Cross-chain identity information sharing method based on commitment transferable signature and related device

Abstract

The present application relates to the technical field of information security, and discloses a cross-chain identity information sharing method based on commitment transferable signature and related equipment, the cross-chain identity information sharing method based on commitment transferable signature comprises the following steps: a commitment transferable signature scheme CTS=(CTS.Setup, CTS.Commit, CTS.Randomize, CTS.KeyGen, CTS.Sign, CTS.Transfer, CTS.Verify) is proposed; a non-interactive zero-knowledge proof protocol π=(NIZKSetup, NIZKProve, NIZKVerify, SimSetup) that can be directly extracted is given; a cross-blockchain or cross-consortium identity authentication protocol is constructed in combination of the CTS scheme and the zero-knowledge proof protocol π; identity information sharing is carried out based on the cross-blockchain or cross-consortium identity authentication protocol; the present application adopts the above technical scheme, and a method for realizing cross-chain identity authentication of a block chain based on commitment transferable signature (CTS) is given, the method realizes anonymous identity authentication, and is suitable for use in a block chain (consortium chain) and other systems with anonymous authentication requirements.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a cross-chain identity information sharing method and related equipment based on a commitment-transferable signature. Background Technology

[0002] Because public distributed ledger data like blockchain possesses the characteristic of immutability, people can trust every transaction within the chain. With the rapid development and popularization of blockchain technology, various public chains, private chains, and consortium chains have emerged. Various companies and organizations attempt to upload relevant information to consortium blockchains (hereinafter referred to as consortium chains) to achieve the authentication and sharing of important internal data (customer information, business information, etc.), thereby improving overall productivity. However, due to significant differences in data needs and application formats among different companies or organizations, the specific data structures on the corresponding consortium chains vary considerably, hindering data integration between different consortium chains. On the other hand, the transparency of blockchain itself and the requirements for protecting user identity information privacy also prevent the direct sharing of information from different consortium chains. These dual reasons have led to the frequent occurrence of "data silos," which has become a significant technical bottleneck restricting the development of blockchain technology. In particular, how to achieve "usable but invisible" cross-chain identity information and further break down "data silos" to realize the technical requirement that "data is productivity" has become an important development direction for blockchain technology applications.

[0003] Existing cross-chain blockchain technologies are all based on cross-chain cryptocurrency exchange and rely on atomic swap technology to achieve cross-chain information exchange. While this type of technology can solve the problem of information flow between chains, it requires complex technology and has low overall efficiency, failing to meet the needs of lightweight cross-chain identity authentication applications. For example, in a scenario where a user wants to conduct a small-amount cross-chain transaction, using a notary mechanism to achieve cross-chain communication would consume a lot of computing power and be too reliant on a trusted third party, posing a risk of system centralization. Furthermore, when a user conducts a cross-consortium chain transaction, they want to achieve their business needs without revealing any identity information. Therefore, the aforementioned cross-chain information exchange based on cross-chain cryptocurrency exchange is no longer sufficient to meet the corresponding identity authentication requirements. Summary of the Invention

[0004] To address the aforementioned issues, this invention provides a cross-chain identity information sharing method based on commitment transferable signatures (CTS). It presents a method for achieving cross-chain identity authentication in blockchains based on commitment transferable signatures (CTS). This method enables anonymous identity authentication and is suitable for use in blockchains (consortium blockchains) and other systems with anonymous authentication requirements.

[0005] To achieve the above objectives, the technical solution adopted by this invention is: a cross-chain identity information sharing method based on commitment-transferable signatures, comprising the following steps:

[0006] S1, propose a commitment-transferable signature scheme CTS = (CTS.Setup, CTS.Commit, CTS.Randomize, CTS.KeyGen, CTS.Sign, CTS.Transfer, CTS.Verify);

[0007] S2, gives a protocol π = (NIZKSetup, NIZKProve, NIZKVerify, SimSetup) that can be directly extracted from non-interactive zero-knowledge proofs;

[0008] S3 combines the CTS scheme and the zero-knowledge proof protocol π to construct a cross-blockchain or cross-consortium identity authentication protocol.

[0009] S4, Share identity information based on the cross-blockchain or cross-consortium identity authentication protocol.

