Attribute-based anonymous credential system supporting threshold aggregation

Abstract

Distributed systems such as blockchain require that the reliability, trustworthiness and availability of the system are guaranteed even if there is a certain number of dishonest or faulty nodes, so it is no longer feasible to deploy existing attribute-based credential schemes in distributed systems. The present application relates to an attribute-based anonymous credential system supporting threshold aggregation. In view of the problem that existing anonymous credential schemes cannot be deployed in distributed systems, an attribute-based anonymous credential supporting threshold issuance and threshold tracking is proposed based on unlinkable editable signatures by combining Shamir threshold secret sharing, ElGamal encryption and knowledge signature technology. The present application simultaneously supports threshold issuance of credentials and threshold tracking of user identity, so that stable credential issuance and reliable user audit can be achieved when the anonymous credential scheme is deployed in a distributed environment. In addition, the present application also supports efficient selective attribute disclosure proof and realizes low storage and computing consumption.

Description

Technical Field

[0001] The present invention belongs to the technical field of credential systems, and in particular relates to an attribute-based anonymous credential system supporting threshold aggregation. Background Art

[0002] Blockchain is an immutable, shared, distributed ledger that can be used to record transaction information in various commercial applications. Deploying anonymous credentials within a blockchain system facilitates the auditing and tracking of digital assets. In blockchain platforms such as Ethereum and Hyperledger, credential issuers are typically integrated into blockchain nodes, and credential distribution is automated through smart contracts.

[0003] However, distributed systems like blockchains require guaranteed reliability, trustworthiness, and availability even in the presence of a certain number of dishonest or faulty nodes. Conventional attribute credential schemes, which rely on a single credential issuer, are no longer suitable for blockchain systems. Threshold credential schemes, which only require a threshold number of issuers to be online to achieve stable credential issuance, are therefore well-suited for deployment in blockchain systems.

[0004] Sonnino et al. first proposed a threshold credential scheme, Coconut, and integrated it into Ethereum and Chainspace systems. Coconut supports threshold publication of private and public attributes, selective disclosure proof of user attributes, and constant-size user credentials. However, Coconut does not support threshold tracking of user identities. Furthermore, the communication and computational complexity of credential verification in this scheme increases linearly with the number of user attributes, limiting its deployment in large-scale user attribute applications.

[0005] To protect user privacy while investigating malicious user behavior, user identity tracking becomes a necessary feature of enhanced attribute credentialing solutions. User identity tracking can help governments and businesses implement internal governance, such as identity management, data auditing, and personnel accountability. To prevent the abuse of tracking power, tracking rights need to be assigned to multiple trackers, and tracking procedures can only be executed if a threshold number of trackers cooperate.

[0006] In large-scale concurrent applications, low credential verification overhead is crucial for improving the stability of authentication services. In the Coconut scheme, regardless of how many user attributes are exposed by the credential verification algorithm, the computational cost of verifying user credentials increases linearly with the number of user attributes; this complexity is not ideal for applications that publish a large number of user attributes. For example, the Anonymous Credentials (IRMA) system developed by the Privacy Preserving Design Foundation supports real-world attributes widely used by governments and businesses, including diplomas, passports, electronic cards, and membership IDs for online services, as well as attributes related to user computing devices, such as hardware platforms and software configurations. These attributes go beyond personal attributes such as name, gender, address, and position, and the number of attributes for some users may increase to hundreds. Therefore, it is necessary to reduce the computational cost of verifying user credentials in applications.

[0007] Numerous distributed and traceable anonymous credential schemes have been proposed due to their flexible deployment, privacy protection, and auditability. Garman et al. first proposed a decentralized anonymous credential scheme based on a distributed ledger. Their scheme could issue publicly auditable credentials without a trusted publisher; however, their scheme required computationally expensive double discrete logarithm proofs to verify credentials. Later, Yang et al. constructed a decentralized anonymous credential scheme using a blacklist-based authentication method that avoided the computationally complex double discrete logarithm proofs. However, neither the schemes of Garman et al. nor Yang et al. support threshold-based credential issuance or identity tracking.

