A digital certificate generation and secret information verification method for hiding secret information

Abstract

Digital certificate generation and secret information verification method for hiding secret information: a digital certificate issuing system maps user secret information A1, …, A m into integers a1, …, a m , m≥1, calculates a modulo p polynomial F(X)=(X-a1)…(X-a m )H(X) mod p, H(X) is a modulo p polynomial of degree n, and the coefficients of F(X) are contained in the digital certificate; when it is necessary to verify whether one or more user secret information is contained in the digital certificate, a program or system for verifying user information in the digital certificate obtains the coefficients of the modulo p polynomial F(X) from the digital certificate, and uses the user secret information A1, A2, …, A m mapped and converted into integers a1, a2, …, a m as the zero points of F(X) to verify whether the user secret information to be verified is contained in the digital certificate.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of cryptography, in particular, a digital certificate generation method for hiding private information and a private information verification method. BACKGROUND

[0002] X509 digital certificate is a kind of electronic identity certificate widely used at present, by which the security functions such as online identity authentication, digital signature and data encryption can be realized. Since the digital certificate is an identity certificate for identifying a user, it is necessary to include various information of the user in the digital certificate, such as name, work unit, contact phone number or email address, and some digital certificates even include the user's ID number. Various applications often use the user information obtained from the digital certificate for user identification and authentication, and use the user information to implement various user authentication and application related functions, such as sending verification information through the contact phone number or email address. However, at present, privacy protection is increasingly valued by people, and according to the requirements of relevant laws, regulations and management regulations, part or even all of the information is private information of the user, which cannot and should not appear in the digital certificate, which leads to a series of problems in the application of the digital certificate.

[0003] The digital certificate is used for identifying and authenticating the identity of the user (commonly known as identity authentication), so in actual application, the user information in the digital certificate is often used to identify and authenticate the user. The inclusion of user information in the digital certificate is to guarantee that the information belongs to the owner of the digital certificate (i.e. the user information in the digital certificate is authenticated and verified), if the private information of the user cannot appear in the digital certificate, how to ensure that certain information indeed belongs to a certain user (the holder of the digital certificate) or ensure that the user has a certain information? Therefore, in order to make the digital certificate not lose the function of guaranteeing and confirming the user information, the digital certificate still needs to include the private information of the user, but the private information of the user cannot appear in the digital certificate in plaintext form, which leads to some technical problems as follows:

[0004] In what form should the private information of the user appear in the digital certificate, and how to provide the verifiability of the user information without revealing the user's privacy, i.e. it can be verified that certain item or items of user information are indeed included in the digital certificate?

[0005] The existing various digital certificate applications are based on the standard X509 digital certificate, if the user information does not appear in the digital certificate or does not appear in the digital certificate in plaintext, how to make these existing various digital certificate applications not be affected?

[0006] When a user has multiple digital certificates, applications often need to display the subject name (such as the common name) on the digital certificate so that the user can select one of the certificates. However, due to privacy protection, the user's name cannot appear on the digital certificate. How can this contradiction be resolved?

[0007] Therefore, how to protect users' private information and ensure the verifiability of user information without affecting the normal use of digital certificates, including ensuring the use of digital certificates in various applications that support the X.509 standard (i.e., compatibility with these applications) and ensuring that users can use digital certificates, is a technical problem that needs to be solved in implementing privacy protection for digital certificates. Summary of the Invention

[0008] The purpose of this invention is to address the problem that current digital certificates cannot protect user privacy by proposing a technical solution that can both protect user private information and facilitate user information verification, without affecting the normal use of digital certificates.

[0009] To achieve the objectives of this invention, the proposed technical solution is a method for generating digital certificates and verifying private information that hides private information, as detailed below.

[0010] When generating and issuing a user's digital certificate, it is necessary to store the user's private information A1, A2, ..., A... m When included as verifiable information in a user's digital certificate, where m≥1, the digital certificate issuing system (CA system) will respectively include A1, A2, ..., A m Mapping and converting to integers a1, a2, ..., a1 within the range [1, p-1]. m The calculation yields a modulo p polynomial F(X) = (X-a1)(X-a2)…(Xa…). m H(X) mod p, where p is a prime number, H(X) is a polynomial modulo p with a first coefficient of 1, a degree of n, and a non-zero constant term, n≥1. That is, F(X) and H(X) are polynomials in the Zp field (the term modulo p refers to a polynomial in the Zp field, where the coefficients of the polynomial are congruents modulo p, and operations on the coefficients of the polynomial are performed modulo p; the degree of the polynomial is also called the order of the polynomial; H(X) with a first coefficient of 1 means that H(X) modulo p). n The coefficient is 1; the selection of n and p should meet the safety requirements, which mean that it is impossible or very difficult to decompose (X-a1)(X-a2)...(Xa... ... m )H(X), to obtain a1, a2, ..., a m And thus we can obtain A1, A2, ..., A m, usually m+n>4, p is large enough, then the digital certificate issuing system includes the coefficients of F(X) in the digital certificate, or includes the coefficients of F(X) after calculation and conversion in the digital certificate; the partial coefficients include one or more coefficients;

[0011] The user private information A1, A2, …, A m The user information that cannot appear in the digital certificate in plaintext form (such as name, email, ID number, phone number, work unit, etc.); the verifiable information refers to: although the user private information A1, A2, …, A m does not directly appear in the digital certificate, but according to the information contained in the digital certificate, it can be verified that the user of the digital certificate, i.e. the holder of the digital certificate, has these user private information, that is, the digital certificate, i.e. F(X), hides the user private information A1, A2, …, A m (Note: before issuing the digital certificate, the validity of these user information has been verified);

[0012] The modulo p polynomial H(X) is different for different users; the coefficients of the modulo p polynomial H(X) except the first coefficient are integer secrets (not disclosed to the outside) in [0, p-1], and the value of H(a i ) is not 0, i=1, 2, …, m (usually the coefficients of H(X) are different for different users, but the degrees can be the same or different);

[0013] When it is necessary to verify whether one or more user private information is hidden in the digital certificate, the program or system for verifying the user information in the digital certificate obtains the coefficients of the modulo p polynomial F(X) from the digital certificate, including the coefficients of F(X) in the digital certificate without calculation and conversion and / or the coefficients of F(X) after calculation and conversion, and then uses the user private information A1, A2, …, A m mapped and converted integer a1, a2, …, a m as the zero point of F(X) to verify whether the user private information to be verified is hidden in the digital certificate;

[0014] If part or all of the coefficients of F(X) are included in the digital certificate after calculation and conversion, the coefficients of F(X) after calculation and conversion must be such that the program or system for verifying the user information in the digital certificate can still use the user private information A1, A2, …, A m mapped and converted integer a1, a2, …, a m as the zero point of F(X) to verify whether the user private information is hidden in the digital certificate (this is a requirement for the coefficient calculation and conversion scheme or method);

[0015] The program or system for verifying the user information in the digital certificate includes a program or system of a digital certificate relying party and a program or system of a trusted third party; the digital certificate relying party is a person or an organization relying on the security function provided by the digital certificate, such as identity authentication and digital signature function; the trusted third party is a party other than the user and the digital certificate relying party.

