A distributed, verifiable, revocable, and scalable credential management method and system
By using a hierarchical tree-structured RSA accumulator, the traditional RSA accumulator is improved into a multi-level group management system, which solves the problem of high computational resources in the traditional RSA accumulator and enables flexible expansion and efficient management of large-scale voucher services.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- METERTEK TECH INC
- Filing Date
- 2023-03-07
- Publication Date
- 2026-04-21
AI Technical Summary
Traditional RSA accumulators have high computational resource requirements in large-scale voucher management, which limits the expansion of business scale.
The grouped hierarchical tree-structured RSA accumulator is adopted to divide members into multi-level groups and manage them through source computing services and root computing services, including the process of adding, revoking and verifying members.
It reduces the demand for single-point computing resources, enables flexible expansion of service capabilities, and improves the computing efficiency and verification speed of verifiable credential services.
Smart Images
Figure CN116204907B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of distributed identity and accumulator technology, specifically relating to a distributed, verifiable, revocable, and scalable credential management method and system. Background Technology
[0002] In the ecosystem of distributed identity, there are generally three roles surrounding verifiable credentials: issuer, verifier, and holder. The relationship between these three roles and verifiable credentials is as follows: Figure 1 As shown, where,
[0003] Issuer: The entity responsible for generating and issuing verifiable credentials. Verifier: The entity responsible for verifying verifiable credentials; it must be able to verify the authenticity and validity of the credentials. Holder: The entity that needs to obtain verifiable credentials; it can apply for verifiable credentials from the issuer and submit them to the verifier for verification.
[0004] The traditional method for verifying verifiable credentials is to use an RSA accumulator. The RSA accumulator technique is a cryptographic technique that uses an RSA encryption scheme based on the difficulty of factoring large prime numbers, allowing for efficient and secure proof of the existence of members in a set.
[0005] like Figure 2 The diagram shown illustrates the structure of existing RSA accumulator technology. Applying RSA accumulator technology to verifiable validity management services involves three elements:
[0006] Set members: Represent verifiable identifiers of a credential, typically large prime numbers. All members constitute the member set;
[0007] Existence evidence: The RSA accumulator is used to calculate the evidence used to verify that a member belongs to the set. There is one existence evidence for each member.
[0008] RSA accumulator root A: The root result calculated using the RSA accumulator technique based on the overall membership set, representing a set.
[0009] Verifiable credential validity management services using RSA accumulator technology need to provide the following functionalities:
[0010] Add a member: Add a member to the set, update the RSA accumulator root, generate evidence of the member's existence, and update the existence evidence of other members.
[0011] Deleting a member: Removes a member from the set, updates the RSA accumulator root, and updates the existence evidence for the other members.
[0012] Member verification: Based on the provided member value and existence evidence, verify whether the member exists in the set.
[0013] When using Figure 2 When considering the original RSA accumulator structure, it's clear from the functional requirements of an RSA accumulator that any change to a member (addition or deletion) will cause the recalculation of the existence evidence for other members and the recalculation of the accumulator root. As the set size increases, each member change triggers large-scale computations. Furthermore, the computation process of the RSA accumulator shows that its basic calculations involve exponential multiplication of large prime numbers, placing high demands on computational resources.
[0014] In summary, the revocable credential verification scheme implemented using RSA accumulators places extremely high demands on the issuer's computational capabilities, thus limiting the scale of business that can be supported. Summary of the Invention
[0015] To address the shortcomings of existing technologies, this invention provides a distributed, verifiable, revocable, and scalable credential management method and system, which can effectively solve the aforementioned problems.
[0016] The technical solution adopted in this invention is as follows:
[0017] This invention provides a distributed, verifiable, revocable, and scalable credential management method, comprising the following steps:
[0018] Step 1: The issuer uses a grouped hierarchical tree-structured RSA accumulator to maintain and manage verifiable credentials;
[0019] The grouped hierarchical tree-structured RSA accumulator has n+1 levels, arranged sequentially from the leaf node to the root node as: Level_0, Level_1, ..., Level_n. Its specific structure is as follows:
[0020] Level 0 members are stored in groups, and any Level 0 member s i Has member value x i Evidence of member existence w i The member value x i This serves as a verifiable credential identifier; all members at Level 0 are divided into multiple groups.
