Registration request processing method, user identity information management method and device

Abstract

The present invention discloses a registration request processing method, a user identity information management method and a device, wherein the registration request processing method comprises: obtaining a request for registering as a computing node in a secure multi-party computing (SMPC) system sent by a user, wherein the request for registering as a computing node in the SMPC system comprises a first anonymous certificate and registration information signed by a signature private key, wherein the first anonymous certificate comprises a signature public key; verifying the signature private key by using the signature public key; sending a request to query a first real-name certificate corresponding to the first anonymous certificate to an ACA according to the verification result and the need to confirm whether the user has registered repeatedly; receiving a first real-name certificate corresponding to the first anonymous certificate sent by the ACA, wherein the first real-name certificate comprises a first registration public key; and when confirming that the user has not registered repeatedly according to the first registration public key, registering the user as a computing node in the SMPC system according to the registration information. By implementing the present invention, the anonymity of computing node identity can be achieved.

Description

Technical Field

[0001] The present application relates to the field of secure multi-party computing technology, and in particular to a registration request processing method, a user identity information management method and a device. Background Art

[0002] In the current Secure Multi-Party Computation (SMPC) framework, when a user registers as a computing node in the SPMC system, a registration request including the user's real identity information will be sent to the coordinator in the SMPC system. As a result, the coordinator in the SMPC system will have the real identity information of all computing nodes. Therefore, there is a problem of coordinator centralization in the current secure multi-party computing framework. Summary of the invention

[0003] The embodiments of the present invention provide a registration request processing method, a user identity information management method and a device to solve the problem of coordinator centralization in the current secure multi-party computing framework.

[0004] In order to solve the above problems, in the first aspect, an embodiment of the present invention provides a registration request processing method, which is used for the coordinator side, and the coordinator is connected to the ACA, including: obtaining a registration request sent by the user as a computing node in the SMPC system, the registration request as a computing node in the SMPC system includes a first anonymous certificate and registration information signed by a signature private key, and the first anonymous certificate includes a signature public key; using the signature public key to verify the signature private key; sending a request to query the first real-name certificate corresponding to the first anonymous certificate to the ACA based on the verification result and the need to confirm whether the user has registered repeatedly; receiving the first real-name certificate corresponding to the first anonymous certificate sent by the ACA, the first real-name certificate including a first registration public key; when confirming that the user has not registered repeatedly based on the first registration public key, registering the user as a computing node in the SMPC system based on the registration information.

[0005] Optionally, a request for querying the first real-name certificate corresponding to the first anonymous certificate is sent to the ACA based on the verification result and the need to confirm whether the user has registered repeatedly, including: when the verification result is successful and it is necessary to confirm whether the user has registered repeatedly, a request for querying the first real-name certificate corresponding to the first anonymous certificate is sent to the ACA; when the verification result is successful and it is not necessary to confirm whether the user has registered repeatedly, registering the user as a computing node in the SMPC system based on the registration information.

[0006] Optionally, the first anonymous certificate includes an extension item, and the extension item includes derived information encrypted by a derived key; after sending a request to the ACA to query the first real-name certificate corresponding to the first anonymous certificate, when confirming that the user has not registered repeatedly according to the first registration public key, before registering the user as a computing node in the SMPC system according to the registration information, the registration request processing method also includes: receiving the derived key corresponding to the first anonymous certificate sent by the ACA; using the derived key to decrypt the encrypted derived information; using the decrypted derived information and the signature public key to calculate the second registration public key; and when confirming that the first registration public key and the second registration public key are the same, confirming that the ACA is trustworthy.

[0007] Optionally, the registration request processing method further includes: confirming that the first registration public key and the second registration public key are different, and when confirming based on the second registration public key that the user has not registered repeatedly, registering the user as a computing node in the SMPC system based on the registration information.

