A traceable anonymous authentication method and system

Abstract

The present invention discloses a traceable anonymous authentication method and system, the method comprising: a trusted third party as the credential issuer issues an attribute credential to a user using the issuer's private key signature; the user presents the attribute certificate in the attribute credential according to the verification requirements of the verification party; the verification party verifies the attribute certificate presented by the user, and if the verification passes, the authentication is successful; the credential issuer tracks the user's identity based on the attribute certificate presented by the malicious user sent by the verification party. The present invention achieves concise and efficient credential presentation. When presenting an attribute credential, the user does not need to present all attribute credential information, but only needs to present the portion of the attribute credential that needs to be verified, and an aggregation method is used to achieve efficient verification of the presented credential. The present invention achieves tracking of the identity of malicious users, and enables the issuer to track the identity of malicious users while ensuring that the identity privacy of non-malicious users will not be leaked during the credential presentation stage.

Description

Technical Field

[0001] The present invention relates to the technical field of anonymous identity authentication, and in particular to a traceable anonymous authentication method and system. Background Art

[0002] Anonymous identity authentication technology is a technical approach used in anonymous communication systems, primarily to provide anonymity to communicating entities. Because anonymous authentication entities are difficult to track and revoke, various abuses of anonymity are rampant in anonymous authentication systems. Identity hiding mechanisms based on the "unnamed" mechanism have been used to construct anonymous communication networks rife with illegal activities, causing significant harm and impact on society and individuals. Anonymous credential technology is one of the main methods for achieving anonymous identity authentication. Compared to traditional digital certificates, users can prove to service providers that their identity credentials belong to a specific set of users (a set of users eligible to access a service), based on specific scenarios. However, service providers cannot identify the specific user within that set. The most popular solution currently is the Identity Mixer solution proposed by IBM in 2009. Anonymous credentials allow identity providers to issue credentials (or certificates) to users. These certificates contain user attributes, such as address or date of birth, as well as the user's rights or roles. Anonymous credential systems involve the roles of issuer, recipient, certifier, and verifier. Certificate issuance occurs between the issuer and recipient, who possesses the certificate. A credential consists of a set of attribute values ​​and cryptographic information that allows the credential owner to establish proof of ownership. When creating a certificate, the credential owner acts as a prover, communicating with a verifier. Using a certificate, a user can prove to a third party that they possess a certificate containing a given attribute or role, without revealing any other information stored in the certificate. Proving possession of a given certificate involves disclosing a selected subset of the attributes contained in the certificate, proving that the attributes are within a given range, proving that the attributes are verifiably encrypted under the public key of a third party, or generating a commitment to a specific attribute. In addition to the basic functionality of anonymous certificate systems—selectively revealing attributes contained in a certificate—other features include certificate revocation, anonymity revocation, valid encoding of binary attributes, or verifiably encrypting attributes under the cryptographic key of a third party. These important features are somewhat independent, with different setup assumptions and trust models.

[0003] In recent years, the following algorithms have been combined and implemented in anonymous credential research: 1) Signature schemes (Camenisch-Lysyanskaya (CL) / BBS) that can be used to issue credentials. These signature schemes support message blocks, meaning that one signature can sign many messages. In simple credentials, each attribute value is treated as a separate message, and the attribute is signed. Signatures allow users to use efficient zero-knowledge proofs of knowledge to prove possession of a signature without revealing the underlying message or even the signature itself. 2) Using compact encoding to combine multiple attribute values ​​into a single message, achieving message aggregation. 3) Combining with blind signature technology, in which the recipient only provides the issuer with a commitment to the attribute values ​​to be included in the credential. Pseudonyms are always used to authenticate the recipient. In blind signature protocols, users can obtain the signer's signature through blind signatures, but the signer cannot obtain information about the signed message or the final signature.