[0021] Level 1 uses a grouped storage method to store multiple Level 1 members. Each Level 1 member corresponds to a Level 0 group. The member value of a Level 1 member is the temporary root of the RSA accumulator of the member values of all members in its corresponding Level 0 group. All members of Level 1 are divided into multiple groups.
[0022] Level 2 uses a grouping format to store multiple Level 2 members. Any Level 2 member corresponds to a Level 1 group. The member value of a Level 2 member is the temporary root of the RSA accumulator of the member values of all members in its corresponding Level 1 group.
[0023] And so on
[0024] Level_n is the root node, which has only one Level_n member. Its member value is the final root of the RSA accumulator of the member values of all members in the corresponding Level_n-1 group.
[0025] Step 2: The service center registers and publishes the source computing service and root computing service corresponding to the grouped hierarchical tree-shaped RSA accumulator structure through the entry service;
[0026] in:
[0027] Each member at Level_1 registers and publishes a source computing service to manage members within the Group at Level_0.
[0028] For each member at Level_2, ..., Level_n, a root computing service is registered and published to manage the members within its subordinate group.
[0029] Step 2: Manage verifiable credentials through source computing services and root computing services.
[0030] Preferably, in step 2, verifiable credentials are managed, including the processes of adding, revoking, and verifying verifiable credentials.
[0031] The preferred method for adding verifiable credentials is as follows:
[0032] Step 3.1: When the entry service receives a verifiable credential request from the client, the entry service searches for the currently available source computing service from among the various source computing services and sends the verifiable credential request to the found source computing service.
[0033] Step 3.2, assuming that the member value of the Level_1 member currently managed by the source computing service is the temporary root A1 of the Level 1 RSA accumulator, and the corresponding Level_0 group has p Level_0 members s1, s2, ..., s p This forms a member set S = (s1, s2, ..., s...). P ), members s1, s2, ..., sp The member values are: x1, x2, ..., x p ;
[0034] The source computing service generates random large prime numbers. The length of these random large prime numbers is determined by a bit length algorithm based on grouping information, ensuring that different groups have different bit lengths. Then, it is determined whether the random large prime number exists in the member values x1, x2, ..., x. p If yes, then regenerate a random large prime number; otherwise, proceed to step 3.3.
[0035] Step 3.3, the source computing service directs the computation to the member set S = (s1, s2, ..., s...). P Add the (p+1)th member s) p+1 Thus, the updated member set S = (s1, s2, ..., s...) is obtained. P ,s P+1 Furthermore, the newly added (p+1)th member s p+1 Member value x p+1 The random large prime number;
[0036] Step 3.4: Generate the (p+1)th member s according to the following formula. p+1 Evidence of the existence of members w p+1 :
[0037]
[0038] in:
[0039] g: a prime number, used as a base;
[0040] N: Modulus;
[0041] mod: Modulo operator;
[0042] Π: Multiplication symbol;
[0043] Step 3.5, update the temporary root A1 of the first-level RSA accumulator using the following formula:
[0044]
[0045] Where: A"1 is the updated temporary root of the Level 1 RSA accumulator;
[0046] Step 3.6, update members s1, s2, ..., s p The evidence of member existence is updated using the following method:
[0047] For members s1, s2, ..., s p Any member s in iWhere i = 1, 2, ..., p, and its updated membership evidence w i "for:
[0048]
[0049] This completes the process of adding verifiable credentials.
[0050] The preferred method for revoking verifiable vouchers is as follows:
[0051] Step 4.1, the entry service receives a verifiable credential revocation request from the client. The verifiable credential revocation request carries the member name, member value and the group of the verifiable credential at level 0 to be revoked.
[0052] Step 4.2: The entry service finds and starts the corresponding source computing service based on its Level_0 group.
[0053] Step 4.3, assuming the member name of the verifiable credential for which revocation is requested is s j Member value is x j The set of members it belongs to is S = (s1, s2, ..., s P ); where j = 1, 2, ..., p;
[0054] The source computing service, from the member set S = (s1, s2, ..., s... P ) Remove member s j This yields a new set of members, S".
[0055] The source computing service calculates a new RSA accumulator temporary root based on the member values of each member in the new member set S", and updates the original RSA accumulator temporary root using the new RSA accumulator temporary root.