[0010] Step S1 is detailed as follows:

[0011] S11. Set the security parameter λ, run the Setup algorithm, and the Setup algorithm outputs common parameters; the common parameters define the message space M, the randomness space R of the commitment scheme, and the randomness space R′ of the Randomize algorithm;

[0012] S12. Input message m∈M, random number Rand∈R, run the Commit algorithm, and output a commitment value comm for m using the random number Rand;

[0013] S13. Sample Rand′ from R′, input common parameters params, commitment value comm, and random number Rand′, run the Randomize algorithm, and output another commitment value comm′;

[0014] S15. Input the common parameter params, run the KeyGen algorithm, and output a key pair (sk, pk) for the signature scheme;

[0015] S15. Input the common parameters params, the key pair (sk, pk) and the commitment comm, run the Sign algorithm, and output a signature σ for comm;

[0016] S16. Input commitment values ​​comm and comm′, and a signature σ for comm. Run the Transfer algorithm. The Transfer algorithm outputs a signature σ′ for the commitment value comm′.

[0017] S17. Input (params, pk, comm, σ). If the Verify algorithm passes the verification, output 1; otherwise, output 0.

[0018] The CTS signature scheme satisfies the following three properties:

[0019] (1) Correctness: The correctness of a given commitment transferable signature scheme includes the following two conditions:

[0020] (i) If for all common parameters params output by the Setup algorithm, for all m∈M, Rand∈R, Rand′∈R′, Randomize(Commit(params, m, Rand), Rand′) = Commit(params, m, Combine(Rand, Rand′)), that is, a commitment value can be correctly randomized;

[0021] (ii) If for all common parameters params output by the Setup algorithm, for all m∈M, Rand∈R, Rand′∈R′, the key pair (sk, pk) generated by the KeyGen algorithm, the σ generated by the Sign algorithm, and the σ′ generated by the Transfer algorithm, for the above inputs, the operation of Verify(params, pk, Commit(params, m, Rand), σ) and Verify(params, pk, Commit(params, m, Combine(Rand, Rand′)σ′)) can pass the verification, then the scheme is said to be correct;

[0022] (2) Simulation, which means that the transmitted signature σ′ does not reveal information about the input x;

[0023] (3) Unforgeability: If the probability of winning for all probabilistic polynomial-time adversaries A in the following interactive game is negligible, then the commit transferable signature scheme is said to be unforgeable:

[0024] a. Input generation phase: Set the security parameter λ, the challenger runs the Setup algorithm to generate common parameters params, and uses params as input to run the KeyGen algorithm to generate key pairs (sk, pk);

[0025] b. Inquiry Phase: Using (params, pk) as input, the adversary A, in probabilistic multinomial time, asks for (comm)... i m i Rand i For input, access the following Oracle database: if comm... i =Commit(params, mi Rand i If ), then return σ. i =Sign(params, sk, comm) i Otherwise, the process will be suspended.

[0026] c. Challenge Phase: The probabilistic multinomial time adversary A outputs (x, Rand, σ), runs the Commit algorithm with (x, Rand) as input, generates a commitment value comm, and then runs the Verify(params, pk, comm, σ) algorithm. If the Verify algorithm accepts the value and x has never been asked during the query phase, then the probabilistic multinomial time adversary A wins.

[0027] Step S2 provides a non-interactive zero-knowledge proof protocol π, which specifically includes the following steps:

[0028] S21. First, define a language L. para ={comm: There exists (m,Rand) such that comm = Commit(params,m,Rand)}. L's non-interactive proof system consists of the following probabilistic multinomial-time algorithms (Setup, Prove, Verify, SimSetup), and it has the following interface:

[0029] S22. Set the security parameter λ, run the Setup algorithm, and output a common string crs;

[0030] S23. Input a common string crs, and an assertion x∈L. para And other evidence w = (m, Rand), run the Prove algorithm, and output a proof π;

[0031] S24. Input a public string crs, an assertion x and a proof π, run the Verify algorithm. If the algorithm accepts the statement, output 1; otherwise, output 0.

[0032] S25. Set the security parameter λ, run the SimSetup algorithm, and output a simulated string ccrs and a trapdoor tk.

[0033] Step S3, constructing a cross-blockchain identity authentication protocol, specifically includes the following steps:

[0034] S31. The consortium blockchain runs the CTS.Setup algorithm, which outputs the common parameters of the CTS scheme. The common parameters define the message space M, the randomness space R of the commitment scheme, and the randomness space R′ of the Randomize algorithm.

