Conditional anonymous authentication system and method based on knowledge signature

Abstract

The present invention relates to a conditional anonymous authentication system based on knowledge signature, including an auditor, a message sender and a message receiver; when the system is initialized, the auditor generates a traceability key pair and manages the accumulator state of the access rights; before the message is sent, the sender generates a temporary identity pseudonym and uses evidence and the identity pseudonym to perform knowledge signature on the message; after the message is received, the receiver verifies the anonymous signature according to the authentication strategy; when performing the audit operation, the auditor uses the traceability private key to decrypt the identity pseudonym and obtain the user's long-term public key. The present invention meets the tracking and supervision requirements of the application while protecting the real identity of the user.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a conditional anonymous authentication system and method based on knowledge signature. Background Art

[0002] In information systems, identity authentication protocols are used to identify user identities and prevent unauthorized access, and are the basis for other security mechanisms. In the fields of e-commerce, Internet of Vehicles, smart healthcare, etc., user identity information is a type of sensitive data that often involves personal privacy. However, traditional authentication protocols do not consider user identity privacy protection, and there is a risk of privacy data leakage.

[0003] In order to enhance the privacy protection capability of authentication protocols, anonymous identity authentication is a hot topic in current research. Domestic and foreign scholars have proposed a number of privacy protection enhancement schemes based on anonymous certificates, certificateless and other cryptographic technologies. However, completely anonymous authentication protocols lack effective regulatory measures and there is an abuse of anonymity, that is, when malicious users spread harmful messages or threaten system security, the system cannot hold them accountable. Therefore, anonymous authentication protocols not only need to protect the privacy security of users, but also need to take into account regulatory capabilities. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a conditional anonymous authentication system and method based on knowledge signature, which can protect the real identity of the user while meeting the tracking and supervision requirements of the application.

[0005] To achieve the above object, the present invention adopts the following technical solution:

[0006] A conditional anonymous authentication system based on knowledge signature includes an auditor, a message sender and a message receiver. When the system is initialized, the auditor generates a traceability key pair and manages the accumulator state that records access rights. Before sending a message, the sender generates a temporary identity pseudonym and uses evidence and the identity pseudonym to perform knowledge signature on the message. After receiving the message, the receiver verifies the anonymous signature according to the authentication policy. When performing an audit operation, the auditor can use the traceability private key to decrypt the identity pseudonym and obtain the user's long-term public key.

[0007] An authentication method for a conditional anonymous authentication system based on knowledge signature, comprising the following steps:

[0008] Step S1: system initialization;

[0009] Step S2: Generate a user long-term key pair and anonymous identity;

[0010] Step S3: The user to be registered sends the long-term public key to the auditor TA through a secure channel. TA receives the user's long-term public key and stores it in the set [UPK n]={pk1,pk2,…,pk n}, set user permissions;

[0011] Step S4: The message sender uses the knowledge signature to sign the information m∈{0,1} * Signature

[0012] Step S5: After receiving the signed message (x, m, σ), the receiver performs a verification operation.

[0013] Furthermore, the system initialization specifically includes:

[0014] a)TA selects safe group parameters Select large prime numbers q1 and q2, calculate the RSA modulus n = q1 × p1, φ(n) = (q1-1)(p1-1), and select a secure one-way hash function Where p = min(q,q1,p1);

[0015] b)TA selects a private key Calculate TA public key tpk = g tsk ;

[0016] c)TA initializes the accumulator used to record the authorized user public key set [UPK n ]={pk1,pk2,…,pk n}, and the RSA accumulation value Acc of the set.

[0017] d)TA public system parameters

[0018] Furthermore, the step S2 is specifically as follows:

[0019] a) The user randomly selects a long-term private key Calculate the long-term public key pk = g sk ;

[0020] b) User calculates ask1 = g v ,ask2=pk·tpk v , (ask1, ask2) are used as anonymous identities, and multiple anonymous identities are generated in the same way.

