Highly efficient anonymous single sign-on system and method based on key verification credentials

Abstract

The present invention relates to an efficient anonymous single sign-on system and method based on key verification credentials, including terminal users, identity servers, service providers and trusted arbitration institutions; based on efficient key verification credentials and anonymous token technology, its construction avoids the expensive bilinear pairing operation required in the previous ASSO system, can be efficiently instantiated in prime order groups, and is suitable for large-scale deployment. The present invention implements the designated verifier function, can ensure the deniability of ticket authentication, and realizes an efficient accountability mechanism, and double spending or other malicious behaviors can be quickly detected and held accountable.

Description

Technical Field

[0001] The present invention relates to the field of Internet security, and in particular to a highly efficient anonymous single sign-on system and method based on key verification credentials. Background Art

[0002] The popularity of single sign-on (SSO) has greatly simplified the authentication and authorization process between third-party resource providers. In a typical SSO architecture, the identity server (IS) is responsible for verifying the credentials of users requesting third-party services and issuing short-term tickets to authenticated users. The user then submits the obtained ticket to the designated service providers (SPs) for identity authentication. By adopting this architecture, users do not need to register an account for each required service, nor do they need to worry about the security of personal information stored in third-party providers. Many widely used open source standards (such as JWT, OAuth), protocols (such as Kerberos, SAML) and frameworks (such as OpenID) implement single sign-on mechanisms; at the same time, this architecture has also been deployed in many websites and mobile applications. According to a survey, 6.30% of the top 1 million websites ranked by Amazon Alexa provide SSO services, including well-known leading companies such as Google, Yahoo, Twitter, Facebook, and Microsoft.

[0003] Security and privacy issues are one of the most important challenges facing single sign-on systems. Since the identity server (IS) holds the privacy of registered users and records their service requests, the IS is often the target of server intrusion and data theft. In 2018, Facebook's single sign-on system disclosed a large-scale data breach, exposing at least 50 million users to serious privacy risks. For security and privacy reasons, many SSO systems prevent the IS from knowing the identity of the service provider requested by the user during the ticket application phase. However, in these schemes, both the IS and the SP can know the real identity of the logged-in user, which means that if the IS or SP is not secure enough, the user's identity information may still be leaked. Anonymous single sign-on (ASSO) is a more private single sign-on paradigm that can provide stronger privacy and security protection. The ASSO system allows users to anonymously authenticate to the IS and obtain tickets, while ensuring the unlinkability of each ticket request. On the other hand, the anonymity is accountable, and the real identity of the anonymous user can be disclosed by a trusted arbitrator (TA) when necessary.

[0004] Execution efficiency is a critical indicator for single sign-on systems. According to a survey, Facebook has about 1.9 billion daily active users, while Twitter has more than 206 million daily active users, which places great demands on the throughput of single sign-on systems. Unfortunately, the existing ASSO solution is not practical in scenarios where large-scale service requests need to be processed, because its ticket issuance or verification operations are based on cumbersome bilinear pairing calculations, and each ticket generation or verification requires hundreds of milliseconds of time overhead. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide an efficient anonymous single sign-on system and method based on key verification credentials, which realizes the designated verifier function, can ensure the deniability of ticket authentication, and realizes an efficient accountability mechanism, so that double spending or other malicious behaviors can be quickly detected and held accountable.

[0006] To achieve the above object, the present invention adopts the following technical solution:

[0007] Please refer to Figure 1 The present invention provides an efficient anonymous single sign-on system based on key authentication credentials, including a terminal user Identity Server Service Providers and credible arbitration institutions

[0008] Said Towards Register, obtain long-term credentials bound to your identity, and before requesting services, Use your own credentials to anonymously Certified and obtained Short-term notes issued;

[0009] Said Manage user identities, save registered user identity information and issue credentials, and be responsible for verifying anonymous credentials and issuing short-term tickets;

[0010] Said Whether the submitted ticket is invalid, expired, or reused, and respond to the user request. If Violation of user regulations, The ticket will be sent to Conduct identity tracking;

[0011] Said Responsible for tracking down malicious users.

[0012] Furthermore, the A tracking tag is stored for each ticket generated.