[0016] Note that the expansion of F(X) to be calculated is F(X) = X m+n + c1X m+n-1 + … + c m+n The digital certificate contains the coefficients c1, …, c m+n and / or the data obtained by the calculation and conversion thereof.

[0017] The digital certificate generated by the above method hides the user's private information through F(X), and in order to verify whether the digital certificate hiding the user's private information belongs to a certain user, or verify whether the user is the owner of a certain digital certificate, or verify whether the user of the digital certificate has one or more private information (such as name, mobile phone number, ID number), the program or system of the digital certificate relying party often needs to verify whether the digital certificate contains one or more verifiable user private information by itself or through the program or system of the trusted third party.

[0018] According to the different ways of including the coefficients of F(X) in the digital certificate, and whether the user private information to be verified is one or more, there are different methods for verifying the user private information.

[0019] The following is a method for verifying one item of user private information when the coefficients of F(X) are not calculated and converted and included in the digital certificate (the coefficients are directly included in the digital certificate).

[0020] If the coefficients of F(X) are not calculated and converted and included in the digital certificate, when it is necessary to verify whether the user private information A is hidden and included in the digital certificate, the program or system for verifying the user information in the digital certificate obtains the coefficients of the modulo p polynomial F(X) from the digital certificate, reconstructs F(X), and then calculates F(a) mod p using the integer a in [1, p-1] mapped and converted from the information A. If the value of F(a) mod p is 0, the verification is passed, that is, the user private information A is hidden and included in the digital certificate, otherwise, the verification fails.

[0021] Note that when verifying, mapping and converting the information A into an integer a in [1, p-1] does not necessarily be performed by the program or system of the verifying party (for example, it can be completed by the program or system of the user end or client end).

[0022] The following is a method for verifying the inclusion of user private information in a digital certificate when the coefficients of F(X) are not converted and included in the digital certificate (when the coefficients are directly included in the digital certificate), and the verification is performed for multiple user private information.

[0023] If the coefficients of F(X) are not converted and included in the digital certificate, when it is necessary to verify whether the user private information B1, B2, …, B q is included in the digital certificate, the verification program or system obtains the coefficients of the modulo p polynomial F(X) from the digital certificate, reconstructs F(X), and then removes the modulo p polynomial F(X) using the modulo p polynomial T(X) = (X - b1)(X - b2)…(X - b q ) mod p. In the process of the division, the operations on the coefficients of the polynomial are performed according to the operation of the modulo p congruence, i.e., F(X) / T(X) mod p, i.e., F(X) is divided by T(X) in the Zp field, where b1, b2, …, b q are integers in [1, p-1] obtained by mapping and converting B1, B2, …, B q . If the division is successful, i.e., the modulo p remainder polynomial R(X) is a constant 0 (i.e., F(X) mod T(X) = 0 in the Zp field), the verification is passed, i.e., the user private information B1, B2, …, B q is included in the digital certificate, otherwise, the verification fails.

[0024] The integers b1, b2, …, b q in [1, p-1] obtained by mapping and converting B1, B2, …, B q , and the construction of the modulo p polynomial T(X) = (X - b1)(X - b2)…(X - b q ) mod p do not have to be completed by the program or system for verifying the user information in the digital certificate (for example, they can be completed by the program or system of the user side or the client side).

[0025] Note that the expansion of T(X) = X q + t1X q-1 + … + t q has to be calculated.

[0026] A method for converting and including part of the coefficients of F(X) in a digital certificate is as follows.

[0027] The prime number p is the order of a generator G of an additive cyclic group that satisfies the discrete logarithm problem (i.e., the order of the additive cyclic group), or the order of a generator g of a multiplicative cyclic group that satisfies the discrete logarithm problem (i.e., the order of the multiplicative cyclic group);

[0028] When a user's digital certificate is generated and issued, the user's private information A1, A2,..., A m As the verifiable information is contained in the user's digital certificate, wherein m≥1, the digital certificate issuing system (CA system) calculates a polynomial F(X) = (X-a1)(X-a2)...(X-am) mod p, wherein a1, a2,..., am are the user's private information, and F(X) is a polynomial of degree m. m )H(X) mod p, wherein a1, a2,..., am are the user's private information, and H(X) is a polynomial of degree m. m And H(X) is as described above, and then F(X) is decomposed into F(X) = F1(X) + c, wherein c is an integer randomly selected from [1, p-1], and the constant term of F1(X) is the constant term of F(X) mod p (Note: the constant term of F1(X) is 0 or non-zero).

[0029] If the group corresponding to p is an additive group satisfying the discrete logarithm problem, calculate G c = cG (the number of group elements is multiplied) ;

[0030] If the group corresponding to p is a multiplicative group satisfying the discrete logarithm problem, calculate g c = g^c, wherein ^ is the power operation (the number before ^ is the base, and the number after ^ is the power) ;

[0031] Then the coefficients of F1(X) and G c or g c are contained in the digital certificate.

[0032] Note that in order to calculate the expansion of F(X) = X m+n + c1X m+n-1 +... + c m+n = F1(X) + c, the digital certificate contains the coefficients of the expansion of F1(X) and G c or g c .

[0033] For the above-mentioned method of calculating the constant coefficient of F(X) and converting it to be contained in the digital certificate, a verification method for verifying a user's private information is as follows.

[0034] When it is necessary to verify whether the user's private information A is hidden in the digital certificate, the program or system for verifying the user's information in the digital certificate obtains the coefficients of the polynomial F1(X) mod p from the digital certificate, reconstructs F1(X), and obtains G c or g c from the digital certificate.

[0035] If p corresponds to an additive group satisfying the discrete logarithm problem, then:

[0036] The program or system for verifying the user information in the digital certificate uses the integer a in [1, p-1] mapped and converted from the information A to calculate G A =(F1(a)mod p)G+G c , if G A is the zero element, the verification is passed, i.e. the user private information A is hidden in the digital certificate, otherwise, the verification fails; or, G A =(p-(F1(a)mod p)) -1 G c , where (p-(F1(a)mod p)) -1 is the modular p multiplication inverse of (p-(F1(a)mod p)), if G A is the generator G, the verification is passed, i.e. the user private information A is hidden in the digital certificate, otherwise, the verification fails.

[0037] If p corresponds to a multiplication group satisfying the discrete logarithm problem, then:

[0038] The program or system for verifying the user information in the digital certificate uses the integer a in [1, p-1] mapped and converted from the information A to calculate g A =(g^(F1(a)mod p))g c , if g A is the identity element, the verification is passed, i.e. the user private information A is hidden in the digital certificate, otherwise, the verification fails; or, g A =g c ^((p-(F1(a)mod p)) -1 ), if g A is the generator g, the verification is passed, i.e. the user private information A is hidden in the digital certificate, otherwise, the verification fails.

[0039] Note that the integer a in [1, p-1] mapped and converted from the information A is not necessarily completed by the program or system of the verifier (for example, it can be completed by the program or system of the user end or client end).

[0040] For the above-mentioned method of converting the coefficients of F(X) into the digital certificate through calculation, a verification method for verifying multiple user information is as follows.