[0021] Furthermore, in step S3, TA performs the following calculation steps:

[0022] a)TA randomly selects each public key Make y i =pk i +u i is a prime number, calculate

[0023] Add(Acci-1 ,y i )→Acc i , and finally obtain Acc = Acc n ;

[0024] b) TA generates a membership certificate for each user and calculates ω i =MemWitCreate(Acc i ,y i ,[UPK n ]);

[0025] c)TA sends (Acc,ω) through the secure channel i ) is distributed to each user.

[0026] Furthermore, in step S4, the sender's long-term key pair (sk, pk), temporary identity (apk1, apk2), and member proof ω knowledge signature structure are as follows:

[0027] SoK={(x,w):apk1=g v ,apk2=pk·tpk v ,pk=g sk ,ω pk+u =Acc}(m)

[0028] in,

[0029] w=(sk,pk,v,ω,u), x=(g,n,q,apk1,apk2,Acc)

[0030] Convert to computable form:

[0031]

[0032] in,

[0033] x=(g,n,q,apk1,apk2,Acc,g1,g2,g3,g4,h1,h2,R1,R2,R1',R2)

[0034]

[0035] The specific signing process of knowledge signature is as follows:

[0036] a) The sender selects random numbers s1,γ1,γ2,γ3,γ4,∈1,∈2,∈3,μ,ρ1,ρ2,α1, b) Sender calculation

[0037]

[0038] c) Sender calculation

[0039]

[0040] z1=s1+ve, Z1=γ3·pke, Z2=μ·ωe

[0041] z2=γ1+r1e,z3=γ2+r2e,z4=γ3+pk·e

[0042]

[0043] z8=∈1+t1e,z9=∈2+t2e,z 10 =∈3+sk -1 e

[0044] z 11 =α1+φe,z 12 =α2+βe

[0045] The sender sends (x, m, σ) to the receiver, where σ = (Z1, Z2, {z i} i∈[1,12] ,e).

[0046] Furthermore, the verification operation is specifically as follows:

[0047] a) Receiver calculation

[0048]

[0049]

[0050] b) Receiver’s judgment

[0051]

[0052] Are they equal? ​​If they are equal, the verification passes, otherwise the verification fails.

[0053] Furthermore, if a malicious user appears, TA will perform the following operations to track and recover the sender's identity:

[0054] a) Obtain temporary identity information (apk1, apk2) associated with the malicious user;

[0055] b) Using TA private key tsk, calculate Obtain the user's long-term public key to obtain the user's identity.

[0056] Compared with the prior art, the present invention has the following beneficial effects:

[0057] 1. The present invention makes the anonymous identity of users traceable, preventing malicious users from abusing the anonymous mechanism to send harmful messages;

[0058] 2. The present invention combines the characteristics of access control and password accumulator. The present invention can realize fine-grained access control based on anonymous authentication, is suitable for application scenarios with high requirements for privacy protection, and is practical in identity authentication, privacy protection, regulatory auditing, and access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 This is the message signing and verification process of the present invention. DETAILED DESCRIPTION

[0060] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0061] The present invention provides a conditional anonymous authentication system based on knowledge signature, comprising an auditor, a message sender and a message receiver; when the system is initialized, the auditor generates a traceability key pair and manages the accumulator state that records access rights; before the message is sent, the sender generates a temporary identity pseudonym and uses evidence and the identity pseudonym to perform knowledge signature on the message; after the message is received, the receiver verifies the anonymous signature according to the authentication strategy; when performing an audit operation, the auditor can use the traceability private key to decrypt the identity pseudonym and obtain the user's long-term public key.

[0062] In this embodiment, an authentication method of a conditional anonymous authentication system based on knowledge signature is also provided, comprising the following steps:

[0063] Step S1: system initialization;

[0064] Step S2: Generate a user long-term key pair and anonymous identity;

[0065] Step S3: The user to be registered sends the long-term public key to the auditor TA through a secure channel. TA receives the user's long-term public key and stores it in the set [UPK n ]={pk1,pk2,…,pk n}, set user permissions;

[0066] Step S4: The message sender uses the knowledge signature to sign the information m∈{0,1} * Signature

[0067] Step S5: After receiving the signed message (x, m, σ), the receiver performs a verification operation.