[0013] A control method for an efficient anonymous single sign-on system based on key authentication credentials includes the following stages:

[0014] System initialization phase: With safety parameter 1 λ As input, generate system public parameters PP; then Run Issuer-Keygen, Provider-Keygen, Arbitrator-Keygen, and User-Keygen to obtain their own private key-public key pairs; and each Initialize a list At the same time, and Initialize a list to save tracking marks;

[0015] User registration stage: before logging in and accessing the service, With Identity Server Run the User-Registration interaction protocol to register its identity to

[0016] Bill application stage: anonymously Authenticate and submit a collection for the requested service If the authentication is successful, Generate tickets for all requested services

[0017] Ticket verification phase: Run the Ticket-Validation algorithm on the submitted ticket Tix sp To verify;

[0018] Malicious user tracking stage: When any suspicious user behavior is detected, The ticket submitted when sending the corresponding service request to then, Execute the Trace algorithm to de-anonymize the malicious user and output their ID eu , public key PK eu .

[0019] Furthermore, the system initialization phase is specifically as follows:

[0020] run Generate a cyclic group of order p In selecting the generator And define collision-resistant hash function H1: H2: After that, the function outputs the common parameters

[0021] Select calculate Output The private key SK is =(x1,x2,x3,x4,y), public key PK is =(X1,X2,Y);

[0022] Select calculate And output The private key SK sp =x sp , public key

[0023] Random Selection And calculate Output The private key SK ta =x ta , public key PK ta =Y ta ; Random Selection And calculate Output The private key SK eu =x eu , public key PK eu =Y eu .

[0024] Furthermore, the User-Registration interaction protocol is specifically:

[0025] First, its public key Y eu Compute a proof and will Send to

[0026] if efficient, Select And calculate

[0027] Among them, (t,U,V) is a eu The bound key verifies the anonymous credential; to ensure the authenticity of the issued certificate, Generate Proof

[0028]

[0029] Send Proof Give and stored in the local database (ID eu ,PK eu );

[0030] After receiving (t,U,V) and back, verify To determine whether (t, U, V) is a legitimate anonymous credential; if the verification is successful, Output cred eu =(t,U,V).

[0031] Furthermore, the bill application stage is specifically as follows:

[0032] Command symbol Reference a set of identifiers of the requested service providers; Select calculate

[0033] then, calculate It will be used to restore The public key For each request Select a ticket identifier And calculate T sp =H2(TID sp ) r ; For (C eu ,E eu ,R eu );

[0034] Generate a zero-knowledge proof

[0035]

[0036] and will Send to

[0037] Before issuing the notes, verify And check the equation Is it established to determine the validity of the user's identity; if the verification is successful, Select For all requests calculate The key pair (lk,rk) is and A one-time ticket authentication key shared between the two parties;

[0038] Calculate using (lk,rk) in Essentially an anonymous token; by leveraging s sp For E eu To randomize, Generate tracking mark

[0039] Generate all invoices back, Hash all accepted or generated components to get Λ2=H2(C eu ,E eu ,R eu ), and use this to calculate Generate a proof for σ

[0040] at last, Will Return to And send Give

[0041] Upon receipt And verify back, Let q = r -1 and recalculate for each requested service For each pair of tuples calculate And output the final note Tix sp =(TID sp ,s sp ,S sp ,W sp ,ID sp ,VP sp ,Info sp ).

[0042] Furthermore, the Ticket-Validation algorithm is specifically:

[0043] Tix sp =(TID sp ,s sp ,S sp ,W sp ,ID sp ,VP sp ,Info sp), private key SK sp , public key PK is =(X1,X2,Y) is the input, First check the validity period VP sp Whether it is expired;

[0044] then, Calculate the ticket authentication key

[0045] And check whether the following conditions are met:

[0046] (1) By TID sp The marked records are in the list does not exist in .

[0047] (2) Equation Established.

[0048] If the verification is successful, Tix sp insert And TID sp Mark it and output 1. Otherwise, Output 0.

