figure 3 Schematic diagram of proof and verification provided by this application;

[0060] Figure 4 Schematic diagram of the structure of a privacy authentication device based on zero-knowledge proof disclosed in this application;

[0061] Figure 5 Structural diagram of an electronic device disclosed in this application. Detailed Embodiments

[0062] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0063] Currently, existing solutions either rely on various newly proposed signature schemes or rely on complex zero-knowledge proofs based on circuit encoding. However, signature schemes have certain difficulties in implementation and deployment, and are not compatible with many existing systems and cannot work in coordination with the systems; while complex zero-knowledge proof technologies based on circuit encoding have high technical thresholds and require a large amount of calculation and communication to generate and verify proofs, which will not only increase the computational load of the system, but also occupy a large amount of network bandwidth. For this reason, this application provides a privacy authentication method based on zero-knowledge proof, which automatically verifies the signature value and attribute proof package through a smart contract, effectively ensuring that the attribute value required for authentication by the user side is not leaked, avoiding the large overhead brought by using complex zero-knowledge proofs based on circuit encoding, and improving the authentication efficiency and user experience.

[0064] See Figure 1 As shown, an embodiment of the present invention discloses a privacy authentication method based on zero-knowledge proof, which is applied to a client and includes:

[0065] Step S11: Determine a fingerprint attribute value based on the first fingerprint information corresponding to the user side, and send the user attributes including the fingerprint attribute value to the certificate authority, so that the certificate authority constructs a first preset polynomial based on the user attributes, and uses the first preset polynomial and a randomly generated second preset polynomial to determine a polynomial commitment value, sign the polynomial commitment value, and send the obtained signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value to the client.

[0066] In this embodiment, obtain a common string determined by the key generation center based on the generator in the group of bilinear mappings and the target value of the preset integer set; specifically, the key generation center selects a bilinear mapping with a prime order p to randomly select a generator from the group of the bilinear mappings and randomly select a generator and from the group of the bilinear mappings randomly select a generator from the group of the bilinear mappings, then randomly select an element from the preset integer set as the target value, that is ; the preset integer set is the multiplicative group of non-zero integers modulo p. Then, a set is constructed based on each of the generators and the target value , , and this set is used as the common string for polynomial commitment. Then, the common string is made public, and the target value is discarded. Obtain the public key and private key of the key generation center, make the public key public, and send the private key to the certificate authority through a secure channel. Specifically, before determining the fingerprint attribute value based on the first fingerprint information corresponding to the client and sending the user attribute including the fingerprint attribute value to the certificate authority, it further includes: obtaining the common string determined by the key generation center based on the generators in the group of bilinear maps and the target values of the preset integer set, making the common string public, and then deleting the target value; obtaining the public key and private key of the key generation center, making the public key public, and then sending the private key to the certificate authority through a secure channel.

[0067] It can be understood that after determining the common string, public key, and private key based on the key generation center, collect the first fingerprint information corresponding to the client, use the fuzzy extractor to convert the first fingerprint information into a first fingerprint template, and use the first fingerprint template as the fingerprint attribute value. Then, determine the user attribute based on the fingerprint attribute value and other attributes of the client; the other attributes of the client include the hobbies, date of birth, ID number, and address code corresponding to the client; then send the user attribute to the certificate authority, so that after receiving the user attribute, the certificate authority uses the index of each attribute name in the user attribute as the abscissa of the point, and the integer represented by the byte array of each attribute value in the user attribute as the ordinate, in order to construct the point set of the user attribute based on each abscissa and each ordinate, for example .

[0068] Furthermore, the certificate authority constructs an n-degree polynomial that passes through all the coordinate points in the point set, that is, the first preset polynomial. The first preset polynomial coefficients corresponding to the first preset polynomial are , and randomly generate an n-degree polynomial as the second preset polynomial. The second preset polynomial coefficients corresponding to the second preset polynomial are , and then determine the polynomial commitment value based on the generator, the target value, the first preset polynomial coefficients, and the second preset polynomial coefficients. The formula corresponding to the polynomial commitment value is as follows:

[0069] ;

[0070] Among them, is the polynomial commitment value; is the product symbol, representing the product of multiple terms; and are the generators; is the target value; is the first preset polynomial coefficient; is the second preset polynomial coefficient. After obtaining the polynomial commitment value, sign the polynomial commitment value using the private key, and send the obtained signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value to the client.

[0071] Specifically, determining the fingerprint attribute value based on the first fingerprint information corresponding to the user terminal, and sending the user attribute including the fingerprint attribute value to the certificate authority, so that the certificate authority constructs a first preset polynomial based on the user attribute, and determines the polynomial commitment value using the first preset polynomial and a randomly generated second preset polynomial, signs the polynomial commitment value, and sends the obtained signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value to the client, includes: collecting the first fingerprint information for the user terminal, and processing the first fingerprint information based on the fuzzy extractor to obtain a first fingerprint template; determining the first fingerprint template as the fingerprint attribute value, and then determining the user attribute based on the fingerprint attribute value and other attributes of the user terminal; sending the user attribute to the certificate authority, so that after receiving the user attribute, the certificate authority constructs a point set of the user attribute based on the indexes of each attribute name and the byte arrays of each attribute value in the user attribute, constructs a first preset polynomial passing through all points in the point set, and records the corresponding first preset polynomial coefficient, then randomly generates a second preset polynomial and records the corresponding second preset polynomial coefficient, determines the polynomial commitment value based on the generator, the target value, the first preset polynomial coefficient, and the second preset polynomial coefficient, then signs the polynomial commitment value, and sends the obtained signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value to the client.

[0072] Step S12: Send an access authentication request including a random string to the server, so that the server determines the target upload method of the first fingerprint information based on the access authentication request.

[0073] In this embodiment, the client sends an access authentication request including a random string key to the server, so that after receiving the access authentication request, the server determines the target upload method of the first fingerprint information; the target upload method includes a fingerprint collection and upload module integrated in the server for on-site authentication, and a fingerprint collection and upload module integrated in the client for remote authentication, and uploads the target upload method, the random string, and a pre-determined authentication attribute policy to the smart contract of the blockchain.

[0074] Step S13: When it is monitored that there is a contract upload event including the random string in the smart contract, obtain the target upload method and the authentication attribute policy, and use the target upload method to obtain the second fingerprint information, determine the corresponding fingerprint collection commitment value based on the second fingerprint information, and upload the fingerprint collection commitment value and the random string to the smart contract.