[0008] Hebant et al. proposed a multi-issuer attribute credential scheme using aggregatable signatures with randomized tags. Their scheme supports traceability and, for the first time, achieves that the computational cost of credential display is independent of the number of user attributes and the number of credential issuers. However, because they use an aggregated approach to implement attribute leakage proof, the scheme does not support relational proof of hidden attributes. In addition, their scheme does not support threshold issuance of credentials and threshold tracing of identities. Sonnino et al. proposed "Coconut", a threshold attribute credential scheme based on PS signatures; then, Rial et al. analyzed the security of Coconut in a general composable model. However, Coconut does not solve the threshold tracing problem of user identity, and the computational overhead of credential verification increases linearly with the number of user attributes.

[0009] In addition, some group signature schemes also implement threshold publishing and threshold tracking functions. For example, Gennaro et al. proposed an extended BBS and CL group signature scheme to support threshold issuance of credentials; however, their scheme uses signature and encryption technology to construct, which results in huge storage consumption when implementing threshold tracking. Recently, Camenisch et al. proposed a short threshold dynamic group signature scheme. They gave a formal model of threshold dynamic group signature, defined the security properties when there are multiple publishers and multiple trackers, and proposed an efficient and provably secure instantiation construction using PS signatures. However, none of the above group signature schemes are attribute-based and therefore cannot implement fine-grained access control. Summary of the Invention

[0010] In view of the above problems in the prior art, the present invention proposes a new threshold anonymous credential scheme based on unlinkable editable signature (URS) by integrating Shamir threshold cryptography technology, ElGamal encryption scheme and knowledge signature technology.

[0011] First, the present invention supports functions such as threshold release of private and public attributes and selective leakage proof of user attributes, so that the attribute credential scheme can achieve stable credential release and fine-grained access control when deployed in a distributed environment; and the present invention supports threshold tracking of user identity, making it more suitable for deployment in anonymous but responsible distributed applications.

[0012] Considering that distributed systems such as blockchains require that the reliability, trustworthiness and availability of the system can be guaranteed even if there are a certain number of dishonest or faulty nodes, it is no longer feasible to deploy existing attribute credential schemes in distributed systems. The present invention relates to an attribute-based anonymous credential system that supports threshold aggregation. In order to solve the problem that existing anonymous credential schemes cannot be deployed in distributed systems, the system proposes an attribute-based anonymous credential that supports threshold issuance and threshold tracking by integrating Shamir threshold secret sharing, ElGamal encryption and knowledge signature technology on the basis of unlinkable editable signatures. The present invention simultaneously supports threshold issuance of credentials and threshold tracking of user identities, so that the anonymous credential scheme can also achieve stable credential issuance and reliable user auditing when deployed in a distributed environment. In addition, the present invention also supports efficient selective attribute leakage proof and achieves lower storage and computing consumption.

[0013] The technical solution specifically adopted by the present invention to solve the technical problem is:

[0014] An attribute-based anonymous credential system supporting threshold aggregation includes the following six entities:

[0015] TTP, as a one-time trusted third party, is responsible for setting up the system initially andI A publisher distributes public and private key pairs;

[0016] I i , as an independent publisher, is used to issue some attribute credentials for users; the system is set up with n I publishers, and as long as there are at least t I As long as there is an honest publisher online, the complete attribute certificate can be issued to the user;

[0017] T i , as an independent tracker, used to track user identity; the system is set up with n T trackers, and as long as at least t T If there is an honest tracker online, the user tracking program can be executed;

[0018] U has a set of private attributes, I t in it I A publisher requests a credential and then obtains t I Partial attribute credentials can be aggregated into a complete attribute credential; when revealing the credential, U needs to disclose a subset of attributes to V or provide a relationship proof of hidden attributes;

[0019] V,is a credential verifier, used to verify the correctness of the credential display token generated by the user;

[0020] It is a public database that only adds data. When a user registers, the publisher stores the user registration information in When tracking a user, the tracker Traverse user registration information;