[0008] Optionally, confirming that the user has not registered repeatedly based on the first registration public key / second registration public key includes: obtaining a registration list, the registration list includes multiple registered second anonymous certificates; sending a request to ACA to query the second real-name certificates corresponding to the multiple second anonymous certificates; receiving the second real-name certificates corresponding to the multiple second anonymous certificates sent by ACA, the second real-name certificate includes a third registration public key; and when confirming that the first registration public key / second registration public key is different from the third registration public key, confirming that the user has not registered repeatedly.

[0009] In the second aspect, an embodiment of the present invention provides a user identity information management method for ACA, including: receiving a request sent by a coordinator to query a first real-name certificate corresponding to a first anonymous certificate; querying the first real-name certificate corresponding to the first anonymous certificate from a relationship list; sending the first real-name certificate to the coordinator, the first real-name certificate including a first registered public key.

[0010] Optionally, before receiving the request sent by the coordinator to query the first real-name certificate corresponding to the first anonymous certificate, the user identity information management method also includes: obtaining the request for applying for the first anonymous certificate sent by the user, generating a random number in response to the request for applying for the first anonymous certificate, the request for applying for the first anonymous certificate includes the first real-name certificate, and the first real-name certificate includes the first registered public key; using the first registered public key to generate a derived key, using the derived key and the random number to generate derived information, and generating a signature public key based on the derived information and the first registered public key; using the derived key to encrypt the derived information to obtain an extension item; generating the user's first anonymous certificate based on the signature public key and the extension item; sending the first anonymous certificate and the derived key to the user, so that the user calculates the signature private key based on the first registered private key corresponding to the first registered public key, the derived key and the encrypted derived information.

[0011] Optionally, after receiving the request sent by the coordinator to query the first real-name certificate corresponding to the first anonymous certificate, the user identity information management method further includes: querying the derived key corresponding to the first anonymous certificate from the relationship list; and sending the derived key corresponding to the first anonymous certificate to the coordinator.

[0012] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes a registration request processing method such as the first aspect or any embodiment of the first aspect, or a user identity information management method such as the second aspect or any embodiment of the second aspect.

[0013] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute a registration request processing method such as the first aspect or any embodiment of the first aspect, or a user identity information management method such as the second aspect or any embodiment of the second aspect.

[0014] The registration request processing method, user identity information management method and device provided by the embodiment of the present invention obtain a registration request for a computing node in a secure multi-party computing (SMPC) system sent by a user, wherein the registration request for a computing node in the SMPC system includes a first anonymous certificate and registration information signed by a signature private key, wherein the first anonymous certificate includes a signature public key; the signature private key is verified by using the signature public key; a request for querying a first real-name certificate corresponding to the first anonymous certificate is sent to the ACA based on the verification result and the need to confirm whether the user has registered repeatedly; the first real-name certificate corresponding to the first anonymous certificate sent by the ACA is received, wherein the first real-name certificate includes a first registration public key; and confirmation that the user has not registered repeatedly based on the first registration public key is confirmed. When registering repeatedly, the user is registered as a computing node in the SMPC system according to the registration information; therefore, when the user sends a request to register as a computing node in the SMPC system to the coordinator, the user may not carry the user's real identity information, but carry anonymous identity information derived from the real identity information, so that the user's real identity information will not be directly exposed to the coordinator, that is, the coordinator will not have the real identity information of all computing nodes, and the computing node identity anonymity is realized, and the ACA can see the real identities of all computing nodes, but not the transaction records, and the coordinator can see the transaction records, but not the identity information of all computing nodes, which not only protects privacy but also realizes decentralized supervision between ACA and coordinator. In addition, if the coordinator needs to confirm whether the user has registered repeatedly, it can query the anonymous user's real identity information from ACA and confirm whether the user has registered repeatedly based on the real identity information, reducing the probability of malicious nodes in the SMPC system.