[0049] Furthermore, the algorithm Trace is specifically:

[0050] Upon receipt of the Tix sp =(TID sp ,s sp ,S sp ,W sp ,ID sp ,VP sp ,Info sp )hour, Calculate TR sp,1 =H1(s sp ) and use it to retrieve the corresponding tracking tag TR sp =(TR sp,1 ,TR sp,2 ,TR sp,3 );if There are records in calculate And send PK eu Give Since during the user registration phase Saved the entry (ID eu ,PK eu ), You can easily find the ID eu And hold people accountable.

[0051] Furthermore, the collision-resistant hash function H1: With H2: Conduct with group Related calculations and meet the following settings:

[0052] make is a cyclic group with output order p The group generator of a ,B=g b ,C=g c ), the DDH assumption requires that the adversary The element C = g ab With random elements The probability of distinguishing is negligible, that is If the opponent Advantages can be ignored, then we believe that the DDH hypothesis is established;

[0053] CTGDH allows the execution of CDH queries and DDH queries. is a cyclic group of order p, given a challenge (g, A = g a ) and 3 fable machine queries: (1) Translate the string t∈{0,1} * Encoded as element B; (2) Take element B as input, output C = B a ; (3) Take the tuple (B, C) as input, if C = B a , output 1; a permission to access the parable machine Rival Generate meet the conditions And not in the fable machine Query B * The tuple (t * ,C * =(B * ) a ) is negligible; The advantage function is defined as

[0054] Given (g, A = g a ,B=g b ) and a parable machine Any As input, randomly selected Output T = (h, h a+mb ); LRSW assumption requires that, in the adversary Possess access to the Fable Machine At the same time as the permission, output a * The ancestor of The probability of is negligible; the adversary’s advantage function is defined as

[0055] Compared with the prior art, the present invention has the following beneficial effects:

[0056] 1. The present invention realizes efficient anonymous single sign-on. The designed system does not rely on cumbersome pairing calculations and can achieve significantly higher execution efficiency than the existing ASSO solution.

[0057] 2. The present invention only uses symmetric cryptographic primitives for limited non-interactive zero-knowledge proofs (NIZK), and the computational complexity and communication overhead are relatively low.

[0058] 3. The present invention implements the function of designated verifiers. In the present invention, only designated service providers (SPs) have the authority to verify the validity of the submitted tickets. This property ensures deniability in identity authentication, and the SP cannot prove to any third-party entity that the user has ever accessed the service.

[0059] 4. The present invention achieves efficient double-spending detection and auditable anonymity. Each bill can only be used once within its limited period, and any double-spending behavior (i.e., the behavior of repeatedly using the same bill) can be quickly discovered and prevented. In addition, the anonymity of the bill is revocable, and a trusted arbitrator can revoke the anonymity of anonymous users who engage in double-spending or violate other rules to hold them accountable. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 It is a schematic diagram of the system model of the present invention. DETAILED DESCRIPTION

[0061] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0062] Please refer to Figure 1 The present invention provides an efficient anonymous single sign-on system based on key authentication credentials, including a terminal user Identity Server Service Providers and credible arbitration institutions

[0063] (1) End users

[0064] A user who requests a service or resource using anonymous credentials. First, the identity server Register to obtain a long-term credential bound to your identity (step ①). Before requesting a service, Use your own credentials to anonymously Certified and obtained Short-term notes issued. Each note corresponds to a service provider Short-term tickets carry the necessary service information and are later verified by the designated service provider.

[0065] (2) Identity Server

[0066] Responsible for managing user identities and saving registered users identity information and issue credentials. In addition, Also responsible for verifying anonymous credentials and issuing short-term tickets.

[0067] (3) Service Provider

[0068] Cloud services can be provided to anonymous users. examine Check whether the submitted ticket is invalid, expired, or reused, and respond to the user request. Violation of user regulations, The ticket will be sent to Conduct identity tracking.

[0069] (4) Trustworthy Arbitration Institution

[0070] is an honest and fair arbitrator responsible for tracking malicious users. In order to improve tracking efficiency, A tracking tag is stored for each ticket generated. This prevents Abuse of tracking permissions ensures that identity tracking can only be done on Executed when a ticket is sent.

[0071] In this embodiment:

[0072] Table 1: Symbolic variables

[0073]

[0074]

[0075] In this embodiment, the system includes the following algorithms:

[0076] 1. Setup(1 λ )→PP. The algorithm is composed of Execute with security parameter 1 λ As input, generate system public parameters PP.