[0075] In this embodiment, when it is monitored that there is a contract upload event including the random string in the smart contract, obtain the target upload method and the authentication attribute policy, and use the target fingerprint collection and upload module determined by the target upload method to obtain the second fingerprint information, then convert the second fingerprint information into a second fingerprint template based on the fuzzy extractor, and use the second fingerprint template and the generator to determine the fingerprint collection commitment value. The formula corresponding to the fingerprint collection commitment value is as follows:

[0076] ;

[0077] where is the fingerprint collection commitment value; is the generator; is the number represented by the byte array of the second fingerprint template. After obtaining the fingerprint collection commitment value, upload the fingerprint collection commitment value and the random string to the smart contract, and determine the set of attribute values including the policy attribute value of the user side that needs to be hidden based on the authentication attribute policy.

[0078] In a specific embodiment, the user side selects the set of attribute values to be hidden from the set of authentication attribute values that meet the authentication requirements according to the authentication attribute policy , and the set of attribute values must include the policy attribute value of the user side. Taking the hobby attribute as an example, the hobby set can be calligraphy, singing, dancing, etc. If the hobby attribute of the user side is singing with a value of 2, the set of attribute values can be selected to hide the hobby attribute of the user side among singing and dancing, or Hide the singing of the client among other hobby attributes.

[0079] Specifically, when it is monitored that there is a contract upload event including the random string in the smart contract, obtain the target upload method and the authentication attribute policy, and use the target upload method to obtain the second fingerprint information. Based on the second fingerprint information, determine the corresponding fingerprint collection commitment value, and upload the fingerprint collection commitment value and the random string to the smart contract, including: when it is monitored that there is a contract upload event including the random string in the smart contract, obtain the target upload method, and use the target upload method to obtain the second fingerprint information; use the fuzzy extractor to convert the second fingerprint information into a second fingerprint template, and based on the second fingerprint template and the generator, determine the fingerprint collection commitment value, and then upload the fingerprint collection commitment value and the random string to the smart contract; determine the set of attribute values to be hidden based on the authentication attribute policy in the smart contract; the set of attribute values includes policy attribute values.

[0080] Step S14: Respectively determine the fingerprint encryption value corresponding to the fingerprint attribute value and the attribute encryption value corresponding to the user policy attribute. Based on the fingerprint encryption value, the attribute encryption value, and the polynomial commitment value, determine the overall challenge, and use the overall challenge to determine the attribute policy challenge. Then, based on the attribute policy challenge, the polynomial commitment value, and using the zero-knowledge proof technology, construct an attribute proof package.

[0081] In this embodiment, use the first fingerprint information corresponding to the fingerprint attribute value to determine the position number of the first fingerprint information among all attributes to obtain the fingerprint attribute index and based on the fingerprint attribute value, the fingerprint attribute index, the second preset polynomial, and the generator, determine the fingerprint encryption value. The formula corresponding to the fingerprint encryption value is as follows:

[0082] ;

[0083] where is the fingerprint encryption value; and are the generators; is the fingerprint attribute value; is the fingerprint attribute index; is the second preset polynomial.

[0084] It can be understood that after obtaining the fingerprint encryption value, based on the first preset polynomial, the fingerprint attribute index, and the fingerprint attribute value, determine the first fingerprint attribute polynomial and the corresponding first fingerprint attribute polynomial coefficients; the formula corresponding to the first fingerprint attribute polynomial is as follows:

[0085] ;

[0086] Wherein, is the independent variable of the first fingerprint attribute polynomial; is the fingerprint attribute index; is the first preset polynomial; is the fingerprint attribute value. After obtaining the first fingerprint attribute polynomial, determine the first fingerprint attribute polynomial coefficient corresponding to the first fingerprint attribute polynomial . Then, use the second preset polynomial, the fingerprint attribute index, and the fingerprint attribute value to determine the second fingerprint attribute polynomial coefficient corresponding to the second fingerprint attribute polynomial; the formula corresponding to the second fingerprint attribute polynomial is as follows:

[0087] ;

[0088] Wherein, is the independent variable of the second fingerprint attribute polynomial; is the fingerprint attribute index; is the second preset polynomial; is the fingerprint attribute value. After obtaining the second fingerprint attribute polynomial, determine the second fingerprint attribute polynomial coefficient corresponding to the second fingerprint attribute polynomial .

[0089] Furthermore, based on the generator, the target value, the first fingerprint attribute polynomial coefficient, and the second fingerprint attribute polynomial coefficient, determine the fingerprint commitment voucher; the formula corresponding to the fingerprint commitment voucher is as follows:

[0090] ;

[0091] Wherein, is the fingerprint commitment voucher; is the product symbol; and are the generators; is the target value; is the first fingerprint attribute polynomial coefficient; is the second fingerprint attribute polynomial coefficient; and represent the index range of the product, is an integer variable starting from 0.

[0092] In this embodiment, after obtaining the fingerprint commitment certificate, the user policy attributes and the corresponding policy attribute values input by the client are acquired, and the attribute encryption value is determined based on the policy attribute index corresponding to the user policy attribute, the policy attribute value, the second preset polynomial, and the generator. In a specific implementation, taking the hobby attribute as an example, the formula corresponding to the attribute encryption value is as follows:

[0093] ;

[0094] Wherein, is the attribute encryption value; and are the generators; is the policy attribute index; is the policy attribute value; is the second preset polynomial. After obtaining the attribute encryption value, the first policy attribute value polynomial and the corresponding first policy attribute value polynomial coefficients are determined based on the first preset polynomial, the policy attribute index, and the policy attribute value; the formula corresponding to the first policy attribute value polynomial is as follows:

[0095] ;

[0096] Wherein, is the independent variable; is the policy attribute value; is the policy attribute index; is the first preset polynomial. Correspondingly, the first policy attribute value polynomial coefficient corresponding to the first policy attribute value polynomial is .

[0097] It can be understood that the second policy attribute value polynomial and the corresponding second policy attribute value polynomial coefficients are determined by using the second preset polynomial, the policy attribute index, and the policy attribute value; the formula corresponding to the second policy attribute value polynomial is as follows:

[0098] ;

[0099] Wherein, is the independent variable; is the policy attribute value; is the policy attribute index; is the second preset polynomial. Correspondingly, the second policy attribute value polynomial coefficient corresponding to the second policy attribute value polynomial is Next, determine an attribute commitment voucher based on the generator, the target value, the polynomial coefficients of the first policy attribute value, and the polynomial coefficients of the second policy attribute value; the formula corresponding to the attribute commitment voucher is as follows:

[0100] ;

[0101] wherein, is the attribute commitment voucher; is the product symbol; and are the generators; is the target value; are the polynomial coefficients of the first policy attribute value; are the polynomial coefficients of the second policy attribute value; and represent the index range of the product, is an integer variable starting from 0.