[0056] The source computing service calculates the membership existence evidence for each member in the new member set S" and updates the original membership existence evidence.
[0057] Preferably, each root calculation service is started according to a certain strategy. Each root calculation service reads the latest RSA accumulator temporary root of its subordinate members and calculates the new RSA accumulator temporary root corresponding to its own level. The original RSA accumulator temporary root of its own level is updated by using the new RSA accumulator temporary root of its own level. In this way, the RSA accumulator temporary roots of each level are updated to ensure effectiveness.
[0058] Preferred verifiable credential verification method is as follows:
[0059] Step 5.1: The verifier obtains the member name, member value, member existence evidence, member group, and verification mode of the Level 0 member to be verified, and calls the member verification service; wherein, the verification mode includes two types, namely fast verification mode and full verification mode;
[0060] Step 5.2, the verifier calls the member verification service;
[0061] Step 5.3: The member verification service performs the member verification process according to the latest group hierarchical tree RSA accumulator structure, that is: verifying whether the member name, member value, member existence evidence, and the group to which the member belongs match the group hierarchical tree RSA accumulator structure. If they match, proceed to step 5.4; otherwise, the verification fails.
[0062] Step 5.4: Determine if the current mode is quick verification. If yes, return the verification result and end the process; otherwise, it is full verification mode, and proceed to step 5.5.
[0063] Step 5.5: Execute the verification process of the temporary root of the RSA accumulator step by step upwards until the final root of the RSA accumulator is reached, and return the final verification result.
[0064] This invention also provides a system for a distributed, verifiable, revocable, and scalable credential management method, comprising:
[0065] The grouped hierarchical tree-structured RSA accumulator structure has n+1 levels, arranged sequentially from the leaf node to the root node as: Level_0, Level_1, ..., Level_n. Its specific structure is as follows:
[0066] Level 0 members are stored in groups, and any Level 0 member s i Has member value x i Evidence of member existence w i The member value x i This serves as a verifiable credential identifier; all members at Level 0 are divided into multiple groups.
[0067] Level 1 uses a grouped storage method to store multiple Level 1 members. Each Level 1 member corresponds to a Level 0 group. The member value of a Level 1 member is the temporary root of the RSA accumulator of the member values of all members in its corresponding Level 0 group. All members of Level 1 are divided into multiple groups.
[0068] Level 2 uses a grouping format to store multiple Level 2 members. Any Level 2 member corresponds to a Level 1 group. The member value of a Level 2 member is the temporary root of the RSA accumulator of the member values of all members in its corresponding Level 1 group.
[0069] And so on
[0070] Level_n is the root node, which has only one Level_n member. Its member value is the final root of the RSA accumulator of the member values of all members in the corresponding Level_n-1 group.
[0071] The service center registers and publishes source computing services and root computing services corresponding to the grouped hierarchical tree-shaped RSA accumulator structure through the entry service;
[0072] in:
[0073] Each member at Level_1 registers and publishes a source computing service to manage members within the Group at Level_0.
[0074] For each member at Level_2, ..., Level_n, a root computing service is registered and published to manage the members within its subordinate group.
[0075] Verifiable credentials are managed through source computing services and root computing services.
[0076] The distributed, verifiable, revocable, and scalable credential management method and system provided by this invention have the following advantages:
[0077] This invention provides a distributed, verifiable, revocable, and scalable credential management method and system. It extends the application of traditional RSA accumulators by designing a grouped, hierarchical, tree-shaped RSA accumulator structure. This breaks down large-scale credential services into smaller parts, reducing single-point computing resources while enabling flexible expansion of service capabilities, thus facilitating the large-scale application of verifiable credential services. Attached Figure Description
[0078] Figure 1 An architecture diagram of distributed verifiable credentials provided by existing technologies;
[0079] Figure 2 A schematic diagram of the original RSA accumulator structure provided for existing technology;
[0080] Figure 3This is a schematic diagram of the grouped hierarchical RSA accumulator structure provided by the present invention;
[0081] Figure 4 The service startup / expansion flowchart provided by this invention;
[0082] Figure 5 A flowchart for adding members provided by this invention;
[0083] Figure 6 A flowchart for member existence verification provided for this invention. Detailed Implementation
[0084] To make the technical problems solved, the technical solutions, and the beneficial effects of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the invention.