[0041] When it is necessary to verify whether the user private information B1, B2, …, B q is hidden in the digital certificate, q≥1, the program or system for verifying the user information in the digital certificate reconstructs F1(X) from the coefficients of the modular p polynomial F1(X) obtained from the digital certificate, and uses B1, B2, …, B qThe integers b1, b2, …, b in [1, p-1] obtained by mapping and conversion q , construct a modulo p polynomial T(X)=(X-b1)(X-b2)…(X-b q ), then remove the modulo p polynomial F1(X) with the modulo p polynomial T(X), and the operation / computation of polynomial coefficients in the process of division is in the form of modulo p congruence operation / computation, i.e., F1(X) / T(X) mod p, i.e., remove F1(X) with the polynomial T(X) in the Zp field, to obtain a modulo p remainder polynomial R(X) (i.e., F1(X) mod T(X)=R(X) for the Zp field), i.e., obtain the remainder polynomial R(X) in the Zp field;

[0042] If R(X) contains other terms in addition to the constant term, the verification fails, and if R(X) contains only the constant term r, the verification continues.

[0043] If p corresponds to an additive group satisfying the discrete logarithm problem, then:

[0044] The program or system for verifying the user information in the digital certificate calculates G A =rG+G c , if G A is zero, the verification passes, i.e., the user private information B1, B2, …, B q is hidden in the digital certificate, otherwise, the verification fails; or, calculate (p-r) -1 G c , where (p-r) -1 is the modulo p multiplication inverse of p-r, if G A is the generator G, the verification passes, i.e., the user private information B1, B2, …, B q is hidden in the digital certificate, otherwise, the verification fails.

[0045] If p corresponds to a multiplicative group satisfying the discrete logarithm problem, then:

[0046] The program or system for verifying the user information in the digital certificate calculates g A =(g^r)g c , if g A is the identity element, the verification passes, i.e., the user private information B1, B2, …, B q is hidden in the digital certificate, otherwise, the verification fails; or, calculate g A =g c ^((p-r) -1 ), where (p-r) -1 is the modulo p multiplication inverse of p-r, if g A is the generator g, the verification passes, i.e., the user private information B1, B2, …, Bq , otherwise, the verification fails.

[0047] Note that the expansion of T(X) is calculated as T(X) = X q + t1X q-1 +... + t q .

[0048] Note that, in the verification, the integers b1, b2,..., b q in [1, p-1] are mapped or transformed from the information B1, B2,..., B q , and the calculation of T(X) = (X-b1)(X-b2)...(X-b q ) mod p is not necessarily completed by the program or system of the verifier (for example, it can be completed by the program or system of the user end or client end).

[0049] A method for converting the calculation of all coefficients of F(X) into a digital certificate is as follows.

[0050] The prime number p is the order of a generator G of an additive cyclic group satisfying the discrete logarithm problem, or the order of a generator g of a multiplicative cyclic group satisfying the discrete logarithm problem;

[0051] When generating and issuing a digital certificate of a user, and the user's private information A1, A2,..., A m are to be included in the user's digital certificate as verifiable information, where m ≥ 1, the digital certificate issuing system (CA system) takes H(X) = 1, and calculates a polynomial mod p:

[0052] F(X) = (X-a1)(X-a2)...(X-a m ) = X m + c1X m-1 +... + c m , where a1, a2,..., a m

[0053] As described above;

[0054] An integer t is randomly selected in [1, p-1], and G t = tG or g t = g^t, where ^ is the power operation (the number before ^ is the base, and the number after ^ is the exponent);

[0055] If p corresponds to an additive group satisfying the discrete logarithm problem, G0 = G t , G1 = c1G t ,..., G m = c m G t are selected or calculated, and a form polynomial F G=G0X m +G1X m-1 +…+G m , G0, G1, …, G m are contained in the digital certificate (+ is a formal addition operator);

[0056] If p corresponds to a multiplicative group satisfying the discrete logarithm problem, g0=g t , g1=g t ^c1, …, g m = g t ^c m are selected or calculated, and the following formal polynomial for the exponent is constructed:

[0057] F g = g t ^(X m +c1X m-1 +…+c m ) = (g0^X m )*(g1^X m-1 )*…*(g m ^X 0 ), where * represents

[0058] multiplication (* is a formal multiplication operator), g m ^X 0 = g m , and g0, g1, …, g m are contained in the digital certificate.

[0059] For the above-mentioned method of converting all coefficients of F(X) into the digital certificate by calculation, a method of verifying a piece of user private information is as follows.

[0060] When it is necessary to verify whether the user private information A is hidden in the digital certificate, the program or system for verifying the user information in the digital certificate obtains G0, G1, …, G m from the digital certificate, reconstructs the formal polynomial F G , or obtains g0, g1, …, g m from the digital certificate, and reconstructs the formal polynomial F g for the exponent;

[0061] If p corresponds to an additive group satisfying the discrete logarithm problem, the program or system for verifying the user information in the digital certificate calculates F G (a) in the additive group by using an integer a in [1, p-1] obtained by mapping and converting from the information A, where G i a m-i is calculated in the additive group. m-i G i, i = 0, 1,..., m, "+" in the polynomial is the addition operation for the additive group element; if F G (a) is the zero element, then the verification is passed, i.e. the user's private information A is hidden in the digital certificate, otherwise, the verification fails;

[0062] If p corresponds to a multiplicative group satisfying the discrete logarithm problem, then the program or system verifying the user's information in the digital certificate calculates F g (a) in the multiplicative group, where g i ^a m-i is the power operation in the multiplicative group, i = 0, 1,..., m, "*" in the calculation formula is the multiplication operation for the multiplicative group element; if F g (a) is the identity element, then the verification is passed, i.e. the user's private information A is hidden in the digital certificate, otherwise, the verification fails.

[0063] Note that the integer a in [1, p-1] mapped and converted from the information A does not necessarily be completed by the program or system of the verifier.

[0064] For the above-mentioned method of converting all coefficients of F(X) into the digital certificate through calculation, and a method of verifying multiple user private information at the same time is as follows.

[0065] When it is necessary to verify whether the user's private information B1, B2,..., B m is hidden in the digital certificate, the program or system verifying the user's information in the digital certificate obtains G0, G1,..., G m from the digital certificate, reconstructs the formal polynomial F G , or obtains g0, g1,..., g m from the digital certificate, reconstructs the formal polynomial F g for the index; a random integer b in [1, p-1] is selected such that T(b) is not 0, i.e. a b in [1, p-1] is randomly selected which is not b1, b2,..., b m , where T(X) = (X-b1)(X-b2)...(X-b m )mod p is a polynomial modulo p, i.e. a polynomial in the Zp field, b1, b2,..., b m are integers in [1, p-1] mapped and converted from B1, B2,..., B m ;

[0066] If p corresponds to an additive group satisfying the discrete logarithm problem, then the program or system verifying the user's information in the digital certificate calculates F G (b) in the additive group, where G i bm-i For the additive group, compute b m-i G i , i = 0, 1, …, m, "+" in the polynomial is the addition operation for the additive group element; if F G (b) is the same as T(b)G0, then the verification is passed, i.e. the digital certificate exactly hides the user private information B1, B2, …, B m , otherwise, the verification fails.