[0102] Specifically, the steps of separately determining the fingerprint encryption value corresponding to the fingerprint attribute value and the attribute encryption value corresponding to the user policy attribute include: determining the position number of the first fingerprint information corresponding to the fingerprint attribute value among all attributes to obtain a fingerprint attribute index, and determining the fingerprint encryption value based on the fingerprint attribute value, the fingerprint attribute index, the second preset polynomial, and the generator; determining the first fingerprint attribute polynomial and the corresponding first fingerprint attribute polynomial coefficients based on the first preset polynomial, the fingerprint attribute index, and the fingerprint attribute value; determining the second fingerprint attribute polynomial coefficients corresponding to the second fingerprint attribute polynomial based on the second preset polynomial, the fingerprint attribute index, and the fingerprint attribute value; determining a fingerprint commitment voucher based on the generator, the target value, the first fingerprint attribute polynomial coefficients, and the second fingerprint attribute polynomial coefficients; obtaining the user policy attribute and the corresponding policy attribute value input by the user terminal, and determining the attribute encryption value based on the policy attribute index corresponding to the user policy attribute, the policy attribute value, the second preset polynomial, and the generator; determining the first policy attribute value polynomial and the corresponding first policy attribute value polynomial coefficients based on the first preset polynomial, the policy attribute index, and the policy attribute value; determining the second policy attribute value polynomial and the corresponding second policy attribute value polynomial coefficients based on the second preset polynomial, the policy attribute index, and the policy attribute value; determining an attribute commitment voucher based on the generator, the target value, the first policy attribute value polynomial coefficients, and the second policy attribute value polynomial coefficients.

[0103] In this embodiment, after obtaining the attribute commitment voucher, generate a first random number , determine the fingerprint attribute commitment based on the first random number and the generator, and the formula corresponding to the fingerprint attribute commitment is as follows:

[0104] ;

[0105] where, is the generator; is the first random number. Then generate the second random number and the third random number , and determine the simulation commitment by using the second random number, the third random number and the attribute encryption value. Specifically, if the set of attribute values to be hidden has attribute values , let , for each attribute value , , the formula corresponding to the simulation commitment is as follows:

[0106] ;

[0107] where, and are the generators; is the second random number; is the third random number; is the attribute value in the set of attribute values to be hidden ; is the attribute encryption value.

[0108] It can be understood that a fourth random number is generated, and the policy attribute commitment is determined by using the fourth random number and the policy attribute value. The formula corresponding to the policy attribute commitment is:

[0109] ;

[0110] where, is the policy attribute commitment; is the generator; is the fourth random number. After obtaining the policy attribute commitment, determine the overall challenge based on the polynomial commitment value, the fingerprint attribute commitment, the simulation commitment, the policy attribute commitment, the fingerprint encryption value, the attribute encryption value and by using the hash algorithm; the formula corresponding to the overall challenge is as follows:

[0111] ;

[0112] where, is the overall challenge; is the hash algorithm; is the polynomial commitment value; is the fingerprint encryption value; is the attribute encryption value; is the fingerprint attribute commitment; is the simulation commitment.

[0113] Furthermore, after obtaining the overall challenge, determine the policy attribute challenge based on the overall challenge; the formula corresponding to the policy attribute challenge is as follows:

[0114] ;

[0115] wherein, is the policy attribute challenge; is the overall challenge; is the summation symbol; represents the set of attribute values to be hidden except for the other attribute values corresponding to values in the set. Then, use the first random number, the second random number, the overall challenge, the second preset polynomial, and the fingerprint attribute index to determine the fingerprint attribute response value; the formula corresponding to the fingerprint attribute response value is:

[0116] ;

[0117] wherein, is the fingerprint attribute response value; is the first random number; is the overall challenge; is the second preset polynomial; is the fingerprint attribute index.

[0118] In this embodiment, use the fourth random number, the policy attribute challenge, the policy attribute index, and the second polynomial to determine the policy attribute response value; the formula corresponding to the policy attribute response value is as follows:

[0119] ;

[0120] wherein, is the policy attribute response value; is the fourth random number; is the second preset polynomial; is the policy attribute index. After obtaining the policy attribute response value, construct an attribute proof package based on the fingerprint encryption value, the attribute encryption value, the fingerprint attribute commitment, the simulation commitment, the fingerprint attribute response value, the policy attribute response value, the overall challenge, the fingerprint collection commitment value, and the polynomial commitment value. The attribute proof package is as follows:

[0121] ;

[0122] wherein, is the attribute proof package; is the polynomial commitment value; is the fingerprint encryption value; is the attribute encryption value; is the fingerprint attribute commitment; is the fingerprint attribute response value; is the simulation commitment; is the third random number; is the policy attribute response value.

[0123] Specifically, determine the overall challenge based on the fingerprint encryption value, the attribute encryption value, and the polynomial commitment value, and use the overall challenge to determine the attribute policy challenge. Then, construct an attribute proof package based on the attribute policy challenge, the polynomial commitment value, and using zero-knowledge proof technology, including: determining the fingerprint attribute commitment based on the first random number and the generator, and determining the simulation commitment using the second random number, the third random number, and the attribute encryption value; determining the policy attribute commitment using the generator and the fourth random number, and determining the overall challenge based on the polynomial commitment value, the fingerprint attribute commitment, the simulation commitment, the policy attribute commitment, the fingerprint encryption value, the attribute encryption value, and using the hash algorithm; determining the policy attribute challenge based on the overall challenge, and determining the fingerprint attribute response value using the first random number, the second random number, the overall challenge, the second preset polynomial, and the fingerprint attribute index; determining the policy attribute response value using the fourth random number, the policy attribute challenge, the policy attribute index, and the second polynomial; constructing an attribute proof package based on the fingerprint encryption value, the attribute encryption value, the fingerprint attribute commitment, the simulation commitment, the fingerprint attribute response value, the policy attribute response value, the overall challenge, the fingerprint collection commitment value, and the polynomial commitment value.

[0124] Step S15: Upload the attribute proof package and the signature value to the smart contract, so that the smart contract can parse and verify the signature value and the attribute proof package, and listen to the verification result through the server to determine the access permission of the user terminal.

[0125] In this embodiment, after obtaining the attribute proof package, the attribute proof package and the signature value are uploaded to the smart contract, so that the smart contract parses the signature value and the attribute proof package to obtain the fingerprint encryption value, the attribute encryption value, the fingerprint attribute commitment, the simulation commitment, the fingerprint attribute response value, the policy attribute response value, the overall challenge, the fingerprint collection commitment value, and the polynomial commitment value. Then, the public key is used to verify whether the signature value corresponding to the polynomial commitment value is valid. If it is valid, it is determined whether the fingerprint commitment credential and the attribute commitment credential are in the polynomial commitment value, that is, it is determined whether the bilinear pairing equation holds. The bilinear pairing equation is as follows:

[0126] ;

[0127] Wherein, is the polynomial commitment value; and are the generators; is the target value; is the fingerprint commitment credential; is the fingerprint attribute index; is the fingerprint encryption value; is the attribute commitment credential; is the policy attribute index; is the attribute encryption value.