[0068] In this embodiment, system initialization specifically includes:

[0069] a)TA selects safe group parameters Select large prime numbers q1 and q2, calculate the RSA modulus n = q1 × p1, φ(n) = (q1-1)(p1-1), and select a secure one-way hash function Where p = min(q,q1,p1);

[0070] b)TA selects a private key Calculate TA public key tpk = g tsk ;

[0071] c)TA initializes the accumulator used to record the authorized user public key set [UPK n ]={pk1,pk2,…,pk n}, and the RSA accumulation value Acc of the set.

[0072] d)TA public system parameters

[0073] In this embodiment, step S2 is specifically as follows:

[0074] a) The user randomly selects a long-term private key Calculate the long-term public key pk = g sk ;

[0075] b) User calculates ask1 = g v ,ask2=pk·tpk v , (ask1, ask2) are used as anonymous identities, and multiple anonymous identities are generated in the same way.

[0076] In this embodiment, in step S3, TA performs the following calculation steps:

[0077] a)TA randomly selects each public key Make y i =pk i +u i is a prime number, calculate

[0078] Add(Acc i-1 ,y i )→Acc i , and finally obtain Acc = Acc n ;

[0079] b) TA generates a membership certificate for each user and calculates ω i =MemWitCreate(Acc i ,y i ,[UPK n ]);

[0080] c)TA sends (Acc,ω) through the secure channel i ) is distributed to each user.

[0081] In this embodiment, in step S4, the sender's long-term key pair (sk, pk), temporary identity (apk1, apk2), and member proof ω knowledge signature structure are as follows:

[0082] SoK={(x,w):apk1=g v ,apk2=pk·tpk v ,pk=g sk ,ω pk+u =Acc}(m)

[0083] in,

[0084] w=(sk,pk,v,ω,u), x=(g,n,q,apk1,apk2,Acc)

[0085] Convert to computable form:

[0086]

[0087] in,

[0088] x=(g,n,q,apk1,apk2,Acc,g1,g2,g3,g4,h1,h2,R1,R2,R1',R2)

[0089]

[0090] The specific signing process of knowledge signature is as follows:

[0091] a) The sender selects random numbers s1,γ1,γ2,γ3,γ4,∈1,∈2,∈3,μ,ρ1,ρ2,α1, b) Sender calculation

[0092]

[0093] c) Sender calculation

[0094]

[0095] z1=s1+ve,Z1=γ3·pk e ,Z2=μ·ω e

[0096] z2=γ1+r1e,z3=γ2+r2e,z4=γ3+pk·e

[0097]

[0098] z8=∈1+t1e,z9=ε2+t2e,z 10 =ε3+sk -1 e

[0099] z 11 =α1+φe,z 12 =α2+βe

[0100] The sender sends (x, m, σ) to the receiver, where σ = (Z1, Z2, {z i} i∈[1,12] ,e).

[0101] In this embodiment, the verification operation is specifically as follows:

[0102] a) Receiver calculation

[0103]

[0104]

[0105] b) Receiver’s judgment

[0106]

[0107] Are they equal? ​​If they are equal, the verification passes, otherwise the verification fails.

[0108] In this embodiment, preferably, if a malicious user appears, the TA performs the following operations to track and recover the sender's identity:

[0109] a) Obtain temporary identity information (apk1, apk2) associated with the malicious user;

[0110] b) Using TA private key tsk, calculate Obtain the user's long-term public key to obtain the user's identity.

[0111] The above description is only a preferred embodiment of the present invention. All equivalent changes and modifications made according to the scope of the patent application of the present invention should fall within the scope of the present invention.