[0085] This invention provides a distributed, verifiable, revocable, and scalable credential management method and system. It extends the application of traditional RSA accumulators by designing a grouped, hierarchical, tree-shaped RSA accumulator structure. This breaks down large-scale credential services into smaller parts, reducing single-point computing resources while enabling flexible expansion of service capabilities, thus facilitating the large-scale application of verifiable credential services.
[0086] This invention provides a distributed, verifiable, revocable, and scalable credential management method, comprising the following steps:
[0087] Step 1: The issuer uses a grouped hierarchical tree-structured RSA accumulator to maintain and manage verifiable credentials;
[0088] The grouped hierarchical tree-structured RSA accumulator has n+1 levels, arranged sequentially from the leaf node to the root node as: Level_0, Level_1, ..., Level_n. Its specific structure is as follows:
[0089] Level 0 members are stored in groups, and any Level 0 member s i Has member value x i Evidence of member existence w i The member value x i This serves as a verifiable credential identifier; all members at Level 0 are divided into multiple groups.
[0090] Level 1 uses a grouped storage method to store multiple Level 1 members. Each Level 1 member corresponds to a Level 0 group. The member value of a Level 1 member is the temporary root of the RSA accumulator of the member values of all members in its corresponding Level 0 group. All members of Level 1 are divided into multiple groups.
[0091] Level 2 uses a grouping format to store multiple Level 2 members. Any Level 2 member corresponds to a Level 1 group. The member value of a Level 2 member is the temporary root of the RSA accumulator of the member values of all members in its corresponding Level 1 group.
[0092] And so on
[0093] Level_n is the root node, which has only one Level_n member. Its member value is the final root of the RSA accumulator of the member values of all members in the corresponding Level_n-1 group.
[0094] Step 2: The service center registers and publishes the source computing service and root computing service corresponding to the grouped hierarchical tree-shaped RSA accumulator structure through the entry service;
[0095] in:
[0096] Each member at Level_1 registers and publishes a source computing service to manage members within the Group at Level_0.
[0097] For each member at Level_2, ..., Level_n, a root computing service is registered and published to manage the members within its subordinate group.
[0098] Step 2: Manage verifiable credentials through source computing services and root computing services.
[0099] Step 2 involves managing verifiable credentials, including adding, revoking, and verifying them.
[0100] The method for adding verifiable credentials is as follows:
[0101] Step 3.1: When the entry service receives a verifiable credential request from the client, the entry service searches for the currently available source computing service from among the various source computing services and sends the verifiable credential request to the found source computing service.
[0102] Step 3.2, assuming that the member value of the Level_1 member currently managed by the source computing service is the temporary root A1 of the Level 1 RSA accumulator, and the corresponding Level_0 group has p Level_0 members s1, s2, ..., s p This forms a member set S = (s1, s2, ..., s...). P ), members s1, s2, ..., s p The member values are: x1, x2, ..., x p ;
[0103] The source computing service generates random large prime numbers. The length of the random large prime numbers is determined by a bit length algorithm based on grouping information to ensure that different groups have different bit lengths. The bit length algorithm based on grouping information is abbreviated as the {BASE+Group} algorithm.
[0104] Then determine whether the random large prime number exists in the member values x1, x2, ..., x. p If yes, then regenerate a random large prime number; otherwise, proceed to step 3.3.
[0105] Step 3.3, the source computing service directs the computation to the member set S = (s1, s2, ..., s...). P Add the (p+1)th member s) p+1 Thus, the updated member set S = (s1, s2, ..., s...) is obtained. P ,s P+1 Furthermore, the newly added (p+1)th member s p+1 Member value x p+1 The random large prime number;
[0106] Step 3.4: Generate the (p+1)th member s according to the following formula. p+1 Evidence of the existence of members w p+1 :
[0107]
[0108] in:
[0109] g: a prime number, used as a base;
[0110] N: Modulus;
[0111] mod: Modulo operator;
[0112] Π: Multiplication symbol;
[0113] Step 3.5, update the temporary root A1 of the first-level RSA accumulator using the following formula:
[0114]
[0115] Where: A"1 is the updated temporary root of the Level 1 RSA accumulator;
[0116] Step 3.6, update members s1, s2, ..., s p The evidence of member existence is updated using the following method:
[0117] For members s1, s2, ..., s p Any member s in i Where i = 1, 2, ..., p, and its updated membership evidence w i "for:
[0118]
[0119] This completes the process of adding verifiable credentials.