[0035] S32. The consortium blockchain runs the NIZK.Setup algorithm and outputs a common string crs.

[0036] S33. Set the security parameter λ. The committee of consortium chain 1 runs the CTS.Keygen algorithm to generate a key pair (pk, sk).

[0037] S34. When a user A completes registration on the consortium blockchain, user A's account has two attributes: account number and amount, which are (x1, x2) respectively. When the user wants to apply for cross-chain credentials, the NIZK.Prove algorithm is first run to perform zero-knowledge proof on (x1, x2) to verify whether x1 is valid and whether x2 is ≥ a certain fixed value B. After the proof is passed, π is obtained.

[0038] S35. Next, input a random number r, and user A runs the CTS.Commit algorithm to commit to (x1, x2) and outputs the commitment c.

[0039] S36. User A sends the commitment value c and the proof π to the consortium blockchain committee. The committee verifies whether they are correct. If the verification is successful, the CTS.Sign algorithm is run to sign the commitment c and output σ.

[0040] S37. User A receives the committee's signature σ, then runs the CTS.Transfer algorithm, inputs a random number r′, signs σ, and commits c′ to generate a new signature σ′;

[0041] S38. Input a random number r′ and a commitment value c. User A runs the CTS.Randomize algorithm and outputs a new commitment value c′.

[0042] S39. Deploy a smart contract on the consumption chain, send the commitment c′ and signature σ′ to the smart contract, and after verification, send a consumption permission to the user.

[0043] A system for cross-chain identity information sharing based on commitment-transferable signatures includes a signature scheme construction module, a protocol construction module, and an authentication module.

[0044] The signature scheme building module is used to build a commitment-transferable signature scheme CTS = (CTS.Setup, CTS.Commit, CTS.Randomize, CTS.KeyGen, CTS.Sign, CTS.Transfer, CTS.Verify);

[0045] The protocol building module is used to construct a non-interactive zero-knowledge proof protocol π = (NIZKSetup, NIZKProve, NIZKVerify, SimSetup) that can be directly extracted; and to construct a cross-blockchain or cross-consortium identity authentication protocol by combining the CTS scheme and the zero-knowledge proof protocol π.

[0046] The authentication module shares identity information based on the aforementioned cross-blockchain or cross-consortium identity authentication protocol.

[0047] In addition, the present invention also provides a computer device, including a processor and a memory, wherein the memory is used to store a computer executable program, the processor reads the computer executable program from the memory and executes it, and the processor can realize the cross-chain identity information sharing method based on commitment transferable signature described in the present invention when executing the computer executable program.

[0048] Simultaneously, a computer-readable storage medium can be provided, in which a computer program is stored. When the computer program is executed by a processor, it can implement the cross-chain identity information sharing method based on commitment-transferable signatures described in this invention.

[0049] Compared with the prior art, the present invention has at least the following beneficial effects:

[0050] This invention employs the method described herein to provide a method for cross-chain identity authentication in blockchain based on Commitment Transferable Signature (CTS). This method achieves anonymous identity authentication and is suitable for use in blockchains (consortium blockchains) and other systems with anonymous authentication requirements. The method proposed in this invention can achieve anonymous identity authentication more efficiently and is more suitable for use in blockchains and other systems with anonymous authentication requirements, and has higher security and reliability. Attached Figure Description

[0051] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments;

[0052] Figure 1 This is a flowchart of the cross-chain identity information sharing method based on commitment-transferable signatures according to the present invention;

[0053] Figure 2 This is a schematic diagram of the algorithm flow for the CTS scheme;

[0054] Figure 3 Provide a schematic diagram of the algorithm flow for the zero-knowledge proof protocol π; Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0056] Digital signature mechanisms are an important cryptographic technique that can solve problems such as forgery, repudiation, impersonation, and tampering during information transmission. They have wide-ranging applications. This invention attempts to utilize a commitment-transferable signature method to meet the identity authentication needs across consortium blockchains, thus solving the problem of cross-chain identity information authentication.