[0077] 2.Issuer-Keygen(PP)→(SK is ,PK is ). The algorithm is composed of Execute, taking the public parameter PP as input, and generate its public-private key pair (SK is ,PK is ).

[0078] 3. Provider-Keygen (PP) → (SK sp ,PK sp ). The algorithm is composed of Execute, taking the public parameter PP as input, and generate its public-private key pair (SK sp ,PK sp ).

[0079] 4.Arbitrator-Keygen(PP)→(SK ta ,PK ta ). The algorithm is composed of Execute, taking the public parameter PP as input, and generate its public-private key pair (SK ta ,PK ta ).

[0080] 5.User-Keygen(PP)→(SK eu ,PK eu ). The algorithm is composed of Execute, taking the public parameter pp as input, and generate its public-private key pair (SK eu ,PK eu ).

[0081] 6. Through Run the algorithm interactively. By its identity identifier ID eu , private key-public key pair (SK eu ,PK eu )and The public key PK is For input; With its private key SK is is the input. The interaction will Registered as and for Returns a string with its identity ID eu Bound anonymous credentials cred eu .

[0082] 7. Through Run the algorithm interactively. With its anonymous credentials cred eu , private key-public key pair (SK eu ,PK eu ), public key PK is ,PK ta and a collection of services is the input, where Include The identifier of the service provider to which access is sought; With its private key SK is and requested The public key set of the certificate cred is input. eu Invalid, the interaction terminates; otherwise, return The requested ticket set

[0083] 8. Ticket-Validation (Ticket-Validation sp ,SK sp ,PK is )→0 / 1. Tix sp , private key-public key pair (SK sp ,PK is ) is input. If the ticket Tix sp If it is valid, the algorithm outputs 1; otherwise, the algorithm outputs 0.

[0084] 9.Trace(Tix sp ,SK ta )→(ID eu ,PK eu ). Tix sp 、Private key SK ta The key is used as input to execute this algorithm, and the algorithm outputs the user identity ID eu With the user's public key PK eu .

[0085] In this embodiment, the system control specifically includes the following stages:

[0086] System initialization phase: During the system initialization phase, Run the Setup algorithm to generate system common parameters. During the system initialization phase, Run Setup to generate system public parameters PP, then Run Issuer-Keygen, Provider-Keygen, Arbitrator-Keygen, and User-Keygen to obtain their own private key-public key pairs. To store the received tickets, each Initialize a list At the same time, and Initialize a list to save the tracking markup.

[0087] ·Setup(1 λ )→PP.

[0088] run Generate a cyclic group of order p In selecting the generator And define collision-resistant hash function H1: H2: After that, the function outputs the common parameters

[0089] Issuer-Keygen(PP)→(SK is ,PK is ).

[0090] Select calculate Output SK is =(x1,x2,x3,x4,y),PK is =(X1,X2,Y).

[0091] Provider-Keygen (PP) → (SK sp ,PK sp ).

[0092] Select calculate And output SK sp =x sp ,

[0093] Arbitrator-Keygen (PP) → (SK ta ,PK ta ).

[0094] Random Selection And calculate Algorithm Output The private key SK ta =x ta , public key PKta =Y ta .

[0095] User-Keygen(PP)→(SK eu ,PK eu ).

[0096] Random Selection And calculate The algorithm outputs EU's private key SK eu =x eu , public key PK eu =Y eu .

[0097] User registration stage: before logging in and accessing the service, With Identity Server Run the User-Registration interaction protocol to register its identity to

[0098] ·

[0099] Should First, its public key Y eu Compute a proof and will Send to if efficient, Select And calculate Among them, (t,U,V) is a eu The bound key verifies the anonymous credential. To ensure the authenticity of the issued certificate, Generate Proof Send Proof Give and stored in the local database (ID eu ,PK eu ). After receiving (t,U,V) and back, verify To determine whether (t,U,V) is a valid anonymous credential. If the verification is successful, Output cred eu =(t,U,V).

[0100] Bill application stage: anonymously Authenticate and submit a collection for the requested service If the authentication is successful, Generate tickets for all requested services The specific interaction process is described in detail in the Ticket-Request algorithm.