[0004] While anonymous authentication protects user privacy, it also makes it difficult to control malicious users, potentially negatively impacting the system. Therefore, from the perspective of protecting service providers and combating illegal users, revoking identity anonymity, preventing anonymous identity lending, and, in specific circumstances, allowing service providers to obtain users' real identities through trusted third parties are all issues that should be considered in the design and implementation of anonymous identity authentication. Currently, the primary approach to tracking malicious users is to establish a trusted third party, enabling the trusted party to retrieve the user's real identity when necessary, thereby enabling tracking of malicious users. In addition to commonly used revocation methods, the authentication process can be linked to user privacy, preventing anonymous identity lending through authentication itself. This approach compromises anonymous identity lending at the cost of privacy, a fundamental benefit for users using anonymous identity authentication systems. Therefore, users, motivated by their own interests, will naturally be reluctant to lend their anonymous identities. This approach is unique in that it does not require any external elements or restrictions on the number of authentication attempts. Regarding anonymous identity revocation, in practice, a short anonymous identity validity period is sometimes employed to achieve coarse-grained revocation. As for revocation in general, current methods usually implement it through blacklist matching. In this scenario, the verifier maintains a user blacklist (BL). For user access, the verifier can detect whether the user is on the blacklist and deny access if so. However, since the user's identity cannot be obtained, direct matching is impossible, so a specific protocol is required to implement it. However, the problem with all the above solutions is that the verification time increases linearly with the size of the BL, which will have a significant impact on system efficiency. Therefore, how to prevent users from engaging in malicious activities while achieving strong anonymous authentication is an important direction of strong anonymous authentication research. Summary of the Invention

[0005] The main purpose of the present invention is to provide a traceable anonymous authentication method and system, which aims to protect the privacy of the authenticated user's credentials while tracking malicious users afterwards, achieve efficient presentation of attribute proofs in the credentials, and improve computing efficiency.

[0006] To achieve the above object, the present invention provides a traceable anonymous authentication method, which comprises the following steps:

[0007] S1: The certificate issuer generates a private key signature and issues an attribute certificate to the user;

[0008] S2: The user presents the attribute certificate in the attribute certificate according to the verification requirements of the verifier;

[0009] S3: The verifier verifies the attribute certificate presented by the user. If the verification passes, the authentication is successful. If the verification fails, the authentication fails.

[0010] S4: The credential issuer tracks the user's identity based on the attribute proof presented by the malicious user sent by the verifier.

[0011] Optionally, in step S1, the certificate issuer generates a private key signature step, specifically including:

[0012] S111: Select an additive group G1 with generator g1 and order P and an additive group G2 with generator g2 and order P, and also include a discrete logarithm relation g1=Ψ(g2) about the generators g1 and g2, (G1, G2) satisfies a (τ, t, ε) co-GDH group pair, and the multiplicative group G T The generator of in It is a bilinear map

[0013] S112: Random Selection As the master private key pair (ω,θ), calculate u=g2 ω ∈G2,v←g2 θ ∈G2 as the master public key pair (u,v);

[0014] S113: Random Selection and As a tracking private key pair (ξ1,ξ2), let a,b∈G1 such that As tracking public key (l,a,b);

[0015] S114: Select global hash function H:{0,1} * →G1,

[0016] S115: System Open The system saves msk={ω,θ}, gsk={ξ1,ξ2}.

[0017] Optionally, in step S1, the step of issuing an attribute certificate to the user specifically includes:

[0018] S121: User randomly selects secret information Aggregate all secret information to obtain the aggregate private key Calculate the commitment based on the public parameters (u,v) Find the aggregate commitment The attribute information {m i}、Commitment{M i}, aggregate commitment M, aggregate private key r are sent to the issuer, and the commitment certificate NIZK1{γ:M=g1 γ};

[0019] S122: The issuer verifies the zero-knowledge proof of commitment;

[0020] S123: The issuer calculates h based on the message sent by the user i ←H(m i ), attribute signature C i ←h i ω ·M i θ ;

[0021] S124: Issuer randomly selects Calculate A←g1 1 / (ω+x) , use (A,x) as the user's private key pair and record it in the user list;

[0022] S125: The issuer sends the user's private key {A,x} and the attribute signature {C i}Sent to the user.