[0057] refer to Figure 1 , Figure 2 and Figure 3 As shown, the present invention provides a cross-chain identity information sharing method based on a commitment-transferable signature, comprising the following steps:

[0058] S1, propose a commitment-transferable signature scheme CTS = (CTS.Setup, CTS.Commit, CTS.Randomize, CTS.KeyGen, CTS.Sign, CTS.Transfer, CTS.Verify);

[0059] S2, gives a protocol π = (NIZKSetup, NIZKProve, NIZKVerify, SimSetup) that can be directly extracted from non-interactive zero-knowledge proofs;

[0060] S3 combines the CTS scheme and the zero-knowledge proof protocol π to construct a cross-blockchain or cross-consortium identity authentication protocol.

[0061] S4, Share identity information based on the cross-blockchain or cross-consortium identity authentication protocol.

[0062] Furthermore, step S1 specifically includes:

[0063] First, set the security parameter λ, run the Setup algorithm, and the Setup algorithm outputs common parameters; the common parameters define the message space M, the randomness space R of the commitment scheme, and the randomness space R′ of the Randomize algorithm;

[0064] Given a message m∈M and a random number Rand∈R, run the Commit algorithm and output a commitment value comm for m using the random number Rand.

[0065] Sample Rand′ from R′, input common parameters params, commitment value comm, and random number Rand′, run the Randomize algorithm, and output another commitment value comm′;

[0066] Input the common parameters params, run the KeyGen algorithm, and output a key pair (sk, pk) for the signature scheme;

[0067] Input the common parameters params, the key pair (sk, pk) and the commitment comm, run the Sign algorithm, and output a signature σ for comm;

[0068] Input commitment values ​​comm and comm′, and a signature σ for comm, run the Transfer algorithm, and the Transfer algorithm outputs a signature σ′ for the commitment value comm′;

[0069] Input (params, pk, comm, σ). If the Verify algorithm passes the verification, output 1; otherwise, output 0.

[0070] The CTS signature scheme satisfies the following three properties:

[0071] (1) Correctness: The correctness of a given commitment transferable signature scheme includes the following two conditions:

[0072] (i) If for all common parameters params output by the Setup algorithm, for all m∈M, Rand∈R, Rand′∈R′, Randomize(Commit(params, m, Rand), Rand′) = Commit(params, m, Combine(Rand, Rand′)), that is, a commitment value can be correctly randomized;

[0073] (ii) If for all common parameters params output by the Setup algorithm, for all m∈M, Rand∈R, Rand′∈R′, the key pair (sk, pk) generated by the KeyGen algorithm, the σ generated by the Sign algorithm, and the σ′ generated by the Transfer algorithm, for the above inputs, the operation of Verify(params, pk, Commit(params, m, Rand), σ) and Verify(params, pk, Commit(params, m, Combine(Rand, Rand′)σ′)) can pass verification, then the scheme is said to be correct.

[0074] (2) Simulation, which means that the transmitted signature σ′ does not reveal information about the input x;

[0075] (3) Unforgeability: If the probability of winning for all probabilistic polynomial-time adversaries A in the following interactive game is negligible, then the commit transferable signature scheme is said to be unforgeable:

[0076] a. Input generation phase: Set the security parameter λ, the challenger runs the Setup algorithm to generate common parameters params, and uses params as input to run the KeyGen algorithm to generate key pairs (sk, pk);

[0077] b. Inquiry Phase: Using (params, pk) as input, the adversary A, in probabilistic multinomial time, asks for (comm)... i m i Rand i For input, access the following Oracle database: if comm... i =Commit(params, m i Rand i If ), then return σ. i =Sign(params, sk, comm) i Otherwise, the process will be suspended.

[0078] c. Challenge Phase: The probabilistic multinomial time adversary A outputs (x, Rand, σ), runs the Commit algorithm with (x, Rand) as input, generates a commitment value comm, and then runs the Verify(params, pk, comm, σ) algorithm. If the Verify algorithm accepts the value and x has never been asked during the query phase, then the probabilistic multinomial time adversary A wins.

