Signature-based access control method and system with privacy protection and decentralization

Abstract

The present invention discloses a privacy-preserving decentralized signature-based access control method and system, including a global initialization phase, a public-private key generation phase, a registration phase, an encryption phase, an access request phase, an access key generation phase, a decryption phase, and a tracking phase. In the method of the present invention, multiple authorization agencies can independently authorize users without any interaction; the access permission obtained by the user from each agency is a digital signature of a keyword, a validity period, and its pseudonym, which is non-repudiable and non-forgeable; in particular, multiple signatures can be aggregated into one signature to reduce the storage burden of the user; in addition, the user can anonymously access the service if and only if the corresponding digital signatures are obtained from multiple agencies respectively. The method of the present invention can be used in a decentralized system to protect data confidentiality and user privacy.

Description

Technical Field

[0001] The present invention belongs to the field of computer security technology, and relates to methods and products for information security applications, and specifically to a signature-based access control method and system with privacy protection and decentralization. Background Art

[0002] With the development of communication and network technologies, more and more decentralized service models have been proposed, such as blockchain and Web3.0. In a decentralized system, services are provided by participants with equal rights and the content is more diversified. Decentralized systems have many advantages: (1) Fault tolerance. In a decentralized system, nodes are relatively opposed. Therefore, if one node has a problem, other nodes can work normally. The system has fault tolerance; (2) Resistance to single-point attacks. In a centralized system, the adversary threatens the entire network by attacking the central node. In a decentralized system, there is no central node that can be attacked; (3) Anti-collusion. It is difficult for the adversary to cooperate with multiple nodes at the same time to attack the system; (4) Autonomy. Nodes can communicate directly without the involvement of a third party. Despite this, data security and privacy protection have become the focus of attention for users of decentralized systems.

[0003] In order to protect user privacy, a decentralized system with privacy protection has been proposed. In this system, users can access data anonymously without being identified. Nevertheless, the existing system still has the following problems: (1) Access permissions are usually keys distributed by authorized agencies, which cannot achieve flexible revocation and non-repudiation; (2) De-anonymization is not considered to identify the true identity of bad users. However, in practical applications, the authorized agency cannot deny its authorization. Otherwise, the system will not be able to achieve accountability. In addition, the network environment is complex and there may be bad users. Therefore, in special cases, it is necessary to de-anonymize users and discover the true identity of bad users. Summary of the invention

[0004] The present invention is aimed at the problems existing in the prior art, and provides a privacy-preserving decentralized signature-based access control method and system, including a global initialization phase, a public-private key generation phase, a registration phase, an encryption phase, an access request phase, an access key generation phase, a decryption phase, and a tracking phase. In the method of the present invention, multiple authorization agencies can independently authorize users without any interaction; the access permission obtained by the user from each agency is a digital signature of a keyword, a validity period, and its pseudonym, which is non-repudiable and non-forgeable; in particular, multiple signatures can be aggregated into one signature to reduce the user's storage burden; in addition, a legitimate user can anonymously access the service if and only if he obtains the corresponding access permission (digital signature) from multiple authorization agencies. The method of the present invention can be used in a decentralized system to protect data confidentiality and user privacy.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is: a privacy-preserving decentralized signature-based access control method, comprising the following steps:

[0006] S1, global initialization phase: the system inputs a security parameter 1 k , output the public parameter PP, that is

[0007] Setup(1 k )→PP;

[0008] S2, public-private key stage: The stage includes the registration agency public-private key generation stage, the authorization agency public-private key generation stage, the tracking agency public-private key generation stage and the user public-private key generation stage. The registration agency, the authorization agency, the tracking agency and the user generate public-private keys according to the security parameters 1. k , output a public-private key pair, where

[0009] Registration authority public-private key generation phase: Registration authority (RA) inputs security parameter 1 k , output the public-private key pair (PK RA , S.K. RA ),Right now

[0010] RA_Setup(1 k )→(PK RA , S.K. RA );

[0011] User public-private key generation phase: User (U) inputs security parameter 1 k , output the public-private key pair (PK U , S.K. U ),Right now

[0012] U_Setup(1 k )→(PK U , S.K. U );