[0015] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flowchart of a registration request processing method according to an embodiment of the present invention;

[0017] Figure 2 This is a flow chart of the interaction between the coordinator, ACA and user in an embodiment of the present invention;

[0018] Figure 3 A schematic diagram of a user identity information management method according to an embodiment of the present invention;

[0019] Figure 4 The figure is a schematic diagram of the hardware structure of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0021] The embodiment of the present invention provides a registration request processing method for a coordinator, wherein the coordinator is connected to the ACA for communication, such as Figure 1 As shown, the registration request processing method includes:

[0022] S101. Obtain a request sent by a user to register as a computing node in the SMPC system, where the request to register as a computing node in the SMPC system includes a first anonymous certificate and registration information signed with a signature private key, where the first anonymous certificate includes a signature public key.

[0023] Specifically, the interaction flow chart of the coordinator, ACA and user involved in the embodiment of the present invention is as follows: Figure 2 As shown, the specific interaction steps are as follows:

[0024] When a user needs to register as a computing node in the SMPC system, he first needs to generate a first registration private key, and then apply for a first real-name certificate from a real-name certificate issuing authority (RCA). After receiving the user's request for the first real-name certificate, the RCA generates a first registration public key based on the first registration private key, generates a first real-name certificate based on the first registration public key, and sends the first real-name certificate to the user.

[0025] The user applies for the first anonymous certificate from ACA based on the first real-name certificate applied for. ACA will obtain the first anonymous certificate application request sent by the user, and generate a random number (first anonymous certificate serial number) in response to the first anonymous certificate application request. The first anonymous certificate application request includes the first real-name certificate, and the first real-name certificate includes the first registered public key; the first registered public key is used to generate a derived key, and the derived key and the random number are used to generate derived information, and the signature public key is generated according to the derived information and the first registered public key; the derived information is encrypted with the derived key to obtain an extension; the user's first anonymous certificate is generated according to the signature public key and the extension; and the first anonymous certificate and the derived key are sent to the user. ACA will also generate the corresponding relationship between the first real-name certificate, the first anonymous certificate and the derived key to obtain a relationship list.

[0026] After receiving the first anonymous certificate and derived key transmitted by ACA, the user uses the derived key to decrypt the encrypted derived information in the extension item of the anonymous certificate to obtain the decrypted derived information, and then uses the decrypted derived information and the first registered private key to generate a signature private key.

[0027] It should be noted that the generation of the first anonymous certificate depends on the key derivation algorithm based on the certificate public key system, and the elliptic curve public key cryptography and one-way hash function are used in the generation process of the key derivation algorithm. The generation of the signature public key and signature private key of the first anonymous certificate depends on the superposition characteristics of the elliptic curve public and private keys, that is, the new public and private keys obtained by adding multiple corresponding public and private keys still have a corresponding relationship. When the user applies for the first anonymous certificate from ACA based on the first real-name certificate applied for, he can apply for one first anonymous certificate or multiple first anonymous certificates. When applying for multiple first anonymous certificates, ACA will generate multiple corresponding random numbers, so that the derived information, signature public key and signature private key corresponding to each first anonymous certificate are different. In the transaction process, if the user chooses to use the first registered private key of the first real-name certificate for signing, then the transaction at this time is real-name; if the user needs anonymous transactions, for different transactions, different signature private keys corresponding to the first anonymous certificates can be selected for signing, which can prevent the association between any two transactions and realize the anonymity of the transaction.

[0028] Then the user sends a request to register as a computing node in the SMPC system to the coordinator, the request to register as a computing node in the SMPC system includes the first anonymous certificate and registration information signed by the signature private key. The coordinator can obtain the request to register as a computing node in the SMPC system sent by the user.

[0029] S102. Use the signature public key to verify the signature private key; specifically, since the signature public key corresponds to the signature private key one by one, the signature public key can be used to verify the signature private key, which can prevent the user from forging the signature private key, and the coordinator cannot obtain the real identity information of the signer from the signature public key. During verification, two verification results can be obtained, one is successful verification, and the other is unsuccessful verification.