[0101] ·

[0102]

[0103] Command symbol Reference A set of identifiers of the requested service providers. Select calculate then, calculate The public key that will be used to restore For each request Select a ticket identifier And calculate T sp =H2(TID sp ) r . For (C eu ,E eu ,R eu ) Generate a zero-knowledge proof and will Send to

[0104] Before issuing the notes, verify And check the equation Whether it is established to determine the validity of the user's identity. If the verification is successful, Select For all requests calculate The key pair (lk,rk) is and A one-time ticket authentication key shared between the two parties. Calculate using (lk,rk) in It is essentially an anonymous token. sp For E eu To randomize, Generate tracking mark Generate all invoices back, Hash all accepted or generated components to get Λ2=H2(C eu ,E eu ,Reu ), and use this to calculate Generate a proof for σ This proof can prevent the ticket It also ensures the freshness of the request ticket. Will Return to And send Give

[0105] Upon receipt And verify back, Let q = r -1 and recalculate for each requested service For each pair of tuples calculate And output the final note Tix sp =(TID sp ,s sp ,S sp ,W sp ,ID sp ,VP sp ,Info sp ).

[0106] Ticket verification phase: Run the Ticket-Validation algorithm on the submitted ticket Tix sp To verify;

[0107] Ticket-Validation (Ticket-Validation sp ,SK sp ,PK is )→0 / 1.

[0108] Tix sp =(TID sp ,s sp ,S sp ,W sp ,ID sp ,VP sp ,Info sp ), private key SK sp , public key PK is =(X1,X2,Y) is the input, First check the validity period VP sp Is it expired? Calculate the ticket authentication key And check whether the following conditions are met:

[0109] By TID sp The marked records are in the list does not exist in .

[0110] Equation Established.

[0111] If the verification is successful, Tix sp insert And TID sp Mark it and output 1. Otherwise, Output 0.

[0112] Malicious user tracking stage: When any suspicious user behavior is detected, The ticket submitted when sending the corresponding service request to then, Execute the Trace algorithm to de-anonymize the malicious user and output their ID eu , public key PK eu .

[0113] ·Trace(Tix sp ,SK ta )→(ID eu ,PK eu ).

[0114] Upon receipt of the Tix sp =(TID sp ,s sp ,S sp ,W sp ,ID sp ,VP sp ,Info sp )hour, Calculate TR sp,1 =H1(s sp ) and use it to retrieve the corresponding tracking tag TR sp =(TR sp,1 ,TR sp,2 ,TR sp,3 ).if There are records in calculate And send PK eu Give Since during the user registration phase Saved the entry (ID eu ,PK eu ), You can easily find the ID eu And hold people accountable.

[0115] In this embodiment, preferably, the keyed-verification anonymous credential (KVAC) includes a setup algorithm Setup, an issuer key generation algorithm Keygen and two interactive algorithms for certificate issuance and verification respectively. Unlike traditional anonymous credentials, in KVAC, the issuance and verification of certificates are performed by the certificate issuer. KVAC is defined as follows:

[0116] ·Setup(1 λ )→pp. Taking the security parameter λ as input, the algorithm outputs the system public parameter pp. In the following algorithms, pp will be used as the default public input.

[0117] Keygen(pp)→(pk,sk). This algorithm outputs a public key ipk and a private key isk for the certificate issuer.

[0118] · The certificate issuer takes the private key isk as input, and the user takes the public key ipk and attribute vector Executes this algorithm for the input. The algorithm returns an The bound user certificate cred.

[0119] · The certificate issuer uses the private key isk and the disclosure attribute As input, the user takes the certificate cred as the vector For input.

[0120] In this embodiment, preferably, a message authentication code (MAC) is a tamper detection mark, which is often used in the underlying construction of communication and authentication protocols. Compared with traditional MAC based on hash functions or block ciphers, algebraic MAC is constructed based on group operations and can be used to prove knowledge or relationships of message blocks. In the present invention, the algebraic MAC of message m is calculated as Where U is the group The random element in (x0,x1) is A key randomly selected from .