[0067] If p corresponds to a multiplicative group satisfying the discrete logarithm problem, then the program or system verifying the user information in the digital certificate computes F g (b) in the multiplicative group, where g i ^b m-i is the power operation in the multiplicative group, i = 0, 1, …, m, "*" in the computation formula is the multiplication operation for the multiplicative group element; if F g (b) is the same as g0^T(b), then the verification is passed, i.e. the digital certificate exactly hides the user private information B1, B2, …, B m , otherwise, the verification fails.

[0068] Note that, in the verification, the integers b1, b2, …, b m in [1, p-1] mapped or converted from B1, B2, …, B m , and the multiplicative group polynomial T(X) = (X-b1)(X-b2)…(X-b m ) mod p are not necessarily executed by the program or system of the digital certificate relying party (for example, they can be completed by the program or system of the user end or client end).

[0069] If part of the information or all of the information in the user private information A1, A2, …, A m is mapped or converted into the integer a1, a2, …, a m in [1, p-1] using a secret, then when it is necessary to verify whether the digital certificate hides the user private information, the program or system verifying the user information in the digital certificate maps or converts the user private information to be verified into the integer in [1, p-1] by using the same secret; the part of the information includes one or more than one item of information (which items of information, which types of user private information use the secret are assumed to be pre-agreed or indicated by other information in the digital certificate).

[0070] If the digital certificate issuing system includes the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X) in the digital certificate in cipher text form after encryption, when it is necessary to verify whether the user's private information is hidden in the digital certificate, the program or system verifying the user's information in the digital certificate decrypts the cipher text of the encrypted coefficients or data in the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X) included in the digital certificate to obtain the plain text thereof; the part includes one or more than one.

[0071] For the above-mentioned method for generating a digital certificate hiding private information and verifying the private information, the manner in which the digital certificate issuing system includes the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X) in the digital certificate includes: including the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X) in the subject name (Name in the subject field) and / or the subject alternative name (subjectAltName) of the digital certificate, and / or the extension fields of the digital certificate (F(X) and / or the calculated converted data in the coefficients of F(X) do not have to be stored in one field of the digital certificate, but can be stored in different fields of the digital certificate).

[0072] For the above-mentioned method for generating a digital certificate hiding private information and verifying the private information, if the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X) are stored (included) in the fields of the subject name and / or the subject alternative name of the digital certificate, the digital certificate issuing system converts the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X) into pseudo data meeting the data type and format requirements of the corresponding fields in the subject name and / or the subject alternative name; the pseudo data refers to data whose type and format meet the specified requirements of the data storage field, but the data does not have the original true meaning (for example, the coefficients of F(X) are first base64 encoded, and then encoded into data in the format of an email address, a URI, and an OU; these email address, URI, and department name are pseudo email address, pseudo URI, and pseudo department name, because they are not real email address, URI, and department name, but fake and pseudo).

[0073] Optionally, for the above-mentioned digital certificate generation and secret information verification method for hiding secret information, in order to facilitate the user to view and select the certificate, the digital certificate issuing system (CA system) generates and issues a digital certificate of the user, and includes the pseudonym submitted by the user when applying for the digital certificate as part of the subject name or subject alias in the digital certificate in plaintext form; the user pseudonym is a name (such as a hero, a segment, a Hanwu emperor, Newton, etc.) that is convenient for the user to select the digital certificate when using the digital certificate and is irrelevant to the real identity of the user.

[0074] Optionally, in addition to the above-mentioned way of including the user's secret information in the digital certificate in a verifiable manner, the digital certificate issuing system can also include the original user's secret information in the digital certificate in the form of ciphertext data that can be decrypted by the program or system of a trusted third party such as the program or system of the digital certificate issuing party, for decryption and use by the program or system of the trusted third party when needed.

[0075] As can be seen from the above description, based on the scheme of the present application, the user's secret information is hidden and included in the user's digital certificate through the polynomial F(X), and the user's secret information cannot be directly obtained from the user's digital certificate (the secret information is desensitized), but based on the polynomial F(X) information included in the digital certificate, it can be easily verified whether the user's certain secret information or certain secret information is hidden and included in the digital certificate, that is, whether the user has this secret information or multiple secret information, so the scheme of the present application well protects the user's privacy; in addition, in actual application, the digital certificate is uniquely identified by the issuer's name and the certificate serial number, so the scheme of the present application does not affect the use of the digital certificate in the existing standard application programs and systems supporting X509 digital certificates (compatible with these application programs and systems); in addition, by introducing the pseudonym, the scheme of the present application protects the user's privacy without affecting the user's habit of using the digital certificate. DETAILED DESCRIPTION

[0076] The specific embodiments of the present application will be described below. The following content is only a description of possible embodiments of the present application and does not limit the scope of protection of the present application.

[0077] How to map and convert a user information A into an integer does not belong to the content of the present application, and there are many possible ways in the specific implementation, such as corresponding and converting different user information (string) into different integers within [1, p-1], or corresponding and converting into different integers within [1, p-1] in a probability collision-free manner. The corresponding and converting into different integers within [1, p-1] in a probability collision-free manner refers to that the probability of mapping and converting two different user information A and B into the same integer within [1, p-1] is extremely small, and within the allowable range, for example, the hash value (hash value, hash value) of the user information A can be taken, and then the hash value is taken as the integer mapped and converted by the user information A (assuming that the hash value does not exceed p-1, if it exceeds, further processing is performed, such as truncation), or the string of the user information A can be directly taken as an integer, if the obtained integer does not exceed p-1, the integer is taken as the mapping and conversion result of the information A, if it exceeds, the hash value is taken as the mapping and conversion result (assuming that the hash value does not exceed p-1, if it exceeds, further processing is performed on the hash value, such as truncation), or the string of the information A can be folded and added: the string of the information A is segmented by N bytes, and the fixed padding data (such as all 0, all 1 or 0, 1 alternating data, etc.) is filled, then the segmented string is added as an integer, and the addition result is taken as the integer mapped and converted by the information A. N should be selected to ensure that the mapping and conversion result does not exceed p-1.