[0030] S103. Send a request to ACA to query the first real-name certificate corresponding to the first anonymous certificate based on the verification result and the need to confirm whether the user has registered repeatedly; specifically, when the user applies to register as a computing node in the SMPC system, the registration information is signed with a signature private key, and the first anonymous certificate is sent to the user, and each user can apply for multiple anonymous certificates and obtain multiple signature private keys. Therefore, it is impossible to confirm whether the user has registered repeatedly through the signature public key. For the same user, different first anonymous certificates applied for all correspond to the same first real-name certificate, because it can be determined whether the user has registered repeatedly based on the user's first real-name certificate. Therefore, in order to prevent users from repeatedly registering as computing nodes in the SMPC system, that is, to reduce the probability of malicious nodes in the SMPC system, a request to query the first real-name certificate corresponding to the first anonymous certificate can be sent to ACA when the verification result is that the verification is passed.

[0031] S104. Receive the first real-name certificate corresponding to the first anonymous certificate sent by ACA, where the first real-name certificate includes the first registered public key; specifically, ACA receives a request to query the first real-name certificate corresponding to the first anonymous certificate, and sends the first real-name certificate corresponding to the first anonymous certificate to the coordinator.

[0032] S105. When it is confirmed that the user has not registered repeatedly according to the first registered public key, the user is registered as a computing node in the SMPC system according to the registration information. Specifically, if the first registered public key is different from the registered public key of other registered computing nodes, it can be confirmed that the user has not registered repeatedly, so that the user can be registered as a computing node in the SMPC system according to the registration information. After the user is registered as a computing node in the SMPC system, when conducting a transaction, the transaction can be signed based on the signature public key corresponding to the anonymous certificate to achieve the anonymity of the transaction, and different signature public keys can be used to sign the transaction for different transactions to achieve the non-correlation of the transaction.

[0033] The registration request processing method provided by the embodiment of the present invention obtains a registration request for a computing node in a secure multi-party computing (SMPC) system sent by a user, wherein the registration request for a computing node in the SMPC system includes a first anonymous certificate and registration information signed by a signature private key, wherein the first anonymous certificate includes a signature public key; the signature private key is verified by using the signature public key; a request for querying a first real-name certificate corresponding to the first anonymous certificate is sent to the ACA according to the verification result and the need to confirm whether the user has registered repeatedly; the first real-name certificate corresponding to the first anonymous certificate sent by the ACA is received, wherein the first real-name certificate includes a first registration public key; when it is confirmed according to the first registration public key that the user has not registered repeatedly, the root The user is registered as a computing node in the SMPC system according to the registration information; therefore, when the user sends a request to the coordinator to register as a computing node in the SMPC system, the user may not carry the user's real identity information, but carry anonymous identity information derived from the real identity information, so that the user's real identity information will not be directly exposed to the coordinator, that is, the coordinator will not have the real identity information of all computing nodes, and the computing node identity anonymity is realized, and the ACA can see the real identities of all computing nodes, but not the transaction records, and the coordinator can see the transaction records, but not the identity information of all computing nodes, which not only protects privacy but also realizes decentralized supervision between ACA and coordinator. In addition, if the coordinator needs to confirm whether the user has registered repeatedly, it can query the anonymous user's real identity information from ACA, and confirm whether the user has registered repeatedly based on the real identity information, reducing the probability of malicious nodes in the SMPC system.

[0034] In an optional embodiment, step S103, based on the verification result and the need to confirm whether the user has registered repeatedly, sends a request to the ACA to query the first real-name certificate corresponding to the first anonymous certificate, including: when the verification result is successful and it is necessary to confirm whether the user has registered repeatedly, sending a request to the ACA to query the first real-name certificate corresponding to the first anonymous certificate; when the verification result is successful and it is not necessary to confirm whether the user has registered repeatedly, registering the user as a computing node in the SMPC system according to the registration information.