[0128] It can be understood that if the bilinear pairing equation holds, it indicates whether the fingerprint commitment credential and the attribute commitment credential are in the polynomial commitment value, and a fingerprint attribute matching equation is determined based on the generator, the fingerprint attribute response value, the fingerprint attribute commitment, the fingerprint collection commitment value, and the overall challenge. The fingerprint attribute matching equation is as follows:

[0129] ;

[0130] Wherein, is the generator; is the fingerprint attribute response value; is the fingerprint attribute commitment; is the fingerprint encryption value; is the fingerprint collection commitment value, is the sum of challenge values, and the formula corresponding to the sum of challenge values is as follows:

[0131] ;

[0132] Wherein, are the respective challenge values in the attribute proof package.

[0133] Further, if the fingerprint attribute matching equation holds, a policy attribute verification equation is determined based on the simulated commitment, the generator, the second random number, the attribute encryption value, the set of attribute values, and the overall challenge. The policy attribute verification equation is as follows:

[0134] ;

[0135] where, is the simulated commitment; and are the generators; is the second random number; are the challenge values in the attribute proof package; is the set of attribute values to be hidden and the attribute value in; is the attribute encryption value. If the policy attribute verification equation holds, it is determined whether the sum of the smart contract challenge value and the challenge value corresponding to the overall challenge is equal. If they are equal, it indicates that the verification result is successful. When the server monitors a successful verification result, the corresponding access permission is opened for the client. It is worth mentioning that in the above verification process, if one step fails to be verified, it indicates that the entire verification process fails.

[0136] Specifically, uploading the attribute proof package and the signature value to the smart contract so that the smart contract can parse and verify the signature value and the attribute proof package, and the server listens for the verification result to determine the access permission of the client, including: uploading the attribute proof package and the signature value to the smart contract so that the smart contract can parse the signature value and the attribute proof package to obtain the fingerprint encryption value, the attribute encryption value, the fingerprint attribute commitment, the simulation commitment, the fingerprint attribute response value, the policy attribute response value, the overall challenge, the fingerprint collection commitment value, and the polynomial commitment value, and then using the public key to verify the validity of the signature value. If the verification passes, it is determined whether the fingerprint commitment certificate and the attribute commitment certificate are in the polynomial commitment value. If so, a fingerprint attribute matching equation is determined based on the generator, the fingerprint attribute response value, the fingerprint attribute commitment, the fingerprint collection commitment value, and the overall challenge. If the fingerprint attribute matching equation holds, a policy attribute verification equation is determined based on the simulation commitment, the generator, the second random number, the attribute encryption value, the set of attribute values, and the overall challenge. If the policy attribute verification equation holds, it is determined whether the overall challenge is equal to the sum of the corresponding challenge values. If they are equal, it indicates that the verification result is successful. When the server listens for a successful verification result, the corresponding access permission is opened to the client.

[0137] As can be seen from the above, this application determines the user attributes based on the first fingerprint information of the client and sends the user attributes to the certificate authority so that the certificate authority can determine the polynomial commitment value based on the user attributes and send it back to the client after signing the polynomial commitment value, ensuring that the user identity attributes are accurately collected and recorded, laying a foundation for subsequent authentication; then sends an access authentication request containing a random string to the server to determine the fingerprint upload method. When the client listens for the contract upload event and obtains the target upload method of the first fingerprint information and the authentication attribute policy, it collects the second fingerprint information and uploads the determined fingerprint collection commitment value to the smart contract. The random string increases the authentication security and prevents the access authentication request from being maliciously intercepted; then determines the overall challenge through the fingerprint encryption value, the attribute encryption value, and the polynomial commitment value, and constructs an attribute proof package using zero-knowledge proof technology to protect user privacy. The smart contract parses and verifies the attribute proof package, and the server listens for the verification result to determine the access permission of the client. In this way, the smart contract automatically verifies the signature value and the attribute proof package, effectively ensuring that the attribute values required for authentication by the client are not leaked, avoiding the large overhead brought by using complex zero-knowledge proofs based on circuit encoding, and improving the authentication efficiency and user experience.

[0138] As can be seen from the above embodiments, the present application performs zero-knowledge proof verification operations on authentication information based on blockchain smart contracts, making the verification results publicly credible. Therefore, the process of performing zero-knowledge proof verification operations on authentication information based on blockchain smart contracts is described.

[0139] Combined with Figure 2 and Figure 3 , an embodiment of the present invention discloses a specific privacy authentication method based on zero-knowledge proof, which is applied to a client and includes:

[0140] In this embodiment, in the initialization stage, the public key and private key required for the signature algorithm are obtained from the key generation center. The private key is mainly used to sign the polynomial commitment value. By using the private key for signing, the integrity and non-repudiation of the polynomial commitment can be ensured; the generator randomly selected from the group based on the bilinear mapping of prime order p is obtained, and the common string determined by the target value in the preset integer set is obtained, and the common string is publicly disclosed to the blockchain, the server, the client, and the fingerprint collection and upload module, and then the relevant sensitive information is cleared and discarded; then the public key is publicly disclosed in the blockchain, the server, and the client, and the private key is sent to the certificate authority through a secure channel.

[0141] It can be understood that the fingerprint collection and upload module is integrated into the server and the client. Figure 2 This is a schematic diagram of fingerprint information collection provided in this embodiment. The first fingerprint information pressed by the user through the fingerprint collection and upload module integrated in the client is obtained, and the first fingerprint information is converted into the first fingerprint template by using a fuzzy extractor, and the first fingerprint template is used as the fingerprint attribute value of the user. The user attributes including the fingerprint attribute value, other attributes of the user (such as hobbies, date of birth, ID number, address code), and attribute-related proof materials are sent to the certificate authority through a secure channel. After receiving the user attributes, the certificate authority uses the index of each attribute name in the user attributes as the abscissa of the point, and the integer represented by the byte array of each attribute value in the user attributes as the ordinate of the point to construct the point set of the user attributes, and then constructs an n-degree polynomial passing through all the coordinate points in the point set to obtain the first preset polynomial, and generates a random n-degree polynomial to obtain the second preset polynomial. After obtaining the first preset polynomial and the second preset polynomial, the polynomial commitment value is determined based on the generator, the target value, the coefficients of the first preset polynomial, and the coefficients of the second preset polynomial, and the private key is used to sign the polynomial commitment value to obtain the signature value. The signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value are sent to the client.