[0078] It is sometimes very necessary to directly convert the string of a user information A into an integer within [1, p-1], because it means that the user information A is directly hidden in the polynomial F(X), but it faces the problem that the string of the user information A is too long to be directly converted into a single integer within [1, p-1] (the folding and adding method is a conversion method), and the following method converts the string of the user information A into multiple associated integers when the string of the user information A is too long:

[0079] (1) If the string of a user information A can be directly converted into an integer a within [1, p-1], it is converted into an integer a within [1, p-1];

[0080] (2) If the string of a user information A is too long to be directly converted into an integer a within [1, p-1], the string of the user information A is converted into multiple sub-strings A1, A2, …, A s , each of which can be an integer c1, c2, …, c s within [1, p-1]; s , and then c1, c2, …, c s are converted into reversible a1, a2, …, a s, the so-called front and back linkage is a1, a2, …, a s , the so-called reversible is that a1, a2, …, a s can be recovered from c1, c2, …, c s , for example, let a1=c1, a2=a1+c2, …, a s =a s-1 +c s , where "+" is algebraic addition, or a1=c1, a2=a1⊕c2, …, a s =a s-1 ⊕c s , where "⊕" is the bitwise XOR for binary numbers, or a mixed processing of "+" and "⊕", for example, a s =a s-1 ⊕(a s-1 +c s ), or a s =a s-1 +(a s-1 ⊕c s ), or, in addition to the first term, the latter uses "+" and "⊕";

[0081] (3) In order to distinguish the integers converted according to (1) and (2), and a1, a2, …, a s in (2), add two binary numbers in the front or tail or other fixed positions of the converted binary integers: for the integer converted according to (1), the added number is 00B; for the first integer in (2), i.e. a1, the added number is 01B; for the middle integer in (2), the added number is 10B; for the last integer in (2), i.e. a s , the added number is 11B; for the integer converted according to (2), if s=2, i.e. there are only two integers, there is no middle integer.

[0082] (4) In the construction of polynomial F(X) and the verification of user information, both (1) and (2) are converted. For user information A converted according to (2), A1, A2, …, A s are used as the associated sub-information of information A, and are used separately for the construction of polynomial F(X) and the verification of user information.

[0083] In order to reduce the probability that the same integer appears in the integers of two different user information decomposed and converted according to this method, the string of sub-information A i can be reversibly scattered as an integer to obtain data as c i . Scattering refers to a non-preservation processing that amplifies the small differences between two information. Reversible means that the original A can be restored from the obtained c i .i string (integer), i = 1, …, m. A simple reversible scattering process is as follows: suppose A i string as an integer d i whose value is less than p1 < p, take the Ai string as an integer and a randomly generated integer w [1, p1] (w is secret or non-secret, if non-secret, it can be a public constant), and then take c i = (d i w) mod p1.

[0084] This way of mapping conversion means that if a is known, A can be recovered, or if a1, a2, …, a s , A1, A2, …, A s , and then A is recovered, that is, the user information A is directly contained in F(X) through calculation conversion.

[0085] In order to enhance the attacker's way of obtaining user private information contained in the digital certificate through guessing (brute force attack), the calculation amount of mapping and converting the user private information to an integer can be increased, such as the prime number p is the order of an additive cyclic group or a multiplicative cyclic group that satisfies the discrete logarithm problem, and G or g is a generator of the additive group or the multiplicative group (the generators of different users are different). First, a private information A is converted into an integer i, and then i is used to calculate G i = iG or g i = g^i, and then G i or g i is converted to obtain an integer a (there are many ways), and G or g is contained in the digital certificate (the generators of different users are different).

[0086] In addition, in order to enhance the difficulty of guessing (brute force attack), multiple private information of the user can be combined in a predetermined manner to participate in calculation and verification as a single private information, such as combining name and email as private information, or combining name, mobile phone number, and ID number as a private information.

[0087] In order to limit only the authorized verification party program or system to be able to verify whether the user private information is contained in the digital certificate, A1, A2, …, A m can be mapped and converted into integers a1, a2, …, a mThe secret can be used in a variety of ways, such as using a keyed-hash, data encryption, multiplying or adding an integer secret to the integer obtained by the mapping and conversion, etc. The program or system of the verifying party that verifies the user information in the digital certificate maps and converts the user private information to be verified into an integer within [1, p-1] by using the same secret (such as sharing the same secret, or obtaining the secret from the digital certificate system, or the secret is encrypted and included in the digital certificate, and the verifying party can decrypt the secret).

[0088] Encrypting the coefficients of F(X) or data converted from the coefficients of F(X) is also a way to limit only authorized verifying parties to verify the user private information.

[0089] In a specific implementation, the user information can be classified according to the sensitivity of the user information. The mapping and conversion of less sensitive user information does not use a secret, and the mapping and conversion of sensitive user information uses a secret. The less sensitive user information can be verified by everyone, and the sensitive user information can only be verified by authorized verifying parties.

[0090] The digital certificate can include different types of numbers, such as user name, ID number, and email address. Some of them are mandatory information in the subject name, and some of them are optional information in the subject alias. In order to reflect the type and selectivity of the user information, a certain number of bits can be added or inserted at the end (the lowest bit), in the middle, or at the beginning (the highest bit) of the integer obtained by mapping and converting the information A, which is used for information classification. The information classification reflects the type and selectivity of the user information, provided that the integer after adding or inserting the information classification does not exceed p-1.

[0091] For the case where the coefficients of F(X) are not calculated and converted and included in the digital certificate, the degree n of the modulo p polynomial H(X) is greater than or equal to 1, and the larger n is, the safer it is. p is a sufficiently large prime number. The selection of n and p needs to meet the security requirements, that is, it is difficult or impossible to obtain the user private information from the known information. Usually, m+n>4 and p is sufficiently large, which will make it impossible or difficult to factor out (X-a1)(X-a2)…(X-a m )H(X) from F(X). In order to avoid using the verified information A to factor F(X), n>4 can be taken. If the mapping and conversion of the user information A into an integer a within [1, p-1] is not reversible or a secret is used, that is, the information A cannot be obtained from a, then m+n>4 is not necessary (n=1 can be taken) as long as p is sufficiently large to make the probability of different user information being mapped and converted into the same integer within [1, p-1] sufficiently small (less than the expected value), because even if (X-a1)(X-a2)…(X-a m )H(X) is factored out and a1, a2, …, am , A2,..., Am, and A1, A2,..., Am, respectively, and A is the user information to be verified. m , A2,..., Am, and A1, A2,..., Am, respectively, and A is the user information to be verified. m , A2,..., Am, and A1, A2,..., Am, respectively, and A is the user information to be verified.

[0092] In order to make H(a i ) not equal to 0, i = 1, 2,..., m, n integers g1, g2,..., gn, different from a1, a2,..., an, can be randomly selected from [1, p-1], and H(X) = (X-g1)(X-g2)...(X-gn) mod p is calculated; of course, n coefficients of H(X) can be directly randomly selected (the coefficients of other terms of H(X) can be 0), as long as it is verified that the value of H(a m ) is not equal to 0, i = 1, 2,..., m; in order to avoid the case that an integer a obtained by mapping and converting the user information A to be verified is a zero point of H(X) (the probability of this case is extremely small), a secret irreducible polynomial in the field Zp can be selected as H(X), or integers g1, g2,..., gn of H(X) = (X-g1)(X-g2)...(X-gn) mod p are constructed. n , A2,..., Am, and A1, A2,..., Am, respectively, and A is the user information to be verified. n , A2,..., Am, and A1, A2,..., Am, respectively, and A is the user information to be verified. n , A2,..., Am, and A1, A2,..., Am, respectively, and A is the user information to be verified. i , A2,..., Am, and A1, A2,..., Am, respectively, and A is the user information to be verified. n , A2,..., Am, and A1, A2,..., Am, respectively, and A is the user information to be verified. n , A2,..., Am, and A1, A2,..., Am, respectively, and A is the user information to be verified. m , A2,..., Am, and A1, A2,..., Am, respectively, and A is the user information to be verified.