[0079] Furthermore, the non-interactive zero-knowledge proof protocol π given in step S2 specifically includes the following steps:

[0080] First, define a language L. para ={comm: There exists (m,Rand) such that comm = Commit(params,m,Rand)}. L's non-interactive proof system consists of the following probabilistic multinomial-time algorithms (Setup, Prove, Verify, SimSetup), and it has the following interface:

[0081] Set the security parameter λ, run the Setup algorithm, and output a common string crs;

[0082] Input a common string crs, and an assertion x∈L para And other evidence w = (m, Rand), run the Prove algorithm, and output a proof π;

[0083] Given a public string crs, an assertion x and a proof π, run the Verify algorithm. If the algorithm accepts the statement, it outputs 1; otherwise, it outputs 0.

[0084] Set the security parameter λ, run the SimSetup algorithm, and output a simulated string ccrs and a trapdoor tk.

[0085] The cross-chain identity authentication method based on CTS in step S3, which constructs a cross-(consortium) blockchain identity authentication protocol, specifically includes:

[0086] The consortium blockchain runs the CTS.Setup algorithm, which outputs the common parameters of the CTS scheme. The common parameters define the message space M, the randomness space R of the commitment scheme, and the randomness space R′ of the Randomize algorithm.

[0087] The consortium blockchain runs the NIZK.Setup algorithm and outputs a common string crs.

[0088] With the security parameter λ set, the committee of consortium blockchain 1 runs the CTS.Keygen algorithm to generate a key pair (pk, sk);

[0089] When a user A completes registration on a consortium blockchain, user A's account has two attributes: account number and amount, which are (x1, x2) respectively. When the user wants to apply for cross-chain credentials, the NIZK.Prove algorithm is first run to perform zero-knowledge proof on (x1, x2) to verify whether x1 is valid and whether x2 is ≥ a certain fixed value B. After the proof is passed, π is obtained.

[0090] Next, a random number r is input, and user A runs the CTS.Commit algorithm to commit to (x1, x2) and outputs the commitment c;

[0091] User A sends the commitment value c and the proof π to the consortium blockchain committee. The committee verifies whether they are correct. If the verification is successful, the CTS.Sign algorithm is run to sign the commitment c and output σ.

[0092] User A receives the committee's signature σ, then runs the CTS.Transfer algorithm, inputs a random number r′, the signature σ, and the commitment c′ to generate a new signature σ′;

[0093] Given a random number r′ and a commitment value c, user A runs the CTS.Randomize algorithm and outputs a new commitment value c′.

[0094] Deploy a smart contract on the consumption chain, send the commitment c′ and signature σ′ to the smart contract, and after verification, send a consumption permission to the user.

[0095] The security of the cross-chain identity information sharing method stems from the security of the CTS and π schemes.

[0096] This invention adopts the above technical solution and provides a method for cross-chain identity authentication in blockchain using commit trans-errable signature (CTS). This method can not only efficiently achieve anonymous identity authentication, but is also suitable for use in blockchain (consortium blockchain) and other systems with anonymous authentication requirements.

[0097] Based on the concept described in this invention, a system for cross-chain identity information sharing based on commitment-transferable signatures is provided, including a signature scheme construction module, a protocol construction module, and an authentication module;

[0098] The signature scheme building module is used to build a commitment-transferable signature scheme CTS = (CTS.Setup, CTS.Commit, CTS.Randomize, CTS.KeyGen, CTS.Sign, CTS.Transfer, CTS.Verify);

[0099] The protocol building module is used to construct a non-interactive zero-knowledge proof protocol π = (NIZKSetup, NIZKProve, NIZKVerify, SimSetup) that can be directly extracted; and to construct a cross-blockchain or cross-consortium identity authentication protocol by combining the CTS scheme and the zero-knowledge proof protocol π.

[0100] The authentication module shares identity information based on the aforementioned cross-blockchain or cross-consortium identity authentication protocol.

[0101] In addition, the present invention can also provide a computer device, including a processor and a memory, wherein the memory is used to store a computer executable program, the processor reads part or all of the computer executable program from the memory and executes it, and the processor can realize the cross-chain identity information sharing method based on commitment transferable signature described in the present invention when executing part or all of the computer executable program.

[0102] On the other hand, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the cross-chain identity information sharing method based on commitment-transferable signatures as described in the present invention.

[0103] The computer device may be a laptop, a desktop computer, or a workstation.

[0104] The processor can be a central processing unit (CPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), or an off-the-shelf programmable gate array (FPGA).

[0105] The memory described in this invention can be an internal storage unit of a laptop, desktop computer, or workstation, such as memory or hard disk; or it can be an external storage unit, such as a portable hard disk or flash memory card.