[0121] In this embodiment, preferably, the anonymous token is a lightweight interactive protocol that provides fast anonymous authentication. Unlike anonymous credentials, anonymous tokens are one-time and need to be re-applied after each identity verification. The anonymous token scheme consists of the following PPT algorithm:

[0122] KeyGen(1 λ)→(pp,sk). Taking the security parameter λ as input, the algorithm outputs the system public parameter pp and the private key sk.

[0123] · The token issuer takes the private key sk as input, and the token acquirer takes the random number t∈{0,1} λ Execute this algorithm for the input. Where t can be regarded as the identifier of the acquired token. The algorithm outputs a token tok for the acquirer, but at the same time prevents the token issuer from knowing tok and t.

[0124] TokVerify(sk, t, tok) → 0 / 1. The algorithm takes the private key sk, the token tok and the token identifier t as input. If the token is valid, the algorithm outputs 1; otherwise, the algorithm outputs 0.

[0125] In this embodiment, preferably, zero-knowledge proof (ZKP) allows the prover to prove to the verifier that he understands the knowledge in a given statement without revealing the knowledge itself. In this embodiment, ZKP is used to prove the knowledge of discrete logarithms, where for the statement h=g x The proof can be expressed as DLPoK{(x):h=g x}. In addition, the symbol Can be used for proof of knowledge equality, that is, the verifier not only proves the knowledge x he knows, but also proves the statement and The present invention instantiates the involved proofs using the Schnorr protocol and uses the Fiat-Shamir heuristic for non-interactive transformation.

[0126] The above description is only a preferred embodiment of the present invention. All equivalent changes and modifications made according to the scope of the patent application of the present invention should fall within the scope of the present invention.

Claims

1. An efficient anonymous single sign-on system based on key authentication credentials, characterized in that: Including end users Identity Server Service Providers and credible arbitration institutions Said Towards Register, obtain long-term credentials bound to your identity, and before requesting services, Use your own credentials to anonymously Certified and obtained Short-term notes issued; Said Manage user identities, save registered user identity information and issue credentials, and be responsible for verifying anonymous credentials and issuing short-term tickets; Said Whether the submitted ticket is invalid, expired, or reused, and respond to the user request. If Violation of user regulations, The ticket will be sent to Conduct identity tracking; Said Responsible for tracking down malicious users.

2. The efficient anonymous single sign-on system based on key authentication credentials according to claim 1 is characterized in that: Said A tracking tag is stored for each ticket generated.

3. The control method of the efficient anonymous single sign-on system based on key authentication credentials according to claim 1 or 2, characterized in that: The following phases are included: System initialization phase: With safety parameter 1 λ As input, generate system public parameters PP; then Run Issuer-Keygen, Provider-Keygen, Arbitrator-Keygen, and User-Keygen to obtain their own private key-public key pairs; and each Initialize a list At the same time, and Initialize a list to save tracking marks; User registration stage: before logging in and accessing the service, With Identity Server Run the User-Registration interaction protocol to register its identity to Bill application stage: anonymously Authenticate and submit a collection for the requested service If the authentication is successful, Generate tickets for all requested services Ticket verification phase: Run the Ticket-Validation algorithm on the submitted ticket Tix sp To verify; Malicious user tracking stage: When any suspicious user behavior is detected, The ticket submitted when sending the corresponding service request to then, Execute the Trace algorithm to de-anonymize the malicious user and output their ID eu , public key PK eu .

4. The control method of the efficient anonymous single sign-on system based on key authentication credentials according to claim 3 is characterized in that: The system initialization phase is specifically as follows: run Generate a cyclic group of order p In selecting the generator {g i } i∈[0,4] , And define collision-resistant hash function H1: H2: After that, the function outputs the common parameters Select {x i } i∈[1,4] , calculate Output The private key SK is =(x1,x2,x3,x4,y), public key PK is =(X1,X2,Y); SP Selection calculate And output The private key SK sp =x sp , public key Random Selection And calculate Output The private key SK ta =x ta , Public Key PK ta =Y ta ; Random Selection And calculate Output The private key SK eu =x eu , public key PK eu =Y eu 。 5. The control method of the efficient anonymous single sign-on system based on key authentication credentials according to claim 3 is characterized in that: The User-Registration interaction protocol is specifically: First, its public key Y eu Compute a proof and will Send to if efficient, Select And calculate Among them, (t,U,V) is a pair with attribute x eu The bound key verifies the anonymous credential; to ensure the authenticity of the issued certificate, Generate Proof Send Proof Give and stored in the local database (ID eu ,PK eu ); After receiving (t,U,V) and back, verify To determine whether (t, U, V) is a legitimate anonymous credential; if the verification is successful, Output cred eu =(t,U,V).