[0142] Figure 3 A schematic diagram of proof and verification provided for this embodiment, sending an access authentication request to the server; the access authentication request includes a randomly generated string key; so that after receiving the access authentication request, the server determines the target upload method of the first fingerprint information, and uploads the random string key in the access authentication request, the target upload method, and the pre-determined authentication attribute policy required for access to the smart contract of the blockchain. When the client monitors that the smart contract contains a contract upload event including the random string, it obtains the target upload method and the authentication attribute policy, determines the corresponding target fingerprint acquisition and upload module based on the target upload method to obtain the second fingerprint information, uses the fuzzy extractor to convert the second fingerprint information into a second fingerprint template, determines the fingerprint acquisition commitment value using the second fingerprint template and the generator, and uploads the fingerprint acquisition commitment value and the random string to the smart contract.

[0143] Further, through the user terminal and based on the authentication attribute policy, select the set of attribute values to be hidden by the user terminal from the set of authentication attribute values that meet the authentication requirements, and then calculate the polynomials corresponding to the fingerprint attributes based on the fingerprint attribute values and the corresponding fingerprint attribute indices using the first preset polynomial and the second preset polynomial to obtain the first fingerprint attribute polynomial and the second fingerprint attribute polynomial, determine the witness of the fingerprint attribute in the polynomial commitment based on the coefficients corresponding to the first fingerprint attribute polynomial and the second fingerprint attribute polynomial respectively to obtain the fingerprint commitment voucher; calculate the polynomials corresponding to the policy attributes based on the policy attribute values and the corresponding policy attribute indices using the first preset polynomial and the second preset polynomial to obtain the first policy attribute polynomial and the second policy attribute polynomial, determine the witness of the policy attribute in the polynomial commitment based on the coefficients corresponding to the first policy attribute polynomial and the second policy attribute polynomial respectively to obtain the policy attribute voucher.

[0144] In this embodiment, after obtaining the fingerprint attribute credential and the policy attribute credential, a random commitment for proving the fingerprint attribute value is generated to obtain a fingerprint attribute commitment, and simulation parameters are calculated for each attribute value in the set of attribute values to be hidden to obtain simulation commitments. A policy attribute commitment corresponding to the policy attribute value is generated using a randomly selected number. Based on the polynomial commitment value, the fingerprint attribute commitment, the simulation commitments, the policy attribute commitment, the fingerprint encrypted value, and the attribute encrypted value, and using a hash algorithm, an overall challenge and a policy attribute challenge are determined, and missing responses, namely a fingerprint attribute response value and a policy attribute response value, are determined. Then, based on the fingerprint encrypted value, the attribute encrypted value, the fingerprint attribute commitment, the simulation commitments, the fingerprint attribute response value, the policy attribute response value, the overall challenge, the fingerprint collection commitment value, and the polynomial commitment value, an attribute proof package proof is constructed, and the attribute proof package, the signature value, and the random string are uploaded to the smart contract, so that the smart contract can parse and verify the signature value and the attribute proof package, and the server listens to the verification result to open corresponding access permissions based on the listening result.

[0145] As can be seen from the above, in this application, the certificate authority encodes user attributes into polynomials and generates commitment values, and then signs the commitment values. This signature mechanism ensures the reliability of the commitment source, prevents the commitment from being tampered with during transmission, and guarantees the authenticity and credibility of the starting point of the entire authentication process. In the proof stage, the client can hide some attribute values according to the authentication attribute policy, and through zero-knowledge proof technology, prove the fingerprint attribute and the policy attribute in the polynomial commitment without exposing the specific attribute values. This not only meets the authentication requirements but also maximally protects user privacy; moreover, it provides two ways to upload fingerprint information, on-site and remote, adapts to different scenarios, and can conveniently complete the authentication. In the verification stage, multi-dimensional verification is performed through the smart contract, which greatly improves the accuracy of the authentication result. In this way, the automated verification of the smart contract reduces manual intervention, greatly shortens the verification time, improves the authentication efficiency, enables users to quickly use relevant services, and enhances the overall user experience.

[0146] Correspondingly, as shown in Figure 4 This application also provides a privacy authentication device based on zero-knowledge proof, which is applied to the client and includes:

[0147] The polynomial commitment value signature module 11 is used to determine the fingerprint attribute value based on the first fingerprint information corresponding to the client, send the user attributes including the fingerprint attribute value to the certificate authority, so that the certificate authority constructs a first preset polynomial based on the user attributes, determines the polynomial commitment value by using the first preset polynomial and a randomly generated second preset polynomial, signs the polynomial commitment value, and sends the obtained signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value to the client;

[0148] The target upload method determination module 12 is used to send an access authentication request including a random string to the server, so that the server determines the target upload method of the first fingerprint information based on the access authentication request;

[0149] The fingerprint commitment value determination module 13 is used to, when it is monitored that there is a contract upload event including the random string in the smart contract, obtain the target upload method and the authentication attribute policy, obtain the second fingerprint information by using the target upload method, determine the corresponding fingerprint acquisition commitment value based on the second fingerprint information, and upload the fingerprint acquisition commitment value and the random string to the smart contract;

[0150] The overall challenge determination module 14 is used to respectively determine the fingerprint encryption value corresponding to the fingerprint attribute value and the attribute encryption value corresponding to the user policy attribute, determine the overall challenge based on the fingerprint encryption value, the attribute encryption value, and the polynomial commitment value, determine the attribute policy challenge by using the overall challenge, and then construct an attribute proof package based on the attribute policy challenge, the polynomial commitment value, and by using the zero-knowledge proof technology;

[0151] The verification result monitoring module 15 is used to upload the attribute proof package and the signature value to the smart contract, so that the smart contract parses and verifies the signature value and the attribute proof package, and monitors the verification result through the server to determine the access permission of the client.

[0152] As can be seen from the above, this application determines the user attributes based on the first fingerprint information of the client, and sends the user attributes to the certificate authority, so that the certificate authority determines the polynomial commitment value based on the user attributes, signs the polynomial commitment value, and sends it back to the client, ensuring that the user identity attributes are accurately collected and recorded, laying a foundation for subsequent authentication. Then, an access authentication request containing a random string is sent to the server to determine the fingerprint upload method. When the client monitors the contract upload event and obtains the target upload method and authentication attribute policy of the first fingerprint information, it collects the second fingerprint information and uploads the determined fingerprint collection commitment value to the smart contract. The random string increases the authentication security and prevents the access authentication request from being maliciously intercepted. Then, the overall challenge is determined through the fingerprint encryption value, attribute encryption value, and the polynomial commitment value, and an attribute proof package is constructed using zero-knowledge proof technology to protect user privacy. The smart contract parses and verifies the attribute proof package, and the server listens to the verification result to determine the access permission of the client. In this way, by automatically verifying the signature value and the attribute proof package through the smart contract, it effectively ensures that the attribute values required for authentication by the client are not leaked, avoids the large overhead brought by using complex zero-knowledge proofs based on circuit encoding, and improves the authentication efficiency and user experience.