[0021] The basic workflow of the system is as follows:

[0022] TTP sets the system parameters and sets the I Publishers distribute keys; each tracker T i (i∈[1,n T ]) Generate a public-private key pair for tracking user identity and publish its public key; when user U applies for attribute certificate, U sends a private key to n I The publisher submits an application;

[0023] Each online publisher publishes some attribute credentials for U and stores the user registration information in the user registration list

[0024] From t IAfter a publisher receives a partial attribute certificate, U aggregates all partial attribute certificates into a complete attribute certificate. When the certificate needs to be displayed, U calculates a certificate display token and discloses a subset of attributes or calculates a relationship proof of hidden attributes. When any token generated by user U needs to be tracked, t T Online trackers collaborate to track user identities.

[0025] Furthermore, As a blockchain, when a user registers, the publisher writes the user registration information into the blockchain by initiating a transaction protocol.

[0026] Furthermore, Sander's polynomial-based unlinkable editable signature (URS) is applied to credential issuance. In the credential issuance algorithm, the user divides his private key into nT shares using Shamir's secret sharing scheme, encrypts each share using ElGamal's encryption scheme, and then sends the ciphertext of all shares to all issuers as part of the registration information. In the credential display algorithm, the user calculates a knowledge signature of a private key. In the tracking algorithm, the tracker uses a pairing-based equation to determine whether the private key hidden in the knowledge signature is consistent with the private key hidden in the registration information.

[0027] Furthermore, in the credential issuance algorithm, the user uses the ElGamal algorithm to encrypt each private attribute and calculate the knowledge signature of each ciphertext to prove the correctness of all ciphertexts; after the user receives the signature of the ciphertext, it uses its homomorphism to deblind the signature to obtain the credential of the private attribute.

[0028] Furthermore, the knowledge signature is specifically:

[0029] For any polynomial-time nondeterministic relation NP language The knowledge signature consists of three algorithms: parameter generation Gen, signature Sign, and signature Verify:

[0030] (1)Gen(1 λ )→pp: Input security parameter 1 λ , generating public parameters pp;

[0031] (2) Sign(y,x,m)→Π: Input message m and an NP relation (x,y) to generate a knowledge signature

[0032] (3)Verify(y,Π,m)→0 / 1: Input message m, And the knowledge signature Π, if the verification is successful, output 1, otherwise output 0.

[0033] Compared with the prior art, the present invention and its preferred embodiments have the following beneficial effects:

[0034] (1) The present invention supports functions such as threshold release of private and public attributes and selective disclosure proof of user attributes, so that the attribute credential scheme can achieve stable credential release and fine-grained access control when deployed in a distributed environment.

[0035] (2) The present invention supports threshold tracking of user identities, making it more suitable for deployment in anonymous but accountable distributed applications, and uses unlinkable editable signatures to achieve efficient selective disclosure proof.

[0036] (3) The present invention can be applied to anonymous reporting systems and anonymous currency systems based on permission chains to improve the privacy of the systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments:

[0038] Figure 1 A system model diagram for the implementation of the present invention;

[0039] Figure 2 This is an application example of the present invention: a diagram of an anonymous reporting system with an accountability mechanism;

[0040] Figure 3 This is another application example of the present invention: an anonymous currency system diagram based on permission chain. DETAILED DESCRIPTION

[0041] To make the features and advantages of this patent more clearly understood, the following embodiments are specifically described in detail as follows:

[0042] It should be noted that the following detailed description is illustrative and is intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used in this specification have the same meaning as commonly understood by those skilled in the art to which this application belongs.

[0043] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0044] 1 System Model

[0045] The main technical route of the present invention is as follows:

[0046] (1) The threshold tracking idea of ​​Camenisch et al. is adopted and optimized to make the tracking algorithm of the present invention more efficient. First, in the credential issuance algorithm, the user uses Shamir's secret sharing scheme to divide his private key into n T The user creates a set of shares and encrypts each share using the ElGamal encryption scheme. The ciphertext of all shares is then sent to all publishers as part of the registration information. Secondly, in the credential disclosure algorithm, the user computes a knowledge signature of the private key. Finally, in the tracking algorithm, the tracker uses a pairing-based equation to determine whether the private key hidden in the knowledge signature is consistent with the private key hidden in the registration information.