[0035] Specifically, if the verification result is unsuccessful, it means that the signature public key does not match the signature private key, and the user has forged the signature private key, then the user's request to register as a computing node in the SMPC system can be ignored. If the verification result is successful, it means that the signature public key matches the signature private key, and if it is not necessary to confirm whether the user has registered repeatedly at this time, the user can be directly registered as a computing node in the SMPC system based on the registration information; and if it is necessary to confirm whether the user has registered repeatedly at this time, a request to query the first real-name certificate corresponding to the first anonymous certificate can be sent to the ACA.

[0036] In an embodiment of the present invention, when the verification result is successful and it is necessary to confirm whether the user has registered repeatedly, a request for querying the first real-name certificate corresponding to the first anonymous certificate is sent to ACA, so that the coordinator can query the real identity information of the anonymous user from ACA according to actual needs, and confirm whether the user has registered repeatedly based on the real identity information, thereby reducing the probability of malicious nodes in the SMPC system. When the verification result is successful and it is not necessary to confirm whether the user has registered repeatedly, the user is registered as a computing node in the SMPC system based on the registration information, so that the real identity information of the user will not be directly exposed to the coordinator, that is, the coordinator will not have the real identity information of all computing nodes, and the identity anonymity of the computing nodes is realized, and the real identities of all computing nodes are visible to ACA, but not to transaction records, and the coordinator is visible to transaction records, but not to the identity information of all computing nodes, which protects privacy and realizes decentralized supervision between ACA and coordinator.

[0037] In an optional embodiment, the first anonymous certificate includes an extension item, and the extension item includes derived information encrypted by a derived key; after sending a request to the ACA to query the first real-name certificate corresponding to the first anonymous certificate, when confirming that the user has not registered repeatedly according to the first registration public key, before registering the user as a computing node in the SMPC system according to the registration information, the registration request processing method also includes: receiving the derived key corresponding to the first anonymous certificate sent by the ACA; using the derived key to decrypt the encrypted derived information; using the decrypted derived information and the signature public key to calculate the second registration public key; and when confirming that the first registration public key and the second registration public key are the same, confirming that the ACA is trustworthy.

[0038] Specifically, in the embodiment of the present invention, since the first anonymous certificate includes an extension item, and the extension item includes the derived information encrypted by the derived key, the coordinator can use the decrypted derived information and the signature public key to calculate the second registered public key. The derived key can be obtained from the ACA. The coordinator calculates the second registered public key RegisterPub_Key as follows:

[0039] RegisterPub_Key=ACertPub_Key-DerivationID*G; ACertPub_Key is the signature public key, DerivationID is the derived information, and G is a constant.

[0040] If the calculated second registration public key is the same as the first registration public key, it means that the first real-name certificate returned from ACA is correct and ACA is credible. If the calculated second registration public key is different from the first registration public key, it means that the first real-name certificate returned from ACA is incorrect, ACA has falsified the relationship list, and ACA is not credible.

[0041] In the embodiment of the present invention, by calculating the second registration public key and comparing the second registration public key with the first registration public key, it is possible to prevent the ACA from forging the first real-name certificate and thus failing to obtain the user's real identity information.

[0042] In an optional embodiment, the registration request processing method further includes: confirming that the first registration public key and the second registration public key are different, and when confirming based on the second registration public key that the user has not registered repeatedly, registering the user as a computing node in the SMPC system based on the registration information.

[0043] Specifically, if the calculated second registration public key is different from the first registration public key, since the calculated second registration public key is the user's real identity information, the second registration public key can be used to confirm whether the user has registered repeatedly. When it is confirmed that the user has not registered repeatedly according to the second registration public key, the user can be registered as a computing node in the SMPC system according to the registration information, thereby still being able to determine the user's real identity and register the user as a computing node in the SMPC system.