[0153] In some specific embodiments, the privacy authentication device based on zero-knowledge proof may specifically further include:

[0154] A public string disclosure unit, configured to obtain a public string determined by the key generation center based on the generator in the group of bilinear mappings and the target numerical values of the preset integer set, disclose the public string, and then delete the target numerical values;

[0155] A private key sending unit, configured to obtain the public key and private key of the key generation center, disclose the public key, and then send the private key to the certificate authority through a secure channel.

[0156] In some specific embodiments, the polynomial commitment value signature module 11 may specifically include:

[0157] A first fingerprint information processing unit, configured to collect the first fingerprint information for the client, and process the first fingerprint information based on a fuzzy extractor to obtain a first fingerprint template;

[0158] A user attribute determination unit, configured to determine the fingerprint attribute value as the first fingerprint template, and then determine the user attributes based on the fingerprint attribute value and other attributes of the client;

[0159] A polynomial commitment value sending unit, configured to send the user attributes to a certificate authority, so that after receiving the user attributes, the certificate authority constructs a point set of the user attributes based on the indexes of the respective attribute names and the byte arrays of the respective attribute values in the user attributes, constructs a first preset polynomial passing through all the points in the point set, records the corresponding first preset polynomial coefficients, then randomly generates a second preset polynomial, records the corresponding second preset polynomial coefficients, determines a polynomial commitment value based on the generator, the target value, the first preset polynomial coefficients, and the second preset polynomial coefficients, then signs the polynomial commitment value, and sends the obtained signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value to the client.

[0160] In some specific embodiments, the fingerprint commitment value determination module 13 may specifically include:

[0161] A second fingerprint information acquisition unit, configured to acquire the target upload method when it is monitored that there is a contract upload event including the random string in the smart contract, and acquire second fingerprint information by using the target upload method;

[0162] A fingerprint acquisition commitment value determination unit, configured to convert the second fingerprint information into a second fingerprint template by using the fuzzy extractor, determine a fingerprint acquisition commitment value based on the second fingerprint template and the generator, and then upload the fingerprint acquisition commitment value and the random string to the smart contract;

[0163] An attribute value set determination unit, configured to determine a set of attribute values to be hidden based on an authentication attribute policy in the smart contract; the set of attribute values includes policy attribute values.

[0164] In some specific embodiments, the overall challenge determination module 14 may specifically include:

[0165] A fingerprint encryption value determination unit, configured to determine the position number of the first fingerprint information among all attributes by using the first fingerprint information corresponding to the fingerprint attribute value to obtain a fingerprint attribute index, and determine a fingerprint encryption value based on the fingerprint attribute value, the fingerprint attribute index, the second preset polynomial, and the generator;

[0166] A first fingerprint coefficient determination unit, configured to determine a first fingerprint attribute polynomial and the corresponding first fingerprint attribute polynomial coefficients based on the first preset polynomial, the fingerprint attribute index, and the fingerprint attribute value;

[0167] A second fingerprint coefficient determination unit, configured to determine a second fingerprint attribute polynomial coefficient corresponding to a second fingerprint attribute polynomial by using the second preset polynomial, the fingerprint attribute index, and the fingerprint attribute value;

[0168] A fingerprint commitment voucher determination unit, configured to determine a fingerprint commitment voucher based on the generator, the target value, the first fingerprint attribute polynomial coefficient, and the second fingerprint attribute polynomial coefficient;

[0169] An attribute encryption value determination unit, configured to obtain a user policy attribute input by a client and a corresponding policy attribute value, and determine an attribute encryption value based on a policy attribute index corresponding to the user policy attribute, the policy attribute value, the second preset polynomial, and the generator;

[0170] A first policy coefficient determination unit, configured to determine a first policy attribute value polynomial and a corresponding first policy attribute value polynomial coefficient based on the first preset polynomial, the policy attribute index, and the policy attribute value;

[0171] A second policy coefficient determination unit, configured to determine a second policy attribute value polynomial and a corresponding second policy attribute value polynomial coefficient by using the second preset polynomial, the policy attribute index, and the policy attribute value;

[0172] An attribute commitment voucher determination unit, configured to determine an attribute commitment voucher based on the generator, the target value, the first policy attribute value polynomial coefficient, and the second policy attribute value polynomial coefficient.

[0173] In some specific embodiments, the overall challenge determination module 14 may specifically include:

[0174] A simulated commitment determination unit, configured to determine a fingerprint attribute commitment based on a first random number and the generator, and determine a simulated commitment by using a second random number, a third random number, and the attribute encryption value;

[0175] An overall challenge determination unit, configured to determine a policy attribute commitment by using the generator and a fourth random number, and determine an overall challenge based on the polynomial commitment value, the fingerprint attribute commitment, the simulated commitment, the policy attribute commitment, the fingerprint encryption value, the attribute encryption value, and by using a hash algorithm;

[0176] A fingerprint response value determination unit, configured to determine a policy attribute challenge based on the overall challenge, and determine a fingerprint attribute response value by using the first random number, the second random number, the overall challenge, the second preset polynomial, and the fingerprint attribute index;

[0177] A policy response value determination unit, configured to determine a policy attribute response value by using the fourth random number, the policy attribute challenge, the policy attribute index, and the second polynomial;

[0178] A proof package construction unit, configured to construct an attribute proof package based on the fingerprint encryption value, the attribute encryption value, the fingerprint attribute commitment, the simulation commitment, the fingerprint attribute response value, the policy attribute response value, the overall challenge, the fingerprint acquisition commitment value, and the polynomial commitment value.

[0179] In some specific embodiments, the verification result monitoring module 15 may specifically include:

[0180] A proof package parsing unit, configured to upload the attribute proof package and the signature value to the smart contract, so that the smart contract parses the signature value and the attribute proof package to obtain the fingerprint encryption value, the attribute encryption value, the fingerprint attribute commitment, the simulation commitment, the fingerprint attribute response value, the policy attribute response value, the overall challenge, the fingerprint acquisition commitment value, and the polynomial commitment value, and then uses the public key to verify the validity of the signature value. If the verification passes, it is determined whether the fingerprint commitment certificate and the attribute commitment certificate are in the polynomial commitment value. If so, a fingerprint attribute matching equation is determined based on the generator, the fingerprint attribute response value, the fingerprint attribute commitment, the fingerprint acquisition commitment value, and the overall challenge. If the fingerprint attribute matching equation holds, a policy attribute verification equation is determined based on the simulation commitment, the generator, the second random number, the attribute encryption value, the attribute value set, and the overall challenge. If the policy attribute verification equation holds, it is determined whether the overall challenge is equal to the sum of the corresponding challenge values. If they are equal, it indicates that the verification result is verification success. When the server monitors the verification result of verification success, it opens the corresponding access permission to the client.