[0120] The verifiable method for revoking a certificate is as follows:
[0121] Step 4.1, the entry service receives a verifiable credential revocation request from the client. The verifiable credential revocation request carries the member name, member value and the group of the verifiable credential at level 0 to be revoked.
[0122] Step 4.2: The entry service finds and starts the corresponding source computing service based on its Level_0 group.
[0123] Step 4.3, assuming the member name of the verifiable credential for which revocation is requested is s j Member value is x j The set of members it belongs to is S = (s1, s2, ..., s P ); where j = 1, 2, ..., p;
[0124] The source computing service, from the member set S = (s1, s2, ..., s... P ) Remove member s j This yields a new set of members, S".
[0125] The source computing service calculates a new RSA accumulator temporary root based on the member values of each member in the new member set S", and updates the original RSA accumulator temporary root using the new RSA accumulator temporary root.
[0126] The source computing service calculates the membership existence evidence for each member in the new member set S" and updates the original membership existence evidence.
[0127] The function of the root calculation service is as follows: each root calculation service is started according to a certain strategy. Each root calculation service reads the latest RSA accumulator temporary root of its subordinate members, calculates the new RSA accumulator temporary root corresponding to its own level, and updates the original RSA accumulator temporary root of its own level using the new RSA accumulator temporary root of its own level. In this way, the temporary roots of RSA accumulators at all levels are updated to ensure their effectiveness.
[0128] The verification method for verifiable credentials is as follows:
[0129] Step 5.1: The verifier obtains the member name, member value, member existence evidence, member group, and verification mode of the Level 0 member to be verified, and calls the member verification service; wherein, the verification mode includes two types, namely fast verification mode and full verification mode;
[0130] Step 5.2, the verifier calls the member verification service;
[0131] Step 5.3: The member verification service performs the member verification process according to the latest group hierarchical tree RSA accumulator structure, that is: verifying whether the member name, member value, member existence evidence, and the group to which the member belongs match the group hierarchical tree RSA accumulator structure. If they match, proceed to step 5.4; otherwise, the verification fails.
[0132] Step 5.4: Determine if the current mode is quick verification. If yes, return the verification result and end the process; otherwise, it is full verification mode, and proceed to step 5.5.
[0133] Step 5.5: Execute the verification process of the temporary root of the RSA accumulator step by step upwards until the final root of the RSA accumulator is reached, and return the final verification result.
[0134] The following is a specific example:
[0135] The present invention provides Figure 3 In the grouped hierarchical tree-structured RSA accumulator structure shown, each member has the following attributes:
[0136] Value: Member value, which is the verifiable credential identifier of the member; for Level 0 members, this item uses a random large prime number of length {BASE+Group}; for Level 1 to Level _n-1 members, this item is the temporary root of the RSA accumulator of the member value of the lower level member; for Level _n members, this item is the root of the RSA accumulator of the member value of the lower level member.
[0137] Level: The level to which a member belongs. Members belonging to the same group within the same level constitute an RSA accumulator member set. Level_0 indicates the level to which the verifiable credential identifier belongs.
[0138] Group: Grouping, members at each level are distributed into different groups.
[0139] MemberGroup: The group to which the member belongs (this field is empty for Level 0 members).
[0140] Witness: Evidence of a member's existence within the current group.
[0141] exist Figure 3 In the RSA accumulator system, the lowest level, Level 0, contains the original set of members, which can be used to verify credential identifiers. These members are grouped into different groups, and the RSA accumulator is calculated on a group-by-group basis. The temporary root of the group's RSA accumulator is used as the parent member, and at the same time, evidence of the member's existence within the group is obtained.
[0142] The verifiable credential validity service based on the grouped hierarchical RSA accumulator is divided into two types: source calculation service and root calculation service.
[0143] The source calculation service is used for Level 1 members and manages the original verifiable credential identifiers (i.e., Level 0 members) within a group. Its basic functions include: member addition, member deletion, and member verification. It also includes an interface that provides the root value of the current group's RSA accumulator.