[0044] In an optional embodiment, since the coordinator does not have the real identity information of all computing nodes, when executing the step of confirming that the user has not registered repeatedly based on the first registration public key / second registration public key, the following steps may be specifically included: obtaining a registration list, the registration list includes multiple registered second anonymous certificates; sending a request to ACA to query the second real-name certificates corresponding to the multiple second anonymous certificates; receiving the second real-name certificates corresponding to the multiple second anonymous certificates sent by ACA, the second real-name certificate includes the third registration public key; and when confirming that the first registration public key / second registration public key is different from the third registration public key, confirming that the user has not registered repeatedly.

[0045] In the embodiment of the present invention, since ACA stores the relationship list of all computing nodes, the second real-name certificate can be queried from ACA through the second anonymous certificate. By comparing the first registered public key / second registered public key with the third registered public key in the second real-name certificate, it can be determined whether the user has registered repeatedly, thereby simply, quickly and accurately determining whether the user has registered repeatedly.

[0046] The embodiment of the present invention also provides a user identity information management method for ACA, such as Figure 3 As shown, the user identity information management method includes:

[0047] S201. Receive a request from the coordinator to query the first real-name certificate corresponding to the first anonymous certificate; specifically, in order to determine the real identity information of the user, the coordinator may send a request to the ACA to query the first real-name certificate corresponding to the first anonymous certificate.

[0048] S202. Query the first real-name certificate corresponding to the first anonymous certificate from the relationship list; specifically, after generating the first anonymous certificate, the ACA will also generate a relationship list of the first real-name certificate, the first anonymous certificate and the derived key. Therefore, the first real-name certificate can be queried based on the first anonymous certificate.

[0049] S203. Send the first real-name certificate to the coordinator, the first real-name certificate including the first registered public key. Specifically, send the first real-name certificate to the coordinator so that the coordinator can obtain the real identity information of the user.

[0050] The user identity information management method provided by the embodiment of the present invention can carry anonymous identity information derived from the real identity information instead of the real identity information of the user when the user sends a request to the coordinator to register as a computing node in the SMPC system, so that the real identity information of the user will not be directly exposed to the coordinator, that is, the coordinator will not have the real identity information of all computing nodes, and the identity anonymity of the computing nodes is realized, and the ACA can see the real identities of all computing nodes but not the transaction records, and the coordinator can see the transaction records but not the identity information of all computing nodes, which not only protects privacy but also realizes decentralized supervision between the ACA and the coordinator. In addition, if the coordinator needs to confirm whether the user has registered repeatedly, the real identity information of the anonymous user can be queried from the ACA, and the real identity information of the user can be confirmed based on the real identity information, thereby reducing the probability of malicious nodes in the SMPC system.

[0051] In an optional embodiment, in step S201, before receiving the request sent by the coordinator to query the first real-name certificate corresponding to the first anonymous certificate, the user identity information management method also includes: obtaining the request for applying for the first anonymous certificate sent by the user, generating a random number in response to the request for applying for the first anonymous certificate, the request for applying for the first anonymous certificate includes the first real-name certificate, and the first real-name certificate includes the first registered public key; using the first registered public key to generate a derived key, using the derived key and the random number to generate derived information, and generating a signature public key based on the derived information and the first registered public key; using the derived key to encrypt the derived information to obtain an extension item; generating the user's first anonymous certificate based on the signature public key and the extension item; sending the first anonymous certificate and the derived key to the user, so that the user calculates the signature private key based on the first registered private key corresponding to the first registered public key, the derived key and the encrypted derived information.

[0052] The steps of generating a derived key using the first registered public key, generating derived information using the derived key and a random number, and generating a signature public key based on the derived information and the first registered public key are as follows:

[0053] 1) ACA generates the root key ACA_KDF_Key using the key distribution function, and generates the derived key KeyDF_Key using the first registered public key RegisterPub_Key in the user's first real-name certificate:

[0054] KeyDF_Key=HMAC(ACA_KDF_Key, RegisterPub_Key); HMAC is a key-related hash operation.

[0055] 2) ACA calculates derived information DerivationID:

[0056] DerivationID=HMAC(KeyDF_Key,ACertIndex);

[0057] 3) ACA uses DerivationID and the first registered public key RegisterPub_Key to generate a signature public key ACertPub_Key: ACertPub_Key = RegisterPub_Key + DerivationID*G; G is a constant.