[0023] Optionally, step S2 specifically includes:

[0024] S21: The user aggregates the attribute information to be proved, the attribute signature and the related random secret information

[0025] S22: User blinded aggregate signature C: randomly select one Blind signature C ′ ←C k , and present proof of blinded signature

[0026] S23: The user uses the user's private key (A, x) to sign the aggregated attribute information that needs to be verified: randomly selected calculate Get the knowledge signature σ={T1,T2,T3} and present the proof of the knowledge signature

[0027] S24: The user will blind the signature C ′ Its proof and knowledge signature σ and its proof are sent to the verifier as a proof of presentation.

[0028] Optionally, the step S3 specifically includes: after receiving the presentation certificate, the verifier first verifies the commitment of the blinded signature and the proof of the knowledge signature. When both are established at the same time, the verifier passes the verification of the presentation certificate.

[0029] Optionally, step S4 specifically includes:

[0030] S41: The verifier sends the verified malicious user's presented credentials to the issuer;

[0031] S42: The issuer uses the tracking private key gsk = {ξ1,ξ2} to recover the user's private key: calculation By comparing A that is the same as A′ in the user list, the user private key pair (A, x) is found, thereby determining the identity of the malicious user and achieving identity tracking.

[0032] In addition, in order to achieve the above-mentioned purpose, the present invention further provides a traceable anonymous authentication device, the device comprising:

[0033] The generation and issuance module is used by the certificate issuer to generate and issue private key signatures and issue attribute certificates to users;

[0034] The presentation module is used for the user to present the attribute proof in the attribute certificate according to the verification requirements of the verification party;

[0035] The verification module is used by the verification party to verify the attribute certificate presented by the user. If the verification passes, the authentication is successful; if the verification fails, the authentication fails;

[0036] The tracking module is used by the credential issuer to track the user identity based on the attribute proof presented by the malicious user sent by the verifier.

[0037] In addition, in order to achieve the above-mentioned purpose, the present invention also provides a traceable anonymous authentication system, which includes a credential issuer, a user and a verifier; wherein the credential issuer, the user and the verifier include: a memory, a processor and a traceable anonymous authentication program stored on the memory and executable on the processor, and when the traceable anonymous authentication program is executed by the processor, the steps of the traceable anonymous authentication method described above are implemented.

[0038] In addition, to achieve the above-mentioned purpose, the present invention further provides a storage medium, on which a traceable anonymous authentication program is stored. When the traceable anonymous authentication program is executed by a processor, the steps of the traceable anonymous authentication method described above are implemented.

[0039] The traceable anonymous authentication method and system proposed in the embodiments of the present invention have the following advantages:

[0040] 1) The anonymous authentication protocol designed in this invention realizes the simplicity and efficiency of credential presentation. When presenting attribute credentials, users do not need to present all attribute credential information, but only need to present the part of attribute credentials that need to be verified. In addition, the aggregation method is used to achieve efficient verification of the presented credentials.

[0041] 2) The anonymous authentication protocol designed by the present invention realizes the tracking of malicious user identities, and enables the issuing party to track the identities of malicious users while ensuring that the identity privacy of non-malicious users will not be leaked during the credential presentation stage. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 Schematic diagram of the efficient and traceable anonymous authentication process of the present invention;

[0043] Figure 2 This is the efficient and traceable anonymous authentication protocol diagram of the present invention.

[0044] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0045] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0046] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0047] This paper provides an efficient and traceable anonymous authentication protocol, which is an identity authentication protocol that can protect privacy. It can ensure that the user who presents the certificate does not expose too much private information to the verifier during authentication. At the same time, when the verifier finds that the user has malicious behavior, it can request the credential issuer to trace the user's true identity.