[0144] The root calculation service, used for members at Level 1 and above, manages lower-level members within a group. Its functions include member verification, member updates, and providing an interface for the RSA accumulator root value within the group. The member update function periodically accesses the RSA accumulator root value interface of its subordinate members to obtain the latest value, and then updates the RSA accumulator root of the set and the existence evidence of each member.
[0145] Service configuration:
[0146] Level: The service level; service Level > 0.
[0147] MemberGroup: The group to which the subordinate members belong. MemberGroup cannot be duplicated within the same level.
[0148] ServiceEndpoint: Service access address.
[0149] Service startup / expansion process, such as Figure 4 As shown:
[0150] During the service startup process, the service registers with the service center using the configured service level and grouping information, publishes service information, and provides external services. As the system scales up, only new services need to be registered, dynamically expanding the verifiable credential service capabilities.
[0151] Member addition process:
[0152] 1) Receive user requests and search for available source computing services through the service registry;
[0153] 2) Call the member addition function of the source computing service;
[0154] 3) The member addition function uses the MemberGroup configured in the service as the member's Group, calls the prime number generation function GenPrime(), uses {BASE+Group} as the prime number length, and generates the member's verifiable identifier Value.
[0155] 4) Perform a duplicate check on Value within the group. If the same value exists, repeat the GenPirme process until a verifiable credential identifier Value that does not exist in the group is generated.
[0156] 5) Use existing RSA root values within the group as evidence of the existence of new members;
[0157] 6) Update the RSA accumulator root within the group based on the new verifiable credential identifier Value;
[0158] 7) Update the evidence of the existence of existing members within the group;
[0159] Member verification process, such as Figure 6 As shown:
[0160] 1) Use member value, group, existence evidence witness, and verification mode (fast verification, full verification) as input parameters to call the member verification service;
[0161] 2) Locate the corresponding service based on the Group, perform member verification, and obtain the verification result;
[0162] 3) If it is quick verification mode, return the verification result directly;
[0163] 4) If it is a strong security verification mode, the existence verification is performed step by step upwards until the root of the final RSA accumulator is reached, and the final verification result is returned.
[0164] Therefore, the distributed, verifiable, revocable, and scalable credential management method and system provided by this invention have the following characteristics:
[0165] 1) Improve the traditional single-level RSA accumulator structure to a multi-level structure, and group the set members so that each level and group can be managed independently;
[0166] 2) After the RSA accumulator is graded, the data size within each group is reduced, and the computation threshold is lowered;
[0167] 3) After hierarchical grouping, each group can publish a temporary root for the data within the group to provide real-time verification services, while the root of the overall set of data can be updated with a delay.
[0168] 4) A prime number generation method based on bit depth is used to group prime numbers and apply it to a grouped RSA accumulator;
[0169] 5) Apply the improved RSA accumulator to verifiable credential technology for large-scale distributed identity.
[0170] This invention also provides a system for a distributed, verifiable, revocable, and scalable credential management method, comprising:
[0171] The grouped hierarchical tree-structured RSA accumulator structure has n+1 levels, arranged sequentially from the leaf node to the root node as: Level_0, Level_1, ..., Level_n. Its specific structure is as follows:
[0172] Level 0 members are stored in groups, and any Level 0 member s i Has member value x i Evidence of member existence w i The member value x i This serves as a verifiable credential identifier; all members at Level 0 are divided into multiple groups.
[0173] Level 1 uses a grouped storage method to store multiple Level 1 members. Each Level 1 member corresponds to a Level 0 group. The member value of a Level 1 member is the temporary root of the RSA accumulator of the member values of all members in its corresponding Level 0 group. All members of Level 1 are divided into multiple groups.
[0174] Level 2 uses a grouping format to store multiple Level 2 members. Any Level 2 member corresponds to a Level 1 group. The member value of a Level 2 member is the temporary root of the RSA accumulator of the member values of all members in its corresponding Level 1 group.
[0175] And so on
[0176] Level_n is the root node, which has only one Level_n member. Its member value is the final root of the RSA accumulator of the member values of all members in the corresponding Level_n-1 group.
[0177] The service center registers and publishes source computing services and root computing services corresponding to the grouped hierarchical tree-shaped RSA accumulator structure through the entry service;
[0178] in:
[0179] Each member at Level_1 registers and publishes a source computing service to manage members within the Group at Level_0.