[0058] The steps for the user to calculate the signature private key based on the first registration private key corresponding to the first registration public key, the derived key and the encrypted derived information include: using the derived key to decrypt the encrypted derived information in the extension item of the anonymous certificate to obtain the decrypted derived information, and then using the decrypted derived information and the first registration private key to generate the signature private key.

[0059] The step of generating a signature private key using the decrypted derived information and the first registered private key includes:

[0060] The user uses the DerivationID and the first registered private key RegisterPrivateKey corresponding to the first real-name certificate to generate the signature private key ACertPriv_Key:

[0061] ACertPriv_Key=(RegisterPrivateKey+DerivationID)mod n; n is a constant.

[0062] In an optional embodiment, after receiving a request from the coordinator to query the first real-name certificate corresponding to the first anonymous certificate, the user identity information management method further includes: querying a derived key corresponding to the first anonymous certificate from the relationship list; and sending the derived key corresponding to the first anonymous certificate to the coordinator.

[0063] Specifically, after generating the first anonymous certificate, ACA will also generate a relationship list of the first real-name certificate, the first anonymous certificate and the derived key, so the derived key can be queried based on the first anonymous certificate. Therefore, when ACA receives a request from the coordinator to query the first real-name certificate corresponding to the first anonymous certificate, it can also send the derived key corresponding to the first anonymous certificate to the coordinator, so that the coordinator can calculate the second registered public key based on the derived key to obtain the user's real identity information.

[0064] Based on the same inventive concept as the registration request processing method and the user identity information management method in the aforementioned embodiment, the embodiment of the present invention further provides an electronic device, such as Figure 4 As shown, it includes: a processor 31 and a memory 32, wherein the processor 31 and the memory 32 can be connected via a bus or other means. Figure 4 The bus connection is used as an example for explanation.

[0065] The processor 31 may be a central processing unit (CPU). The processor 31 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0066] The memory 32 is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the registration request processing method or the user identity information management method in the embodiment of the present invention. The processor 31 executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory 32, that is, implementing the registration request processing method or the user identity information management method in the above method embodiment.

[0067] The memory 32 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function; the data storage area may store data created by the processor 31, etc. In addition, the memory 32 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage devices. In some embodiments, the memory 32 may optionally include a memory remotely arranged relative to the processor 31, and these remote memories may be connected to the processor 31 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0068] The above one or more modules are stored in the memory 32, and when executed by the processor 31, the following is performed: Figure 1 The registration request processing method in the embodiment shown or Figure 2 The user identity information management method shown.

[0069] For details of the above electronic equipment, please refer to Figure 1 or Figure 2 The corresponding related descriptions and effects in the illustrated embodiments can be understood and will not be repeated here.

[0070] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0071] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0072] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable information processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable information processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0073] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable information processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0074] These computer program instructions can also be loaded onto a computer or other programmable information processing device so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0075] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A registration request processing method, used at a coordinator end, wherein the coordinator is connected to an anonymous certificate authority ACA, comprising: Obtaining a request sent by a user to register as a computing node in a secure multi-party computing (SMPC) system, where the request to register as a computing node in the SMPC system includes a first anonymous certificate and registration information signed with a signature private key, where the first anonymous certificate includes a signature public key; Verifying the signature private key using the signature public key; Sending a request to the ACA to query the first real-name certificate corresponding to the first anonymous certificate according to the verification result and the need to confirm whether the user has registered repeatedly; Receiving a first real-name certificate corresponding to the first anonymous certificate sent by the ACA, where the first real-name certificate includes a first registered public key; When confirming, according to the first registration public key, that the user has not registered repeatedly, registering the user as a computing node in the SMPC system according to the registration information; Confirming that the user has not registered repeatedly according to the first registration public key includes: if the first registration public key is different from the registration public keys of other registered computing nodes, confirming that the user has not registered repeatedly.