6. The control method of the efficient anonymous single sign-on system based on key authentication credentials according to claim 3 is characterized in that: The bill application stage is specifically as follows: Command symbol Reference a set of identifiers of the requested service providers; Select calculate then, calculate It will be used to restore The public key For each request Select a ticket identifier And calculate T sp =H2(TID sp ) r ; For (C eu ,E eu ,R eu ); Generate a zero-knowledge proof and will Send to Before issuing the notes, verify And check the equation Is it established to determine the validity of the user's identity; if the verification is successful, Select For all requests calculate The key pair (lk,rk) is and A one-time ticket authentication key shared between the two parties; Calculate using (lk,rk) in Essentially an anonymous token; by leveraging s sp For E eu To randomize, Generate tracking mark Generate all invoices back, Hash all accepted or generated components to get Λ2=H2(C eu ,E eu ,R eu ), and use this to calculate Generate a proof for σ at last, Will Return to And send Give Upon receipt And verify back, Let q = r -1 and recalculate for each requested service For each pair of tuples calculate And output the final note Tix sp =(TID sp ,s sp ,S sp ,W sp ,ID sp ,VP sp ,Info sp ).

7. The control method of the efficient anonymous single sign-on system based on key authentication credentials according to claim 3, characterized in that: The Ticket-Validation algorithm is specifically: Tix sp =(TID sp ,s sp ,S sp ,W sp ,ID sp ,VP sp ,Info sp ), private key SK sp , public key PK is =(X1,X2,Y) is the input, First check the validity period VP sp Whether it is expired; then, Calculate the ticket authentication key And check whether the following conditions are met: (1) By TID sp The marked records are in the list does not exist in; (2) Equation Established; If the verification is successful, Tix sp insert And TID sp Mark it and output 1; otherwise, Output 0.

8. The control method of the efficient anonymous single sign-on system based on key authentication credentials according to claim 3 is characterized in that: The algorithm Trace is specifically: Upon receipt of the Tix sp =(TID sp ,s sp ,S sp ,W sp ,ID sp ,VP sp ,Info sp )hour, Calculate TR sp,1 =H1(s sp ) and use it to retrieve the corresponding tracking tag TR sp =(TR sp,1 ,TR sp,2 ,TR sp,3 );if There are records in calculate And send PK eu Give Since during the user registration phase Saved the entry (ID eu ,PK eu ), You can easily find the ID eu And hold people accountable.

9. The control method of the efficient anonymous single sign-on system based on key authentication credentials according to claim 4, characterized in that: The anti-collision hash function H1: With H2: Conduct with group Related calculations and meet the following settings: make is a cyclic group with output order p The group generator of a ,B=g b ,C=g c ), the DDH assumption requires that the adversary The element C = g ab With random elements The probability of distinguishing is negligible, that is If the opponent Advantages can be ignored, then we believe that the DDH hypothesis is established; CTGDH allows the execution of CDH queries and DDH queries. is a cyclic group of order p, given a challenge (g, A = g a ) and 3 fable machine queries: (1) Translate the string t∈{0,1} * Encoded as element B; (2) Take element B as input, output C = B a ; (3) Take the tuple (B, C) as input, if C = B a , output 1; a permission to access the parable machine Rival Generate meet the conditions And not in the fable machine Query B * The tuple (t * ,C * =(B * ) a ) is negligible; The advantage function is defined as Given (g, A = g a ,B=g b ) and a parable machine Any As input, randomly selected Output T = (h, h a+mb ); LRSW assumption requires that, in the adversary Possess access to the Fable Machine At the same time as the permission, output a * The ancestor The probability of is negligible; the adversary’s advantage function is defined as

Images