[0106] Computer-readable storage media can include computer storage media and communication media. Computer storage media includes volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Computer-readable storage media can include: read-only memory (ROM), random access memory (RAM), solid-state drives (SSDs), or optical discs, etc. Random access memory can include resistive random access memory (ReRAM) and dynamic random access memory (DRAM).

[0107] Obviously, the described embodiments are only a part of the embodiments of this application, not all of them. Without conflict, the embodiments and features in the embodiments of this application can be combined with each other. The components of the embodiments of this application described and illustrated herein can generally be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of this application is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

Claims

1. A cross-chain identity information sharing method based on commitment-transferable signatures, characterized in that, Including the following steps: S1, propose a commitment-transferable signature scheme CTS=(CTS.Setup, CTS.Commit, CTS.Randomize, CTS.KeyGen, CTS.Sign, CTS.Transfer, CTS.Verify); S11. Set the security parameter λ, run the CTS.Setup algorithm, and the CTS.Setup algorithm outputs common parameters; the common parameters define the message space M, the randomness space R of the commitment scheme, and the randomness space R´ of the CTS.Randomize algorithm; S12. Input message m∈M, random number Rand∈R, run CTS.Commit algorithm, output a commitment value comm for m using random number Rand; S13. Sample Rand' from R', input common parameters params, commitment value comm, and random number Rand', run the CTS.Randomize algorithm, and output another commitment value comm'; S14. Input the common parameters params, run the CTS.KeyGen algorithm, and output a key pair (sk, pk) for the signature scheme; S15. Input the common parameters params, the key pair (sk, pk) and the commitment comm, run the CTS.Sign algorithm, and output a signature σ for comm; S16. Input commitment values ​​comm and comm', and a signature σ for comm. Run the CTS.Transfer algorithm. The CTS.Transfer algorithm outputs a signature σ' for the commitment value comm'. S17. Input (params, pk, comm, σ). If the CTS.Verify algorithm passes the verification, output 1; otherwise, output 0. S2 provides a protocol for directly extracting non-interactive zero-knowledge proofs, π = (NIZK.Setup, NIZK.Prove, NIZK.Verify, NIZK.SimSetup). S21. First, define a language L. para ={comm: There exists (m, Rand) such that comm = Commit(params, m, Rand)}; L's non-interactive proof system consists of the following probabilistic multinomial-time algorithms (NIZK.Setup, NIZK.Prove, NIZK.Verify, NIZK.SimSetup): S22. Set the security parameter λ, run the NIZK.Setup algorithm, and output a common string crs; S23. Input a common string crs, and an assertion x∈L. para And other evidence w=(m,Rand), run the NIZK.Prove algorithm, and output a proof of π; S24. Input a public string crs, an assertion x and a proof π, run the NIZK.Verify algorithm, output 1 if the algorithm accepts the statement, otherwise output 0; S25. Set the security parameter λ, run the NIZK.SimSetup algorithm, and output the simulated string ccrs and the trapdoor tk; S3 combines the CTS scheme and the zero-knowledge proof protocol π to construct a cross-blockchain or cross-consortium identity authentication protocol. S31. The consortium blockchain runs the CTS.Setup algorithm, which outputs the common parameters of the CTS scheme. The common parameters define the message space M, the randomness space R of the commitment scheme, and the randomness space R' of the CTS.Randomize algorithm. S32. The consortium blockchain runs the NIZK.Setup algorithm and outputs a common string crs. S33. Set the security parameter λ. The consortium blockchain committee runs the CTS.Keygen algorithm to generate a key pair (pk, sk). S34. When a user A completes registration on the consortium blockchain, user A's account has two attributes: account number and amount, which are (x1, x2) respectively. When the user wants to apply for cross-chain credentials, the NIZK.Prove algorithm is first run to perform zero-knowledge proof on (x1, x2) to verify whether x1 is valid and whether x2 is ≥ a certain fixed value B. After the verification is successful, π is obtained. S35. Next, input a random number r, and user A runs the CTS.Commit algorithm to commit to (x1, x2) and outputs the commitment c. S36. User A sends the commitment value c and the proof π to the consortium blockchain committee. The committee verifies whether they are correct. If the verification is successful, the CTS.Sign algorithm is run to sign the commitment c and output σ. S37. Input a random number r´ and a commitment value c. User A runs the CTS.Randomize algorithm and outputs a new commitment value c´. S38. User A receives the committee's signature σ, then runs the CTS.Transfer algorithm, inputs a random number r´, the signature σ, and the commitment c´ to generate a new signature σ´; S39. Deploy a smart contract on the consumption chain, send the commitment c´ and signature σ´ to the smart contract, and after the smart contract verifies the information, send a consumption permission to the user. S4, Share identity information based on the cross-blockchain or cross-consortium identity authentication protocol.