[0181] Furthermore, an embodiment of the present application also discloses an electronic device, Figure 5 which is a structural diagram of an electronic device 20 shown according to an exemplary embodiment. The content in the figure should not be considered as any limitation to the scope of use of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. Among them, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the zero-knowledge proof-based privacy authentication method disclosed in any of the foregoing embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0182] In this embodiment, the power supply 23 is used to provide operating voltages for the various hardware devices on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and no specific limitation is imposed thereon herein; the input / output interface 25 is used to obtain external input data or output data to the outside, and its specific interface type can be selected according to specific application requirements, and no specific limitation is imposed herein.

[0183] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, a random access memory, a magnetic disk, an optical disc, etc., and the resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be transient storage or permanent storage.

[0184] Among them, the operating system 221 is used to manage and control the various hardware devices and the computer program 222 on the electronic device 20, and it can be Windows Server, Netware, Unix, Linux, etc. The computer program 222, in addition to including a computer program capable of implementing the zero-knowledge proof-based privacy authentication method executed by the electronic device 20 disclosed in any of the foregoing embodiments, may further include a computer program capable of performing other specific tasks.

[0185] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the zero-knowledge proof-based privacy authentication method disclosed above is implemented. For the specific steps of this method, reference can be made to the corresponding content disclosed in the foregoing embodiments, and details will not be repeated herein.

[0186] In this specification, the various embodiments are described in a progressive manner, and the key point of each embodiment is to illustrate the differences from other embodiments. The same or similar parts among the various embodiments can be referred to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and reference can be made to the description in the method part for related parts.

[0187] Those skilled in the art can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been generally described according to their functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0188] The steps of the methods or algorithms described in connection with the embodiments disclosed herein may be implemented directly in hardware, in software modules executed by a processor, or in a combination thereof. The software modules may be located in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0189] Finally, it should also be noted that in this document, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variation thereof is intended to cover non-exclusive inclusion, such that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not expressly listed, or elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or device comprising the element.

[0190] The technical solutions provided in this application have been introduced in detail above. Specific examples are used herein to illustrate the principles and implementation manners of this application. The description of the above embodiments is only used to help understand the method and its core idea of this application; at the same time, for those of ordinary skill in the art, according to the idea of this application, there will be changes in the specific implementation manners and application scopes. In summary, the content of this specification should not be construed as a limitation to this application.

Claims

1. A privacy authentication method based on zero-knowledge proof, characterized in that, Applied to the client side, including: Determine a fingerprint attribute value based on the first fingerprint information corresponding to the user side, and send the user attributes including the fingerprint attribute value to the certificate authority, so that the certificate authority constructs a first preset polynomial based on the user attributes, and uses the first preset polynomial and a randomly generated second preset polynomial to determine a polynomial commitment value, sign the polynomial commitment value, and send the obtained signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value to the client side; Send an access authentication request including a random string to the server side, so that the server side determines the target upload method of the first fingerprint information based on the access authentication request; When it is monitored that there is a contract upload event including the random string in the smart contract, obtain the target upload method and the authentication attribute policy, use the target upload method to obtain the second fingerprint information, determine the corresponding fingerprint collection commitment value based on the second fingerprint information, and upload the fingerprint collection commitment value and the random string to the smart contract; Respectively determine a fingerprint encryption value corresponding to the fingerprint attribute value and an attribute encryption value corresponding to the user policy attribute, determine an overall challenge based on the fingerprint encryption value, the attribute encryption value, and the polynomial commitment value, use the overall challenge to determine an attribute policy challenge, and then construct an attribute proof package based on the attribute policy challenge, the polynomial commitment value, and using zero-knowledge proof technology; Upload the attribute proof package and the signature value to the smart contract, so that the smart contract parses and verifies the signature value and the attribute proof package, and listens to the verification result through the server side to determine the access permission of the user side.

2. The privacy authentication method based on zero-knowledge proof according to claim 1, wherein Before determining the fingerprint attribute value based on the first fingerprint information corresponding to the user side and sending the user attributes including the fingerprint attribute value to the certificate authority, it further includes: Obtain a public string determined by the key generation center based on the generator in the group of bilinear maps and the target numerical values in the preset integer set, publicly disclose the public string, and then delete the target numerical values; Obtain the public key and private key of the key generation center, publicly disclose the public key, and then send the private key to the certificate authority through a secure channel.

3. The privacy authentication method based on zero-knowledge proof according to claim 2, characterized in that, Determine the fingerprint attribute value based on the first fingerprint information corresponding to the user side, and send the user attributes including the fingerprint attribute value to the certificate authority, so that the certificate authority constructs a first preset polynomial based on the user attributes, and uses the first preset polynomial and a randomly generated second preset polynomial to determine a polynomial commitment value, sign the polynomial commitment value, and send the obtained signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value to the client side, including: Collect the first fingerprint information for the user side, and process the first fingerprint information based on the fuzzy extractor to obtain a first fingerprint template; Determine the first fingerprint template as the fingerprint attribute value, and then determine the user attributes based on the fingerprint attribute value and other attributes of the client; Send the user attributes to the certificate authority. After receiving the user attributes, the certificate authority constructs a point set of the user attributes based on the indexes of each attribute name and the byte arrays of each attribute value in the user attributes, constructs a first preset polynomial passing through all points in the point set, and records the corresponding first preset polynomial coefficients. Then, randomly generate a second preset polynomial and record the corresponding second preset polynomial coefficients. Determine the polynomial commitment value based on the generator, the target value, the first preset polynomial coefficients, and the second preset polynomial coefficients. Then, sign the polynomial commitment value, and send the obtained signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value to the client.

4. The privacy authentication method based on zero-knowledge proof according to claim 2, characterized in that, When it is monitored that there is a contract upload event including the random string in the smart contract, obtain the target upload method and the authentication attribute policy, and use the target upload method to obtain the second fingerprint information. Based on the second fingerprint information, determine the corresponding fingerprint collection commitment value, and upload the fingerprint collection commitment value and the random string to the smart contract, including: When it is monitored that there is a contract upload event including the random string in the smart contract, obtain the target upload method, and use the target upload method to obtain the second fingerprint information; Use the fuzzy extractor to convert the second fingerprint information into a second fingerprint template, and determine the fingerprint collection commitment value based on the second fingerprint template and the generator. Then, upload the fingerprint collection commitment value and the random string to the smart contract; Determine the set of attribute values to be hidden based on the authentication attribute policy in the smart contract; the set of attribute values includes policy attribute values.