[0093] For the case that the constant term of F(X) is calculated and converted to be contained in the digital certificate, generally, as long as the selected additive cyclic group or multiplicative cyclic group satisfies the discrete logarithm problem, but in order to avoid using the verified information A to obtain F(X) and decompose F(X), n > 4 can be taken. If the mapping and conversion of the user information A to an integer a in [1, p-1] is irreversible, or a secret is used, i.e., the information A cannot be obtained from a (such as using hash calculation and using a secret), as long as p is large enough, so that the probability of different user information being mapped and converted to the same integer in [1, p-1] is small enough (less than the expected value), n > 4 is not necessary (n = 1 can be taken), because even if (X-a1)(X-a2)...(X-an)H(X) is decomposed and a1, a2,..., an is obtained, A1, A2,..., Am cannot be obtained. m , A2,..., Am, and A1, A2,..., Am, respectively, and A is the user information to be verified. m , A2,..., Am, and A1, A2,..., Am, respectively, and A is the user information to be verified. m , A2,..., Am, and A1, A2,..., Am, respectively, and A is the user information to be verified. m , A2,..., Am, and A1, A2,..., Am, respectively, and A is the user information to be verified.

[0094] For the case that all coefficients of F(X) are converted and contained in the digital certificate by calculation, the selected additive cyclic group or multiplicative cyclic group can satisfy the discrete logarithm problem.

[0095] The scheme of the present application provides verifiable security protection of user private information, and does not provide encryption protection against cracking. Therefore, an attacker can determine the user private information contained in the digital certificate by reducing the range of attempts and constantly verifying attempts through favorable conditions and information, such as the user private information being a printable string, having a certain format, and the user range. From the initial digital certificate generation and verification method of the present application for hiding private information to the second and third methods of generating and verifying digital certificates for hiding private information, the cost (amount of calculation) of attempt calculation is increasingly large. The initial scheme can be used in scenarios that often require online verification of user information, the third scheme can be used in scenarios that rarely require verification of user information, such as only at initialization, and the second scheme is a compromise.

[0096] If it is required to limit only authorized entities to verify the user private information in the digital certificate, the coefficients of F(X) and / or part or all of the data in the data converted by calculation of the coefficients of F(X) can be encrypted and contained in the digital certificate in the form of ciphertext. Only authorized entities can obtain the plaintext of the data by decryption, which is used for verification of the user private information.

[0097] For X509 digital certificates, user information is usually mainly present in the subject name (Name in the subject field) and subject alias (subjectAltName) fields. When part or all of the user information required to be present in the digital certificate is private information, the private information needs to be desensitized before appearing in the digital certificate. The processing of user private information in the present application is the desensitization of private data. As to which user information is private information, it depends on the requirements of relevant laws and regulations, management regulations, the requirements of the user himself, the security policy of the digital certificate issuing authority, and other factors, which are not the content of the present application.

[0098] The user information is usually stored in the subject name (Name in the subject field) and / or subject alias (subjectAltName) field of the digital certificate. The desensitized data of the user private information, i.e., the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X), can also be stored in the field of the digital certificate for storing user information, and can also appear in the custom extension field (the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X) do not have to be stored in one field of the digital certificate, but can be stored in different fields of the digital certificate).

[0099] The data in the subject name and subject alias of X509 has type requirements, such as IA5String, PrintableString, etc. (not all data of this type, but determined according to the specific situation), therefore, if the desensitized data of the user private information, i.e., the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X), are to appear in the subject name and / or subject alias in the form of IA5String, PrintableString, etc., the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X) need to be first converted into data of the type of IA5String, PrintableString, etc., such as base64 encoding the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X), and then storing the base64 encoded data in the subject name and / or subject alias.

[0100] Further, some fields in the subject name and subject alternative name have specific representation format requirements, such as the mailbox address, URI format. If the data after the user private information is desensitized, i.e. the coefficient of F(X) and / or the data after the calculation and conversion of the coefficient of F(X), is stored in these fields, then the coefficient of F(X) and / or the data after the calculation and conversion of the coefficient of F(X) can be base64 encoded and then represented as pseudo data conforming to the storage field format requirements, such as representing the data after base64 encoding as the format of organizational unit name, i.e. pseudo organizational unit name, storing it in the OU field of the subject name, representing the data after base64 encoding as the format of mailbox address, i.e. pseudo mailbox address, storing it in the email field of the subject name or subject alternative name, representing the data after base64 encoding as the format of URI, i.e. pseudo URI, storing it in the URI field of the subject alternative name (of course, they are not real organizational unit name, mailbox address, URI, but fake, pseudo, these fake, pseudo data do not have the real meaning that they should originally have). If the coefficient of F(X) and / or the data after the calculation and conversion of the coefficient of F(X) is stored in the custom, OCTET String type extension field, then there is no such special processing requirement.

[0101] From the above description, it can be seen that the data obtained after the user private information is desensitized, i.e. the coefficient of F(X) and / or the data after the calculation and conversion of the coefficient of F(X), can be stored in any place in the digital certificate where data can be stored, as long as the program or system of the certificate relying party knows where to obtain it, and the stored data conforms to the format requirements of the X509 digital certificate.

[0102] Other specific technical implementations not described are well known to those skilled in the relevant art and are self-evident.

Claims

1. A method for generating a digital certificate hiding private information and verifying the private information, characterized in that: the program or system for verifying the user information in the digital certificate comprises the program or system of a digital certificate relying party and the program or system of a trusted third party; the digital certificate relying party is an individual or an organization relying on the security function provided by the digital certificate; and the trusted third party is a party other than the user and the relying party of the digital certificate. When generating and issuing a user's digital certificate, it is necessary to store the user's private information A1, A2, ..., A... m When verifiable information is included in a user's digital certificate, where m≥1, the digital certificate issuance system will respectively include A1, A2, ..., A m Mapping and converting to integers a1, a2, ..., a1 within the range [1, p-1]. m The calculation yields a modulo p polynomial F(X) = (X-a1)(X-a2)…(Xa…). m F(X) mod p, where p is a prime number, and H(X) is a polynomial modulo p with a first coefficient of 1, a degree of n, and a non-zero constant term, where n ≥ 1. That is, F(X) and H(X) are polynomials in the Zp domain. Then, the digital certificate issuance system includes the coefficients of F(X) in the digital certificate, or includes some or all of the coefficients of F(X) in the digital certificate after calculation and transformation; the partial coefficients include one or more coefficients. The user private information A1, A2,..., A m The user information that cannot appear in the digital certificate in plaintext form; the verifiable information refers to: although the user private information A1, A2,..., A m does not directly appear in the digital certificate, but according to the information contained in the digital certificate, it can be verified that the user of the digital certificate, i.e. the holder of the digital certificate, has these user private information, i.e. the digital certificate, i.e. F(X) hidden contains the user private information A1, A2,..., A m ; The modulo p polynomial H(X) is different for different users; coefficients of the modulo p polynomial H(X) except the first coefficient are integers in [0, p-1] secret, and the value of H(a i ) is not 0, i = 1, 2, …, m; When it is necessary to verify whether one or more pieces of user private information are hidden in a digital certificate, a program or system for verifying user information in a digital certificate obtains coefficients of a modulo p polynomial F(X) from the digital certificate, including coefficients of F(X) without a calculated conversion and / or coefficients of F(X) with a calculated conversion, and then uses user private information A1, A2,..., An hidden by F(X) to verify whether the user private information A1, A2,..., An is hidden in the digital certificate. m The mapped and converted integers a1, a2,..., an m For the property that F(X) is a zero point, the program or system verifies whether the user private information to be verified is hidden in the digital certificate. If part or all of the coefficients of F(X) are converted and included in the digital certificate, the converted coefficients of F(X) must be such that the program or system verifying the user information in the digital certificate can still use the user's private information A1, A2,..., An hidden by F(X) m The mapped and converted integers a1, a2,..., an m For the characteristic that F(X) is a zero point, verify whether the user's private information is hidden in the digital certificate; 2. The method according to claim 1, characterized in that: if the coefficients of F(X) are not converted and contained in the digital certificate, when it is necessary to verify whether the user private information A is contained in the digital certificate, the program or system for verifying the user information in the digital certificate obtains the coefficients of the polynomial F(X) mod p from the digital certificate, reconstructs F(X), and then calculates F(a) mod p by using the integer a in [1, p-1] mapped and converted from the information A, and if the value of F(a) mod p is 0, the verification is passed, that is, the user private information A is contained in the digital certificate, otherwise, the verification fails.