[0013] S3, registration phase: the user (U) uses the public parameters PP, the public-private key pair (PK U , S.K. U ), generate a private key SK U Zero-knowledge proof of Π U , (ID U , PK U , Π U ) is sent to the Registration Authority (RA), where ID U For the user's identity, the registration authority uses the public parameters PP and the private key SK RA And the user's public key PK U, generate an anonymous certificate for the user σ U ,Right now

[0014]

[0015] S4, encryption stage: the encryptor uses the keywords, validity period and public keys of multiple authorized agencies to encrypt the message and obtain the ciphertext;

[0016] S5, access control request phase: the user (U) uses the public parameters PP and anonymous certificate σ U Generate a U Zero-knowledge proof Π′ U and a pseudonym P U , and then use Π′ U and P U Authorized institution Apply for access rights, authorized institutions Using public parameters PP and key SK i , generates a pair of keyword W, validity period TP and encryption P for the user U The digital signature of

[0017]

[0018] Where i = 1, 2, ..., S;

[0019] S6, access key generation phase: The user (U) uses the public parameter PP and the obtained digital signature to generate the access key K U ;

[0020] S7, decryption phase: User (U) uses public parameters PP and access key K U And decrypt the ciphertext CT, output the plaintext M, that is,

[0021] Dec(PP,K U , CT)→M.

[0022] As an improvement of the present invention, in step S2,

[0023] Authorization agency public-private key generation phase: Authorization agency (AA i ) Input security parameter 1 k , output the public-private key pair (PK i , S.K. i ),Right now

[0024] AA_Setup(1 k )→(PK AA , S.K. AA ),

[0025] Where i = 1, 2, ..., n;

[0026] Tracking agency public-private key generation phase: Tracking agency (TA) inputs security parameter 1 k , output the public-private key pair (PK TA , S.K. TA ),Right now

[0027] TA_Setup(1 k )→(PK TA , S.K. TA ).

[0028] As an improvement of the present invention, the step S8 is also included, in the tracking phase: the tracking agency inputs the public parameters PP and the key SK TA , pseudonym P U And zero-knowledge proof Π′ U , output the user's public key PK U ,Right now

[0029] T(PP,SK TA , P U , Π U )→PK U .

[0030] As another improvement of the present invention, in the encryption phase of step S4, the encryptor inputs a public parameter PP, a keyword W about the message M, a set of public keys of the authorized institution And a validity period TP, output ciphertext CT, that is

[0031]

[0032] As another improvement of the present invention, in step S6, the digital signatures obtained by the user from multiple authorized institutions can be aggregated into one signature, and the user (U) uses the public parameters PP and the obtained digital signatures (K1, K2, ..., K S ) into an access key K U ,Right now

[0033]

[0034] In order to achieve the above-mentioned purpose, the present invention also adopts a technical solution: a privacy-preserving decentralized signature-based access control system, including a computer program, which implements the steps of any of the above-mentioned methods when executed by a processor.

[0035] Compared with the prior art, the present invention first encrypts data using keywords, validity periods, and public keys of multiple authorized agencies, then authenticates the user through anonymous authentication technology, generates an access permit for the user, and allows the user to aggregate multiple access permits through aggregated digital signature technology and tracking technology, thereby achieving the unforgeability and non-repudiation of access permits and the traceability of bad users. The present invention has the following technical effects and advantages:

[0036] (1) Users can access the service anonymously without revealing their real identity;

[0037] (2) The data is encrypted with keywords, validity period, and the public key of the authorized agency. In order to access the data, the user must obtain permission from multiple agencies separately and must use the permission within the validity period of the data;

[0038] (3) Access permission is a digital signature of keywords, validity period and user pseudonym, which is non-repudiable and unforgeable;

[0039] (4) Multiple digital signatures can be aggregated into one signature, reducing the user's storage burden;

[0040] (5) In special circumstances, tracking agencies can de-anonymize users and discover their true identities. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a flowchart of the steps of the privacy-preserving decentralized signature-based access control method of the present invention. DETAILED DESCRIPTION

[0042] The present invention will be further explained below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0043] Example 1