[0180] For each member at Level_2, ..., Level_n, a root computing service is registered and published to manage the members within its subordinate group.
[0181] Verifiable credentials are managed through source computing services and root computing services.
[0182] The distributed, verifiable, revocable, and scalable credential management method and system provided by this invention have the following advantages:
[0183] 1) By using grouping technology, the data size within a group is reduced, the computational load of the RSA accumulator is reduced, the computational threshold is lowered, the computational efficiency is improved, and the update and verification speed is faster.
[0184] 2) By combining grouping with hierarchical management methods, distributed data management is achieved, which facilitates the scalability expansion of verifiable credential services;
[0185] 3) By publishing temporary roots within the group, timely responses to data changes within the group can be achieved, while delayed collection from the parent root ensures the verifiability of the complete dataset. The combination of these two methods improves the efficiency of computer verification of credentials and guarantees service reliability. Furthermore, the computational requirements for submitting the final root data are extremely low.
[0186] 4) By using a prime number generation method based on the number of bits, the amount of deduplication calculation is reduced, the generation efficiency of grouped prime numbers is improved, and thus the calculation speed of the RSA accumulator is increased;
[0187] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.
Claims
1. A distributed, verifiable, revocable, and scalable credential management method, characterized in that, Includes the following steps: Step 1: The issuer uses a grouped hierarchical tree-structured RSA accumulator to maintain and manage verifiable credentials; The grouped hierarchical tree-structured RSA accumulator has n+1 levels, arranged sequentially from the leaf node to the root node as: Level_0, Level_1, ..., Level_n. Its specific structure is as follows: Level 0 stores multiple Level 0 members in a grouped manner, and any Level 0 member... Has member values Evidence of the existence of members The member value This serves as a verifiable credential identifier; all members at Level 0 are divided into multiple groups. Level 1 uses a grouped storage method to store multiple Level 1 members. Each Level 1 member corresponds to a Level 0 group. The member value of a Level 1 member is the temporary root of the RSA accumulator of the member values of all members in its corresponding Level 0 group. All members of Level 1 are divided into multiple groups. Level 2 uses a grouping format to store multiple Level 2 members. Any Level 2 member corresponds to a Level 1 group. The member value of a Level 2 member is the temporary root of the RSA accumulator of the member values of all members in its corresponding Level 1 group. And so on Level_n is the root node, which has only one Level_n member. Its member value is the final root of the RSA accumulator of the member values of all members in the corresponding Level_n-1 group. Step 2: The service center registers and publishes the source computing service and root computing service corresponding to the grouped hierarchical tree-shaped RSA accumulator structure through the entry service; in: Each member at Level_1 registers and publishes a source computing service to manage members within the Level_0 group. For each member at Level_2, ..., Level_n, a root computing service is registered and published to manage the members within its subordinate group. Step 3: Manage verifiable credentials through source computing services and root computing services, including adding, revoking and verifying verifiable credentials.
2. The distributed, verifiable, revocable, and scalable credential management method according to claim 1, characterized in that, The method for adding verifiable credentials is as follows: Step 3.1: When the entry service receives a verifiable credential request from the client, the entry service searches for the currently available source computing services from among the various source computing services and sends a verifiable credential request to the found source computing service. Step 3.2, assuming the member value of the Level_1 member currently managed by the source computing service is the temporary root of the Level 1 RSA accumulator. The corresponding Level 0 group (Group) has p Level 0 members. , forming a member set ,member The member values are as follows: ; The source computing service generates a random large prime number. The length of the random large prime number is determined by a bit length algorithm based on grouping information, ensuring that different groups have different bit lengths. Then, it is determined whether the random large prime number exists in the member value. If yes, then regenerate a random large prime number; otherwise, proceed to step 3.
3. Step 3.3, the source computing service, to the member set Add the first Members This yields the updated member set. Furthermore, the newly added first Members member values The random large prime number; Step 3.4, generate the first according to the following formula. Members Evidence of the existence of members : ； in: g: a prime number, used as a base; Modulus; Modulo operator; : Multiplication symbol; Step 3.5, update the temporary root of the first-level RSA accumulator using the following formula. : ； in: This is the temporary root for the updated Level 1 RSA accumulator; Step 3.6, Update Members The evidence of member existence is updated using the following method: For members any member ,in, Its updated evidence of membership for: ； This completes the process of adding verifiable credentials.