3. The method according to claim 1, characterized in that:

4. The method according to claim 1, characterized in that: the prime number p is the order of a generator G of an additive cyclic group satisfying the discrete logarithm problem, or the order of a generator g of a multiplicative cyclic group satisfying the discrete logarithm problem; If the coefficients of F(X) are not converted and included in the digital certificate, when it is necessary to verify whether the user's private information B1, B2,..., B q is hidden in the digital certificate, a program or system for verifying the user's information in the digital certificate obtains the coefficients of the modulo p polynomial F(X) from the digital certificate, reconstructs F(X), and then removes the modulo p polynomial F(X) with the modulo p polynomial T(X)=(X-b1)(X-b2)...(X-b q )mod p, wherein the operation / computation of the polynomial coefficients in the removing process is in the form of modulo p congruence, i.e., F(X) / T(X) mod p, i.e., F(X) is removed with the polynomial T(X) in the Zp field, wherein b1, b2,..., b q are integers in [1, p-1] obtained by mapping / converting B1, B2,..., B q ; if the removal is successful, i.e., the modulo p polynomial R(X) obtained is a constant 0, the verification is passed, i.e., the user's private information B1, B2,..., B q is hidden in the digital certificate, otherwise, the verification fails.

5. The method according to claim 4, characterized in that: if p corresponds to an additive group satisfying the discrete logarithm problem, then: When generating, issuing a user's digital certificate, it is necessary to put the user's private information A1, A2,..., A m As the verifiable information contained in the user's digital certificate, where m≥1, the digital certificate issuing system calculates a polynomial F(X)=(X-a1)(X-a2)...(X-am) over modulo p, and then calculates F(X)=F1(X)+c, where c is a random integer in [1, p-1], and the modulo p algebraic sum of c and the constant term of F1(X) is the constant term of F(X). m )H(X) mod p, where a1, a2,..., a m and H(X) are as described above, and then F(X) is decomposed into F(X)=F1(X)+c, where c is a random integer in [1, p-1], and the modulo p algebraic sum of c and the constant term of F1(X) is the constant term of F(X). If the group corresponding to p is an additive group satisfying the discrete logarithm problem, compute G c = cG; If the group corresponding to p is a multiplicative group satisfying the discrete logarithm problem, then the computation of g c = g^c, where ^ is the power operation; The coefficients of F1(X) and G c or g c are included in the digital certificate. if p corresponds to a multiplicative group satisfying the discrete logarithm problem, then: When it is necessary to verify whether the user's private information A is hidden in the digital certificate, the program or system for verifying the user's information in the digital certificate obtains the coefficients of the modulo p polynomial F1(X) from the digital certificate, reconstructs F1(X), obtains G c or g c ; 6. The method according to claim 4, characterized in that: The program or system for verifying the user information in the digital certificate uses the integer a in [1, p-1] mapped and converted from the information A to calculate G A = (F1(a) mod p) G + G c If G A is zero, the verification is passed, i.e. the user private information A is hidden in the digital certificate, otherwise, the verification fails; or, G A = (p - (F1(a) mod p)) -1 G c where (p - (F1(a) mod p)) -1 is the modular p multiplication inverse of (p - (F1(a) mod p)), if G A is the generator G, the verification is passed, i.e. the user private information A is hidden in the digital certificate, otherwise, the verification fails; if R(X) contains other terms in addition to the constant term, the verification fails, and if R(X) contains only the constant term r, the process continues; The program or system for verifying the user information in the digital certificate uses the integer a in [1, p-1] obtained by mapping and converting from the information A to calculate g A = (g^(F1(a) mod p))g c If g A is the identity element, the verification is passed, i.e. the user private information A is hidden in the digital certificate, otherwise, the verification fails; or, g A = g c ^((p-(F1(a) mod p)) -1 ), if g A is the generator g, the verification is passed, i.e. the user private information A is hidden in the digital certificate, otherwise, the verification fails. if p corresponds to an additive group satisfying the discrete logarithm problem, then: When it is needed to verify whether the user private information B1, B2, …, B q is hidden in the digital certificate, q≥1, the program or system for verifying the user information in the digital certificate reconstructs F1(X) from the coefficients of the polynomial F1(X) in the digital certificate, and uses the integers b1, b2, …, b q mapped and converted from B1, B2, …, B q to construct a modulo p polynomial T(X)=(X-b1)(X-b2)…(X-b q )mod p, and then uses the modulo p polynomial T(X) to remove the modulo p polynomial F1(X), and in the process of the removal calculation, the operation / computation on the polynomial coefficients is in the form of the operation / computation of the modulo p congruence, i.e., F1(X) / T(X) mod p, i.e., in the Zp domain, F1(X) is removed by T(X) to obtain a modulo p remainder polynomial R(X), i.e., a remainder polynomial R(X) in the Zp domain. if p corresponds to a multiplicative group satisfying the discrete logarithm problem, then:

7. The method according to claim 1, characterized in that: A program or system verifying the user information in the digital certificate computes G A = rG + G c , if G A is zero element, then the verification is passed, i.e. the user private information B1, B2,..., B q is contained in the digital certificate, otherwise, the verification fails; or computes (p-r) -1 G c , where (p-r) -1 is the modular p multiplication inverse of p-r, if G A is the generator G, then the verification is passed, i.e. the user private information B1, B2,..., B q is contained in the digital certificate, otherwise, the verification fails. the prime number p is the order of a generator G of an additive cyclic group satisfying the discrete logarithm problem, or the order of a generator g of a multiplicative cyclic group satisfying the discrete logarithm problem; A program or system for verifying user information in a digital certificate computes g A = (g^r)g c , if g A is the identity element, then the verification passes, i.e., the user's private information B1, B2,..., B q is contained in the digital certificate, otherwise, the verification fails; or computes g A = g c ^((p-r) -1 ), where (p-r) -1 is the modular p multiplication inverse of p-r, if g A is the generator g, then the verification passes, i.e., the user's private information B1, B2,..., B q is contained in the digital certificate, otherwise, the verification fails. as described above; 8. The method according to claim 7, characterized in that: When generating, issuing a user's digital certificate, it is necessary to put the user's private information A1, A2,..., An into the digital certificate. m As the verifiable information is contained in the user's digital certificate, where m≥1, the digital certificate issuing system takes H(X)=1, and calculates a polynomial mod p: F(X) = (X-a1)(X-a2)...(Xa m ) = X m +c1X m-1 +…+c m Where a1, a2, ..., a m 9. The method according to claim 7, characterized in that: Select an integer t at random in [1, p - 1] and compute G t = tG or g t = g^t, where ^ is the power operation; If p corresponds to an additive group satisfying the discrete logarithm problem, select or calculate G0=G t , G1=c1G t ,..., G m =c m G t , construct a formal polynomial F G =G0X m +G1X m-1 +...+G m , and include G0, G1,..., G m in the digital certificate; If p corresponds to a multiplicative group satisfying the discrete logarithm problem, select or compute g0= g t , g1= g t ^c1,..., g m = g t ^c m , construct the following polynomial in the form of the exponent: F g = g t (X m + c1X m-1 +…+c m ) = (g0^X m )*(g1^X m-1 )*…*(g m ^X 0 ), where * denotes exponentiation operation, g m X 0 = g m g0, g1,..., g m are contained in the digital certificate.

10. The method according to any one of claims 1-9, characterized in that: When it is needed to verify whether the user's private information A is hidden in the digital certificate, the program or system for verifying the user's information in the digital certificate obtains G0, G1,..., G m from the digital certificate, reconstructs the formal polynomial F G , or obtains g0, g1,..., g m from the digital certificate, reconstructs the formal polynomial F g for the exponent. If p corresponds to an additive group satisfying the discrete logarithm problem, the program or system verifying the user information in the digital certificate uses the integer a in [1, p-1] mapped and converted from the information A to calculate F G (a) in the additive group, wherein G i a m-i is calculated as a m-i G i , i = 0, 1,..., m, and the + in the polynomial is the addition operation for the additive group element; if F G (a) is the zero element, the verification is passed, that is, the user private information A is hidden in the digital certificate, otherwise, the verification fails. If p corresponds to a multiplicative group satisfying the discrete logarithm problem, then the program or system verifying the user information in the digital certificate uses the integer a in [1, p-1] mapped and converted from the information A to calculate F g (a) in the multiplicative group, where g i ^a m-i is the power operation in the multiplicative group, i = 0, 1, …, m, and * in the calculation formula is the multiplication operation for the multiplicative group element; if F g (a) is the identity element, then the verification passes, i.e., the private information A of the user is hidden in the digital certificate, otherwise, the verification fails.

11. The method according to any one of claims 1-9, characterized in that: When it is necessary to verify whether the user's private information B1, B2,..., B m is hidden in the digital certificate, a program or system for verifying the user's information in the digital certificate obtains G0, G1,..., G m from the digital certificate, reconstructs the formal polynomial F G , or obtains g0, g1,..., g m from the digital certificate, reconstructs the formal polynomial F g for the exponent; selects an integer b in [1, p-1] at random such that T(b) is not 0, i.e. selects b in [1, p-1] at random which is not b1, b2,..., b m , where T(X) = (X-b1)(X-b2)...(X-b m ) mod p is a polynomial modulo p, i.e. a polynomial in the field Zp, and b1, b2,..., b m are integers in [1, p-1] mapped or converted from B1, B2,..., B m ; If p corresponds to an additive group satisfying the discrete logarithm problem, then the procedure or system for verifying the user information in the digital certificate computes F G (b) where G is computed in the additive group i b m-i b is computed in the additive group m-i G i , i = 0, 1,..., m, the + in the polynomial is the addition operation for the additive group elements; if F G (b) is the same as T(b)G0, then the verification passes, i.e., the digital certificate exactly hides the user's private information B1, B2,..., B m , otherwise, the verification fails; If p corresponds to a multiplicative group satisfying the discrete logarithm problem, then the procedure or system for verifying the user information in the digital certificate computes F g (b) where g i ^b m-i is the power operation in the multiplicative group, i = 0, 1,..., m, and * in the computation is the multiplication operation for the multiplicative group elements; if F g (b) is the same as g0^T(b), then the verification is passed, i.e., the private information B1, B2,..., B m m in the digital certificate is exactly hidden, otherwise, the verification fails. ​ If part of the information or all of the information in the user private information A1, A2, …, A m is mapped and converted into an integer a1, a2, …, a m p-1 within [1, p-1] using a secret, when it is necessary to verify whether the user private information is hidden in the digital certificate, a program or system for verifying the user information in the digital certificate maps and converts the user private information to be verified into an integer within [1, p-1] using the same secret; the part of the information includes one or more than one item of information. ​ If the digital certificate issuing system includes the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X) in the digital certificate in cipher text form after encryption, when it is necessary to verify whether the user's private information is hidden in the digital certificate, the program or system verifying the user's information in the digital certificate decrypts the cipher text of the encrypted coefficients or data in the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X) included in the digital certificate to obtain the plain text thereof; The part includes one or more than one.

12. The method for generating a digital certificate hiding private information and verifying the private information according to any one of claims 1-9, characterized in that: The way in which the digital certificate issuing system includes the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X) in the digital certificate includes including the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X) in the subject name and / or the subject alias of the digital certificate, and / or the extension field of the digital certificate.

13. The method for generating a digital certificate hiding private information and verifying the private information according to claim 12, characterized in that: If the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X) are stored in the field of the subject name and / or the subject alias of the digital certificate, the digital certificate issuing system converts the coefficients of F(X) and / or the calculated converted data in the coefficients of F(X) into pseudo data conforming to the data type and format requirements of the corresponding field in the subject name and / or the subject alias; the pseudo data refers to data whose type and format conform to the specified requirements of the data storage field, but the data does not have the original true meaning.

14. The method for generating a digital certificate hiding private information and verifying the private information according to any one of claims 1-9, characterized in that: When the digital certificate issuing system generates and issues a digital certificate of a user, it includes the pseudonym submitted by the user when applying for the digital certificate as part of the subject name or the subject alias in the digital certificate in plain text form; The user pseudonym is a name unrelated to the user's real identity and convenient for the user to select the digital certificate when using the digital certificate.

15. The method for generating a digital certificate hiding private information and verifying the private information according to any one of claims 1-9, characterized in that: In addition to including the user's private information in the digital certificate in a verifiable manner, the digital certificate issuing system also includes the original user's private information in the digital certificate in the form of cipher text data that can only be decrypted by the program or system of a trusted third party for decryption and use by the program or system of the trusted third party when necessary.