[0044] A privacy-preserving decentralized signature-based access control method, such as Figure 1 As shown, the following steps are included:

[0045] S1 global initialization phase: the system inputs a safety parameter 1 k , output the public parameter PP, that is

[0046] Setup(1 k )→PP

[0047] Assumptions Generates an algorithm for a bilinear group. The algorithm takes as input a security parameter 1 k , output the cyclic group of prime order p and a bilinear map Assume that g0, g, g1, g2, h0, h1 are The generator of g is The generator of is a hash function. The public parameters of the system are

[0048] S2 public-private key generation phase: This phase consists of the following four parts

[0049] S2-1 Registration Authority Public-Private Key Generation Phase: The Registration Authority (RA) randomly selects calculate The public-private key pair of the registration authority is (Y RA , x ra ).

[0050] S2-2 Authorization agency public-private key generation phase: Assume that there are n authorization agencies in the system Each authorized institution A i Randomly select calculate and A i The private key is x i , the public key is Y i =(Y i，1 , Y i，2 ). Let the set of all authorized agencies’ public keys be

[0051] S2-3 Tracking Agency Public-Private Key Generation Phase: Tracking Agency (TA) randomly selects calculate The public-private key pair of the tracking organization is (Y TA , x ta ). The tracking organization maintains a user information list Table.

[0052] S2-4 User public-private key generation phase: User (U) is randomly selected calculate The user's public-private key pair is (Y U , x u ).

[0053] S3 registration phase: Assume that the user (U) has an identity ID U ∈{0, 1} * U interacts with the registration authority (RA) as follows: After the user authenticates to the registration authority, he obtains an anonymous certificate, which allows the user to prove to the authorization agency that he is a legitimate user without revealing his specific identity information.

[0054] (1) U generates a private key x u Zero-knowledge proof of Then (ID U , PK U , Π U ) is sent to the registration authority.

[0055] (2) RA Verification U If it is not correct, RA exits; otherwise, RA randomly selects calculate Where du≠-x ta RA will (e u , d u , δ U ) is sent to U, and (ID U , Y U ) is sent to the tracking agency (TA).

[0056] (3)TA will (ID U , Y U ) is added to the user information list Table.

[0057] S4 encryption phase: Assuming the message The keyword associated with M is W∈{0,1} * , valid for TP∈{0,1} * The encryptor first identifies a set of authorized institutions and the corresponding public key set Then randomly select calculate

[0058]

[0059] Where I is The set of subscripts of the mechanism in ,

[0060] Using keywords, validity periods, and public key encryption from multiple authorized agencies, users must obtain authorization from multiple agencies to access data.

[0061] S5 Access Request Phase: In order to access message M, the user (U) needs to obtain a request from each authority. Licensed separately.

[0062] (1)U is randomly selected calculate and Generate about (x u , r s ,s u , δ U)

[0063]

[0064] where y u =s u x u . Let the user's pseudonym be P U =(P U，1 , P U，2 ). General U Send to each Users can anonymously obtain digital signatures with keywords, validity periods, and pseudonyms from multiple authorized agencies.

[0065] (2) First verify the zero-knowledge proof If it is not correct, Exit; otherwise, calculate in Access permission K i Send to U.

[0066] (3) U verification

[0067] S6 Access key generation phase: The user (U) generates an access key K using the public parameter PP and the obtained digital signature U , user (U) calculates K U =Π i∈I K i .

[0068] S7 decryption phase: User (U) uses public parameters PP and access key K U and decrypt the ciphertext CT, output the plaintext M, and the user (U) calculates

[0069] S8 Tracking stage: Tracking agency (TA) inputs public parameters PP and key SK TA , pseudonym P U And zero-knowledge proof Π′ U , output the user's public key PK U , that is, tracking agencies use access information calculate By Y U Identify the user’s real ID U .

[0070] In summary, the present invention proposes a decentralized signature-based access control method with privacy protection. This method does not require a trusted central agency to initialize the system, and users can access data anonymously; messages are encrypted using keywords, validity periods, and public keys of authorized agencies; a user can access data if and only if he or she obtains access permissions from multiple agencies, that is, signatures for keywords, validity periods, and their pseudonyms; in addition, multiple signatures can be aggregated into one signature to reduce the storage burden of end users; in special cases, tracking agencies can de-anonymize and discover the true identity of bad users, further protecting data confidentiality and user privacy. It is a new generation of access control method with good effects and a wide range of applications.