3. The distributed, verifiable, revocable, and scalable credential management method according to claim 1, characterized in that, The verifiable method for revoking a certificate is as follows: Step 4.1, the entry service receives a verifiable credential revocation request from the client. The verifiable credential revocation request carries the member name, member value and the group of the verifiable credential at Level 0 that is to be revoked. Step 4.2: The entry service finds and starts the corresponding source computing service based on its Level_0 group. Step 4.3, assuming the member name of the verifiable credential for which revocation is requested is... Member value The set of members to which it belongs is ;in, ; The source computing service, from the member set Delete member A new set of members is obtained. ; The source computing service, based on the new member set The member values of each member in the RSA accumulator are used to calculate the new temporary root of the RSA accumulator, and the original temporary root of the RSA accumulator is updated using the new temporary root of the RSA accumulator. The source computing service calculates a new set of members. Each member's existence evidence is used to update the original member's existence evidence.
4. The distributed, verifiable, revocable, and scalable credential management method according to claim 1, characterized in that, Each root calculation service is started according to a certain strategy. Each root calculation service reads the latest RSA accumulator temporary root of its subordinate members and calculates the new RSA accumulator temporary root corresponding to its own level. The original RSA accumulator temporary root of its own level is updated by using the new RSA accumulator temporary root of its own level. In this way, the temporary roots of RSA accumulators at all levels are updated to ensure effectiveness.
5. The distributed, verifiable, revocable, and scalable credential management method according to claim 1, characterized in that, The verification method for verifiable credentials is as follows: Step 5.1: The verifier obtains the member name, member value, member existence evidence, member group, and verification mode of the Level 0 member to be verified, and calls the member verification service; wherein, the verification mode includes two types, namely fast verification mode and full verification mode; Step 5.2, the verifier calls the member verification service; Step 5.3: The member verification service performs the member verification process according to the latest group hierarchical tree RSA accumulator structure, that is: verifying whether the member name, member value, member existence evidence, and the group to which the member belongs match the group hierarchical tree RSA accumulator structure. If they match, proceed to step 5.4; otherwise, the verification fails. Step 5.4: Determine if the current mode is quick verification. If yes, return the verification result and end the process; otherwise, it is full verification mode, and proceed to step 5.
5. Step 5.5: Execute the verification process of the temporary root of the RSA accumulator step by step upwards until the final root of the RSA accumulator is reached, and return the final verification result.
6. A system for a distributed, verifiable, revocable, and scalable credential management method according to any one of claims 1-5, characterized in that, include: The grouped hierarchical tree-structured RSA accumulator structure has n+1 levels, arranged sequentially from the leaf node to the root node as: Level_0, Level_1, ..., Level_n. Its specific structure is as follows: Level 0 stores multiple Level 0 members in a grouped manner, and any Level 0 member... Has member values Evidence of the existence of members The member value This serves as a verifiable credential identifier; all members at Level 0 are divided into multiple groups. Level 1 uses a grouped storage method to store multiple Level 1 members. Each Level 1 member corresponds to a Level 0 group. The member value of a Level 1 member is the temporary root of the RSA accumulator of the member values of all members in its corresponding Level 0 group. All members of Level 1 are divided into multiple groups. Level 2 uses a grouping format to store multiple Level 2 members. Any Level 2 member corresponds to a Level 1 group. The member value of a Level 2 member is the temporary root of the RSA accumulator of the member values of all members in its corresponding Level 1 group. And so on Level_n is the root node, which has only one Level_n member. Its member value is the final root of the RSA accumulator of the member values of all members in the corresponding Level_n-1 group. The service center registers and publishes source computing services and root computing services corresponding to the grouped hierarchical tree-shaped RSA accumulator structure through the entry service; in: Each member at Level_1 registers and publishes a source computing service to manage members within the Level_0 group. For each member at Level_2, ..., Level_n, a root computing service is registered and published to manage the members within its subordinate group. Verifiable credentials are managed through source computing services and root computing services.
Citation Information
Patent Citations
Method for authentication item
US6226743B1
A credential management system for distributed authentication, and related systems and methods
WO2018175980A1