Claims

1. The authentication method of the conditional anonymous authentication system based on knowledge signature is characterized by: The following steps are involved: Step S1: system initialization; Step S2: Generate a user long-term key pair and anonymous identity; Step S3: The user to be registered sends the long-term public key to the auditor TA through a secure channel. TA receives the user's long-term public key and stores it in the set [UPK n ]={pk1,pk2,…,pk n }, set user permissions; Step S4: The message sender uses the knowledge signature to sign the information m∈{0,1} * Signature Step S5: After receiving the signed message (x, m, σ), the receiver performs a verification operation; In step S4, the sender's long-term key pair (sk, pk), temporary identity (apk1, apk2), membership proof ω, and knowledge signature structure are as follows: SoK={(x,w):apk1=g v ,apk2=pk·tpk v ,pk=g sk ,ω pk+u =Acc}(m) in, w=(sk,pk,v,ω,u), x=(g,n,q,apk1,apk2,Acc) Convert to computable form: Among them, tpk is the TA public key; x=(g,n,q,apk1,apk2,Acc,g1,g2,g3,g4,h1,h2,R1,R2,R1',R'2) Among them, Acc is the RSA cumulative value that records the authorized user public key set; sk and pk are the user's long-term private key and long-term public key respectively; The specific signing process of knowledge signature is as follows: a) The sender selects random numbers s1,γ1,γ2,γ3,γ4,∈1,∈2,∈3,μ,ρ1,ρ2,α1, b) Sender calculation c) Sender calculation z1=s1+ve,Z1=γ3·pk e ,Z2=μ·ω e z2=γ1+r1e,z3=γ2+r2e,z4=γ3+pk·e z8=∈1+t1e,z9=∈2+t2e,z 10 =∈3+sk -1 yes z 11 =α1+φe,z 12 =α2+βe The sender sends (x, m, σ) to the receiver, where σ = (Z1, Z2, {z i } i∈[1,12] ,e); is a hash function.

2. The authentication method according to claim 1, characterized in that: The system initialization specifically includes: a)TA selects safe group parameters Select large prime numbers q1 and p1, calculate the RSA modulus n = q1 × p1, φ(n) = (q1-1)(p1-1), and select a secure one-way hash function Where p = min(q,q1,p1); b)TA selects a private key Calculate TA public key tpk = g tsk ; c)TA initializes the accumulator used to record the authorized user public key set [UPK n ]={pk1,pk2,…,pk n }, and the RSA accumulation value Acc of the set; d)TA public system parameters 3. The authentication method according to claim 1, characterized in that: The step S2 is specifically as follows: a) The user randomly selects a long-term private key Calculate the long-term public key pk = g sk ; b) User calculates ask1 = g v ,ask2=pk·tpk v , (ask1, ask2) are used as anonymous identities, and multiple anonymous identities are generated in the same way.

4. The authentication method according to claim 1, characterized in that: In step S3, TA performs the following calculation steps: a)TA randomly selects each public key Make y i =pk i +u i is a prime number, calculate Add(Acc i-1 ,y i )→Acc i , and finally obtain Acc = Acc n ; Among them, pk i It is the user's long-term public key; b) TA generates a membership certificate for each user and calculates ω i =MemWitCreate(Acc i ,y i ,[UPK n ]); c)TA sends (Acc,ω) through the secure channel i ) is distributed to each user.

5. The authentication method according to claim 1, characterized in that: The verification operation is specifically as follows: a) Receiver calculation b) Receiver’s judgment Are they equal? ​​If they are equal, the verification passes, otherwise the verification fails.

6. The authentication method according to claim 1, characterized in that: If a malicious user appears, TA will perform the following operations to track and recover the sender's identity: a) Obtain temporary identity information (apk1, apk2) associated with the malicious user; b) Using TA private key tsk, calculate Obtain the user's long-term public key to obtain the user's identity.

7. A conditional anonymous authentication system based on knowledge signature, characterized in that: The system is implemented by the authentication method described in any one of claims 1 to 6, and includes an auditor, a message sender, and a message receiver; when the system is initialized, the auditor generates a traceability key pair and manages the accumulator state of the record access rights; Before sending a message, the sender generates a temporary identity pseudonym and uses evidence and the identity pseudonym to sign the message; after receiving the message, the receiver verifies the anonymous signature according to the authentication policy; when performing an audit operation, the auditor can use the traceability private key to decrypt the identity pseudonym and obtain the user's long-term public key.

Images