[0071] It should be noted that the above content only illustrates the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications all fall within the protection scope of the claims of the present invention.

Claims

1. A privacy-preserving decentralized signature-based access control method, characterized in that: The following steps are involved: S1, global initialization phase: the system inputs a security parameter 1 k , output the public parameter PP, that is Setup(1 k )→PP; S2, public-private key generation stage: The stage includes the registration agency public-private key generation stage, the authorization agency public-private key generation stage, the tracking agency public-private key generation stage and the user public-private key generation stage. The registration agency, the authorization agency, the tracking agency and the user generate public-private keys according to the security parameters 1. k , output the public-private key, where Registration authority public-private key generation phase: Registration authority (RA) inputs security parameter 1 k , output the public-private key pair (PK RA , S.K. RA ),Right now RA_Setup(1 k )→(PK RA ,SK RA ); User public-private key generation phase: User (U) inputs security parameter 1 k , output the public-private key pair (PK U , S.K. U ),Right now U_Setup(1 k )→(PK U ,SK U ); S3, registration phase: the user (U) uses the public parameters PP, the public-private key pair (PK U , S.K. U ), generate a private key SK U Zero-knowledge proof of U , (ID U , PK U ,∏ U ) is sent to the Registration Authority (RA), where ID U For the user's identity, the registration authority uses the public parameters PP and the private key SK RA And the user's public key PK U , generate an anonymous certificate for the user σ U ,Right now S4, encryption stage: the encryptor uses the keywords, validity period and public keys of multiple authorized agencies to encrypt the message and obtain the ciphertext; S5, access control request phase: the user (U) uses the public parameters PP and anonymous certificate σ U Generate a U Zero-knowledge proof ∏′ U and a pseudonym P U , and then use ∏′ U and P U Authorized institution Apply for access rights, authorized institutions Using public parameters PP and key SK i , generates a pair of keyword W, validity period TP and encryption P for the user U The digital signature of Where i = 1, 2, ..., S; S6, access key generation phase: The user (U) generates the access key K using the public parameter PP and the obtained digital signature U ; S7, decryption phase: User (U) uses public parameters PP and access key K U And decrypt the ciphertext CT, output the plaintext M, that is, Dec(PP,K U ,CT)→M。 2. The privacy-preserving decentralized signature-based access control method of claim 1, wherein: In the step S2, Authorization agency public-private key generation phase: Authorization agency (AA i ) Input security parameter 1 k , output the public-private key pair (PK i , S.K. i ),Right now AA_Setup(1 k )→(PK AA ,SK AA ), Where i = 1, 2, ..., n; Tracking agency public-private key generation phase: Tracking agency (TA) inputs security parameter 1 k , output the public-private key pair (PK TA , S.K. TA ),Right now TA_Setup(1 k )→(PK TA ,SK TA )。 3. The privacy-preserving decentralized signature-based access control method of claim 2, wherein: It also includes step S8, tracking stage: the tracking agency inputs public parameters PP and key SK TA , pseudonym P U And zero-knowledge proof ∏′ U , output the user's public key PK U ,Right now T(PP,SK TA ,P U ,∏′ U )→PK U 。 4. The privacy-preserving decentralized signature-based access control method of claim 3, wherein: In the encryption phase of step S4, the encryptor inputs a public parameter PP, a keyword W about the message M, and a set of public keys of authorized institutions. And a validity period TP, output ciphertext CT, that is 5. The privacy-preserving decentralized signature-based access control method of claim 4, wherein: In step S6, the digital signatures obtained by the user from multiple authorized institutions are aggregated into one signature, and the user (U) uses the public parameters PP and the obtained digital signatures (K1, K2, ..., K S ), generate an access key K U ,Right now A_K(PP,K1,K2,…,K S )→K U 。 6. A privacy-preserving decentralized signature-based access control system comprising a computer program characterized by: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images