[0048] This embodiment Figure 1-Figure 2As shown in Figure 1, the main idea is: 1. A trusted third party, acting as the credential issuer, issues an attribute credential to the user using the issuer's private key. 2. The user presents the attribute proof in the attribute credential according to the verification requirements of the verifier. 3. The verifier verifies the attribute proof presented by the user, and authentication is successful if the verification passes. 4. The credential issuer uses the attribute proof presented by the malicious user, sent by the verifier, to track the user's identity. This protocol, as a basic cryptographic protocol, can be applied to the field of privacy computing to protect the privacy of both communicating parties.

[0049] The efficient and traceable anonymous authentication method consists of five algorithms: key generation algorithm AC.Generate, credential issuance algorithm AC.Issue, credential presentation algorithm AC.Show, credential verification algorithm AC.Verify and identity tracking algorithm AC.Trace.

[0050] (1) Key Generation Algorithm AC.Generate: This algorithm is run by the credential issuer (Issuer). It takes as input the security parameter λ and outputs the system public parameter mpk, the master private key msk, and the tracking private key gsk. The Issuer publishes gpk and keeps msk and gsk secret. The specific operation process is as follows:

[0051] 1) Choose an additive group G1 of order P with generator g1 and an additive group G2 of order P with generator g2, and also a discrete logarithm relation g1 = Ψ(g2) about the generators g1 and g2, where (G1, G2) satisfies a (τ, t, ε) co-GDH group pair. T The generator of in It is a bilinear map

[0052] 2) Random selection As the master private key pair (ω,θ), calculate u=g2 ω ∈G2,v←g2 θ ∈G2 as the master public key pair (u,v);

[0053] 3) Random selection and As a tracking private key pair (ξ1,ξ2), let a,b∈G1 such that As tracking public key (l,a,b);

[0054] 4) Select the global hash function H:{0,1} * →G1,

[0055] 5) System disclosure The system saves msk={ω,θ}, gsk={ξ1,ξ2}.

[0056] (2) Credential issuance algorithm AC.Issue: This algorithm is run interactively by the issuer and the user. The input is the user's attribute information m1,…,m n , message commitment, and the issuer's master private key, the algorithm outputs a valid certificate issued for the attribute information. The specific operation process is as follows:

[0057] 1) The user randomly selects secret information Aggregate all secret information to obtain the aggregate private key Calculate the commitment based on the public parameters (u,v) Find the aggregate commitment The attribute information {m i}、Commitment{M i}, aggregate commitment M, aggregate private key r are sent to the issuer, and the commitment certificate NIZK1{γ:M=g1 γ};

[0058] 2) The issuer verifies the zero-knowledge proof of commitment;

[0059] 3) The issuer calculates h based on the message sent by the user i ←H(m i ), attribute signature C i ←h i ω ·M i θ ;

[0060] 4) The issuing party is randomly selected Calculate A←g1 1 / (′+x) , use (A,x) as the user's private key pair and record it in the user list;

[0061] 5) The issuer sends the user's private key {A,x} and attribute signature {C i}Send to user;

[0062] (3) Credential Presentation Algorithm AC.Show: This algorithm is executed by the user. The input is N (N≤n) attributes TA={a1,…,a N}, user attribute information, secret information, attribute signature and user private key. The specific operation process is as follows:

[0063] 1) The user aggregates the attribute information to be proved, the attribute signature and the related random secret information

[0064] 2) User blinded aggregate signature C: randomly select one Blinded signature C′←C k , and present proof of blinded signature

[0065] 3) The user uses the user's private key (A, x) to sign the aggregated attribute information that needs to be verified: randomly selected calculate Get the knowledge signature σ={T1,T2,T3} and present the proof of the knowledge signature

[0066] 4) The user will blind the signature C ′ Its proof and knowledge signature σ and its proof are sent to the verification party as a proof of presentation;

[0067] (4) Presentation of the credential verification algorithm AC.Verify: This algorithm is run by the Verifier. The specific operation process is as follows:

[0068] 1) After receiving the presentation certificate, the verifier first verifies the commitment of the blinded signature and the proof of the knowledge signature. When both are true, the verifier passes the verification of the presentation certificate;

[0069] (5) Identity tracing algorithm AC.Trace: This algorithm is run by the issuing party. The specific operation process is as follows:

[0070] 1) The verifier sends the verified malicious user's credentials to the issuer;

[0071] 2) The issuer uses the tracking private key gsk = {ξ1,ξ2} to recover the user's private key: Calculate By comparing with A in the user list ′ For the same A, we can find the user’s private key pair (A, x), thereby determining the malicious user’s identity and achieving identity tracking.

[0072] (1) For: NIZK1{γ:M=g1 γ}

[0073] The prover needs to prove his possession of knowledge γ to the verifier, and the verifier completes the verification by executing a non-interactive protocol.

[0074] 1) The prover is randomly selected calculate s γ ←r γ +cγ and c γ 、s γ Send to the verifier;

[0075] 2) Verifier calculation and verify Is it established? If so, it passes the verification.

[0076] (2) For:

[0077] The prover needs to prove the possession of knowledge λ,μ to the verifier, and the verifier completes the verification by executing a non-interactive protocol.

[0078] 1) Both parties make their own pre-calculation

[0079] 2) The prover is randomly selected calculate s λ ←r λ +cλ,s μ ←r μ +cμ and c m 、s λ 、s μ Send to the verifier;

[0080] 3) Verifier calculation and verify

[0081] Is it established? If so, it passes the verification.

[0082] (3) For:

[0083] The prover needs to prove to the verifier that he has signed the message h using the secret ζ,η, and the verifier completes the verification by executing a non-interactive protocol.

[0084] 1) The prover is randomly selected Compute the linear encryption with respect to ζ: T1←a α , T2←b β , T3←ζl α+β , and simultaneously calculate two auxiliary values ​​δ1←ηα and δ2←ηβ;

[0085] 2) The verification party proves the possession of knowledge α, β, η, δ1, δ2, which satisfies a α =T1,b β =T2, Random selection Calculate the commitment value first Recalculate the challenge value Finally calculate the response value s α =r α +cα,s β =r β +cβ,s η =r η + cη, And c, sα 、s β 、s η 、 Send to the verifier;

[0086] 3) The verifier calculates

[0087] Revalidation Is it true? If so, it passes the verification.

[0088] This embodiment proposes a traceable anonymous authentication method based on an aggregate signature and an anonymous credential system, utilizing zero-knowledge proof. This method can protect the privacy of authenticated users during the presentation of their credentials while tracking malicious users afterwards, achieving efficient presentation of attribute proofs in the credentials and improving computational efficiency.

[0089] The embodiment of the present invention further provides a traceable anonymous authentication device, comprising:

[0090] The generation and issuance module is used by the certificate issuer to generate and issue private key signatures and issue attribute certificates to users;

[0091] The presentation module is used for the user to present the attribute proof in the attribute certificate according to the verification requirements of the verification party;

[0092] The verification module is used by the verification party to verify the attribute certificate presented by the user. If the verification passes, the authentication is successful; if the verification fails, the authentication fails;

[0093] The tracking module is used by the credential issuer to track the user identity based on the attribute proof presented by the malicious user sent by the verifier.

[0094] Other embodiments or specific implementations of the traceable anonymous authentication device of the present invention can refer to the above-mentioned method embodiments and will not be described in detail here.

[0095] In addition, the present invention also proposes a traceable anonymous authentication system, which includes a credential issuer, a user and a verifier; wherein the credential issuer, the user and the verifier include: a memory, a processor and a traceable anonymous authentication program stored on the memory and executable on the processor, and when the traceable anonymous authentication program is executed by the processor, the steps of the traceable anonymous authentication method described above are implemented.

[0096] The specific implementation of the traceable anonymous authentication device of the present application is basically the same as the various embodiments of the traceable anonymous authentication method described above, and will not be repeated here.