2. According to the registration request processing method of claim 1, the step of sending a request to the ACA to query the first real-name certificate corresponding to the first anonymous certificate according to the verification result and the need to confirm whether the user has registered repeatedly comprises: When the verification result is successful and it is necessary to confirm whether the user has registered repeatedly, sending a request to the ACA to query the first real-name certificate corresponding to the first anonymous certificate; When the verification result is successful and there is no need to confirm whether the user has registered repeatedly, the user is registered as a computing node in the SMPC system according to the registration information.

3. The registration request processing method according to claim 1, wherein the first anonymous certificate includes an extension item, and the extension item includes derived information encrypted by a derived key; After sending a request to the ACA to query the first real-name certificate corresponding to the first anonymous certificate, when confirming according to the first registration public key that the user has not registered repeatedly, before registering the user as a computing node in the SMPC system according to the registration information, the method further includes: Receiving a derived key corresponding to the first anonymous certificate sent by the ACA; Decrypting the encrypted derived information using the derived key; Calculating a second registration public key using the decrypted derived information and the signature public key; When it is confirmed that the first registration public key and the second registration public key are the same, it is confirmed that the ACA is credible.

4. The registration request processing method according to claim 3, further comprising: When it is confirmed that the first registration public key and the second registration public key are different, and when it is confirmed according to the second registration public key that the user has not registered repeatedly, the user is registered as a computing node in the SMPC system according to the registration information.

5. The registration request processing method according to claim 4, confirming that the user has not registered repeatedly according to the first registration public key / the second registration public key, comprises: Acquire a registration list, wherein the registration list includes a plurality of registered second anonymous certificates; Sending a request to the ACA to query the second real-name certificates corresponding to the multiple second anonymous certificates; Receiving a second real-name certificate corresponding to the plurality of second anonymous certificates sent by the ACA, wherein the second real-name certificate includes a third registered public key; When it is confirmed that the first registration public key / the second registration public key is different from the third registration public key, it is confirmed that the user has not registered repeatedly.

6. A user identity information management method for an anonymous certificate authority ACA, comprising: receiving a request sent by the coordinator to query a first real-name certificate corresponding to the first anonymous certificate; Querying the first real-name certificate corresponding to the first anonymous certificate from the relationship list; Sending the first real-name certificate to the coordinator, the first real-name certificate including a first registered public key; When the coordinator confirms that the user has not registered repeatedly according to the first registration public key, the coordinator registers the user as a computing node in the SMPC system according to the registration information; Confirming that the user has not registered repeatedly according to the first registration public key includes: if the first registration public key is different from the registration public key of other registered computing nodes, confirming that the user has not registered repeatedly; Querying the derived key corresponding to the first anonymous certificate from the relationship list; Sending a derived key corresponding to the first anonymous certificate to the coordinator.

7. The user identity information management method according to claim 6, before receiving the request sent by the coordinator to query the first real-name certificate corresponding to the first anonymous certificate, further comprising: Obtaining a first anonymous certificate application request sent by a user, and generating a random number in response to the first anonymous certificate application request, wherein the first anonymous certificate application request includes a first real-name certificate, and the first real-name certificate includes a first registered public key; generating a derived key using the first registered public key, generating derived information using the derived key and the random number, Generate a signature public key according to the derived information and the first registered public key; Encrypting the derived information using the derived key to obtain an extension item; Generate a first anonymous certificate of the user according to the signature public key and the extension item; The first anonymous certificate and the derived key are sent to the user, so that the user calculates a signature private key according to a first registered private key corresponding to the first registered public key, the derived key and the encrypted derived information.

8. An electronic device, comprising: at least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the registration request processing method as described in any one of claims 1-5 or the user identity information management method as described in any one of claims 6-7.

9. A computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the registration request processing method according to any one of claims 1 to 5 or the user identity information management method according to any one of claims 6 to 7.

Images