5. The privacy authentication method based on zero-knowledge proof according to claim 4, wherein, Respectively determine the fingerprint encryption value corresponding to the fingerprint attribute value and the attribute encryption value corresponding to the user policy attribute, including: Use the first fingerprint information corresponding to the fingerprint attribute value to determine the position number of the first fingerprint information among all attributes to obtain the fingerprint attribute index, and determine the fingerprint encryption value based on the fingerprint attribute value, the fingerprint attribute index, the second preset polynomial, and the generator; Determine the first fingerprint attribute polynomial and the corresponding first fingerprint attribute polynomial coefficients based on the first preset polynomial, the fingerprint attribute index, and the fingerprint attribute value; Use the second preset polynomial, the fingerprint attribute index, and the fingerprint attribute value to determine the second fingerprint attribute polynomial coefficients corresponding to the second fingerprint attribute polynomial; Determine the fingerprint commitment certificate based on the generator, the target value, the first fingerprint attribute polynomial coefficients, and the second fingerprint attribute polynomial coefficients; Obtain the user policy attribute and the corresponding policy attribute value input by the client, and determine the attribute encryption value based on the policy attribute index corresponding to the user policy attribute, the policy attribute value, the second preset polynomial, and the generator; Determine the first policy attribute value polynomial and its corresponding first policy attribute value polynomial coefficients based on the first preset polynomial, the policy attribute index, and the policy attribute value; Determine the second policy attribute value polynomial and its corresponding second policy attribute value polynomial coefficients using the second preset polynomial, the policy attribute index, and the policy attribute value; Determine the attribute commitment certificate based on the generator, the target value, the first policy attribute value polynomial coefficients, and the second policy attribute value polynomial coefficients.

6. The privacy authentication method based on zero-knowledge proof according to claim 5, wherein, Determine the overall challenge based on the fingerprint encryption value, the attribute encryption value, and the polynomial commitment value, and use the overall challenge to determine the attribute policy challenge. Then, construct an attribute proof package based on the attribute policy challenge, the polynomial commitment value, and using zero-knowledge proof technology, including: Determine the fingerprint attribute commitment based on the first random number and the generator, and determine the simulation commitment using the second random number, the third random number, and the attribute encryption value; Determine the policy attribute commitment using the generator and the fourth random number, and determine the overall challenge based on the polynomial commitment value, the fingerprint attribute commitment, the simulation commitment, the policy attribute commitment, the fingerprint encryption value, the attribute encryption value, and using the hash algorithm; Determine the policy attribute challenge based on the overall challenge, and determine the fingerprint attribute response value using the first random number, the second random number, the overall challenge, the second preset polynomial, and the fingerprint attribute index; Determine the policy attribute response value using the fourth random number, the policy attribute challenge, the policy attribute index, and the second polynomial; Construct an attribute proof package based on the fingerprint encryption value, the attribute encryption value, the fingerprint attribute commitment, the simulation commitment, the fingerprint attribute response value, the policy attribute response value, the overall challenge, the fingerprint collection commitment value, and the polynomial commitment value.

7. The privacy authentication method based on zero-knowledge proof according to claim 6, characterized in that Upload the attribute proof package and the signature value to the smart contract so that the smart contract can parse and verify the signature value and the attribute proof package, and listen for the verification result through the server to determine the access permission of the client, including: Upload the attribute proof package and the signature value to the smart contract, so that the smart contract parses the signature value and the attribute proof package to obtain the fingerprint encryption value, the attribute encryption value, the fingerprint attribute commitment, the simulation commitment, the fingerprint attribute response value, the policy attribute response value, the overall challenge, the fingerprint collection commitment value, and the polynomial commitment value. Then, use the public key to verify the validity of the signature value. If the verification passes, determine whether the fingerprint commitment certificate and the attribute commitment certificate are in the polynomial commitment value. If so, based on the generator, the fingerprint attribute response value, the fingerprint attribute commitment, the fingerprint collection commitment value, and the overall challenge, determine the fingerprint attribute matching equation. If the fingerprint attribute matching equation holds, based on the simulation commitment, the generator, the second random number, the attribute encryption value, the set of attribute values, and the overall challenge, determine the policy attribute verification equation. If the policy attribute verification equation holds, determine whether the overall challenge is equal to the sum of the corresponding challenge values. If they are equal, it indicates that the verification result is successful. When the server monitors a successful verification result, open the corresponding access permission to the client.

8. A privacy authentication device based on zero-knowledge proof, characterized in that, Applied to the client, it includes: A polynomial commitment value signature module, which is used to determine the fingerprint attribute value based on the first fingerprint information corresponding to the client, send the user attributes including the fingerprint attribute value to the certificate authority, so that the certificate authority constructs a first preset polynomial based on the user attributes, determines the polynomial commitment value using the first preset polynomial and a randomly generated second preset polynomial, signs the polynomial commitment value, and sends the obtained signature value, the first preset polynomial, the second preset polynomial, and the polynomial commitment value to the client; A target upload method determination module, which is used to send an access authentication request including a random string to the server, so that the server determines the target upload method of the first fingerprint information based on the access authentication request; A fingerprint commitment value determination module, which is used to obtain the target upload method and the authentication attribute policy when monitoring a contract upload event including the random string in the smart contract, obtain the second fingerprint information using the target upload method, determine the corresponding fingerprint collection commitment value based on the second fingerprint information, and upload the fingerprint collection commitment value and the random string to the smart contract; An overall challenge determination module, which is used to respectively determine the fingerprint encryption value corresponding to the fingerprint attribute value and the attribute encryption value corresponding to the user policy attribute, determine the overall challenge based on the fingerprint encryption value, the attribute encryption value, and the polynomial commitment value, determine the attribute policy challenge using the overall challenge, and then construct an attribute proof package based on the attribute policy challenge, the polynomial commitment value, and using the zero-knowledge proof technology; The verification result monitoring module is used to upload the attribute proof package and the signature value to the smart contract, so that the smart contract can parse and verify the signature value and the attribute proof package, and monitor the verification result through the server to determine the access permission of the client.

9. An electronic device, characterized in that, It includes: A memory for storing computer programs; A processor for executing the computer program to implement the zero-knowledge proof-based privacy authentication method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, For storing computer programs, wherein the computer program, when executed by the processor, implements the zero-knowledge proof-based privacy authentication method according to any one of claims 1 to 7.

Images