[0097] The present invention also provides a computer-readable storage medium, including a computer-readable storage medium, storing a traceable anonymous authentication program. The computer-readable storage medium may be a memory device in a terminal, or at least one of a ROM (Read-Only Memory) / RAM (Random Access Memory), a magnetic disk, and an optical disk. The computer-readable storage medium includes instructions for enabling a traceable anonymous authentication device with a processor to execute the traceable anonymous authentication method described in various embodiments of the present invention.

[0098] The specific implementation of the traceable anonymous authentication program in the readable storage medium of the present application is basically the same as the various embodiments of the traceable anonymous authentication method described above, and will not be repeated here.

[0099] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0100] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0101] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0102] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A traceable anonymous authentication method, characterized in that: The method comprises the following steps: S1: The certificate issuer generates a private key signature and issues an attribute certificate to the user; S2: The user presents the attribute certificate in the attribute certificate according to the verification requirements of the verifier; S3: The verifier verifies the attribute certificate presented by the user. If the verification passes, the authentication is successful. If the verification fails, the authentication fails. S4: The credential issuer tracks the user's identity based on the attribute proof presented by the malicious user sent by the verifier; In step S1, the certificate issuer generates and issues a private key signature, which specifically includes: S111: Select a generator Order The additive group and a generator for Order The additive group , also includes a generator The discrete logarithmic relationship , Satisfaction is a co-GDH group pair, multiplicative group The generator of ,in It is a bilinear map ; S112: Random Selection As a master private key pair ,calculate As a master public key pair ; S113: Random Selection and As a tracking private key pair ( ,make Make As a tracking public key ; S114: Select global hash function , ; S115: System public mpk , the system saves msk , gsk ; In step S1, the step of issuing an attribute certificate to the user specifically includes: S121: User randomly selects secret information , aggregate all secret information and obtain the aggregate private key , according to the public parameters , calculate commitment , find the aggregate commitment , attribute information ,promise , Aggregate Commitment , aggregate private key Sent to the issuer and present proof of commitment ; S122: The issuer verifies the zero-knowledge proof of commitment; S123: The issuer calculates based on the message sent by the user , attribute signature ; S124: Issuer randomly selects ,calculate ,Will As the user's private key pair and recorded in the user list; S125: The issuer sends the user's private key and the property signature Sent to the user.

2. The traceable anonymous authentication method according to claim 1, wherein: The step S2 specifically includes: S21: The user aggregates the attribute information to be proved, the attribute signature and the related random secret information , , ; S22: User blinded aggregate signature : Randomly select one , blinded signature , and present proof of blinded signature ; S23: User uses user private key Perform knowledge signature on the aggregated attribute information that needs to be verified: Randomly select ,calculate , , , get the knowledge signature , and present proof of knowledge signature ; S24: User will blind the signature Its proof and knowledge signature and its proof are sent to the verifier as proof of presentation.

3. The traceable anonymous authentication method according to claim 2, wherein: Said step S3 specifically includes: after receiving the presentation certificate, the verifier first verifies the commitment of the blinded signature and the proof of the knowledge signature. When both are established at the same time, the verifier passes the verification of the presentation certificate.

4. The traceable anonymous authentication method according to claim 3, wherein: The step S4 specifically includes: S41: The verifier sends the verified malicious user's presented credentials to the issuer; S42: Issuer uses tracking private key gsk Recovering the user's private key: Calculation , by comparing with Same , find the user's private key pair , thereby determining the identity of malicious users and achieving identity tracking.

5. A traceable anonymous authentication system, characterized in that: The traceable anonymous authentication system includes a credential issuer, a user, and a verifier; wherein the credential issuer, the user, and the verifier include: a memory, a processor, and a traceable anonymous authentication program stored on the memory and executable on the processor, wherein the traceable anonymous authentication program, when executed by the processor, implements the steps of the traceable anonymous authentication method as described in any one of claims 1 to 4.

Images