2. The cross-chain identity information sharing method based on commitment-transferable signatures according to claim 1, characterized in that, CTS = (CTS.Setup, CTS.Commit, CTS.Randomize, CTS.KeyGen, CTS.Sign, CTS.Transfer, CTS.Verify) must satisfy the following three properties: (1) Correctness: The correctness of a given commitment transferable signature scheme includes the following two conditions: (i) If for all common parameters params output by the CTS.Setup algorithm, for all m∈M, Rand∈R, Rand´∈R´, Randomize(Commit(params, m, Rand), Rand´)=Commit(params, m, Combine(Rand, Rand´)), that is, a commitment value can be correctly randomized; (ii) If for all common parameters params output by the CTS.Setup algorithm, for all m∈M, Rand∈R, Rand´∈R´, the key pair (sk, pk) generated by the CTS.KeyGen algorithm, the key pair σ generated by the CTS.Sign algorithm, and the key pair σ´ generated by the CTS.Transfer algorithm, for the above inputs, the operation of Verify(params, pk, Commit(params, m, Rand), σ) and Verify(params, pk, Commit(params, m, Combine(Rand, Rand´)σ´)) can pass the verification, then the scheme is said to be correct; (2) Simulation, which means that the transmitted signature σ´ will not reveal information about the input x; (3) Unforgeability: If the probability of winning for all probabilistic polynomial-time adversaries A in the following interactive game is negligible, then the commit transferable signature scheme is said to be unforgeable: a. Input generation phase: Set the security parameter λ, the challenger runs the CTS.Setup algorithm to generate common parameters params, and uses params as input to run the CTS.KeyGen algorithm to generate key pairs (sk, pk); b. Inquiry Phase: Using (params, pk) as input, the adversary A, in probabilistic multinomial time, asks for (comm)... i m i Rand i For input, access the following Oracle database: if comm... i =Commit(params, m i Rand i If ), then return σ. i =Sign(params, sk, comm) i Otherwise, the process will be suspended. c. Challenge Phase: The probabilistic multinomial time adversary A outputs (x, Rand, σ), and runs the CTS.Commit algorithm with (x, Rand) as input to generate a commitment value comm. Then, the CTS.Verify(params, pk, comm, σ) algorithm is run. If the CTS.Verify algorithm accepts the value and x has never been asked during the query phase, then the probabilistic multinomial time adversary A wins.

3. A system for cross-chain identity information sharing based on the commitment-transferable signature of the method described in claim 1, characterized in that, This includes a signature scheme construction module, a protocol construction module, and an authentication module; The signature scheme building module is used to build a commitment-transferable signature scheme CTS=(CTS.Setup, CTS.Commit, CTS.Randomize, CTS.KeyGen, CTS.Sign, CTS.Transfer, CTS.Verify); The protocol building module is used to construct a non-interactive zero-knowledge proof protocol π=(NIZK.Setup, NIZK.Prove, NIZK.Verify, NIZK.SimSetup) that can be directly extracted; and to construct a cross-blockchain or cross-consortium identity authentication protocol by combining the CTS scheme and the zero-knowledge proof protocol π. The authentication module shares identity information based on the aforementioned cross-blockchain or cross-consortium identity authentication protocol.

4. A computer device, characterized in that, It includes a memory and a processor, wherein the memory stores computer-readable instructions, which, when executed by the processor, cause the processor to perform the cross-chain identity information sharing method based on a commitment-transferable signature as described in any one of claims 1 to 2.

5. A storage medium storing computer-readable instructions, characterized in that, When the computer-readable instructions are executed by the processor, the processor performs the cross-chain identity information sharing method based on a commitment-transferable signature as described in any one of claims 1 to 2.

Images