[0047] (2) Sander’s polynomial-based unlinkable editable signature is applied to credential issuance. Sander’s URS signature is chosen because it implements efficient attribute leakage proof, supports relational proof of hidden attributes, and the public key size is linearly proportional to the number of user attributes.

[0048] (3) To support threshold issuance of credentials, the present invention uses Shamir's secret sharing technique, which means that the publisher's key generation algorithm must rely on a trusted third party (TTP) for execution. Key distribution can also be accomplished in a distributed manner instead of using a TTP, but this will result in higher computational overhead.

[0049] (4) ElGamal's encryption scheme is used to implement the issuance of private attribute credentials due to its homomorphism and support for efficient zero-knowledge proofs. In the credential issuance algorithm, the user uses the ElGamal algorithm to encrypt each private attribute and calculate the knowledge signature of each ciphertext to prove the correctness of all ciphertexts. After receiving the signature of the ciphertext, the user uses its homomorphism to deblind the signature and obtain the credential of the private attribute.

[0050] The system model implemented by the present invention is as follows Figure 1 The system consists of the following six different entities.

[0051] 1. TTP is a one-time trusted third party responsible for setting up the system initially (step 1) and I A publisher distributes a public-private key pair (step 2).

[0052] 2.I i It is an independent publisher responsible for issuing some attribute certificates for users. I Assuming that some of the publishers are malicious or have been damaged, and some publishers may not be able to perform the credential issuance task online all the time. Therefore, as long as at least t I As long as there is an honest publisher online, the complete attribute certificate can be issued to the user.

[0053] 3. T i It is an independent tracker responsible for tracking the user's identity. T trackers, assuming that some of them are malicious or have been damaged, and some trackers may not be able to perform user tracking tasks online all the time. Therefore, as long as at least t T As long as there is an honest tracker online, the user tracking program can be executed.

[0054] 4. U has a set of private attributes, which he should disclose to n I t in it I The publisher requests a credential (step 4), and then obtains the t I Partial attribute credentials can be aggregated into a complete attribute credential (step 5). When revealing the credential (step 6), U needs to disclose a subset of attributes to V or provide a relational proof of the hidden attributes.

[0055] 5. V is an honest but curious credential verifier who honestly verifies the correctness of the credential display token generated by the user, but is curious about the user's hidden attribute information and the user's true identity.

[0056] 6. It is a public database that only adds data. When a user registers (step 4), the publisher stores the user registration information in When tracking a user, the tracker Traverse user registration information. It can be a blockchain. When a user registers, the publisher writes the user registration information into the blockchain by initiating a transaction protocol.

[0057] like Figure 1 As shown, based on the design of the above system, the basic workflow of the present invention is as follows:

[0058] TTP sets the system parameters (step 1) and sets n I Publishers distribute keys (step 2); each tracker T i (i∈[1,n T ]) Generate a public-private key pair for tracking user identity (step 3) and publish its public key; when user U applies for attribute certificate (step 4), U sends a private key to n I Publisher applies; each online publisher publishes some attribute credentials for U and stores the user registration information in the user registration list From t IAfter each publisher receives a partial attribute certificate, U aggregates all partial attribute certificates into a complete attribute certificate (step 5); when the certificate needs to be displayed, U calculates a certificate display token and discloses a subset of attributes or calculates a relationship proof of hidden attributes (step 6); when any token generated by user U needs to be tracked, t T Online trackers collaborate to track the user's identity (step 7).

[0059] 2 Basic components of the system

[0060] 2.1 Bilinear Group

[0061] and is a multiplicative cyclic group of order prime number p, g, yes Random generator of . Mapping e: is a bilinear map. The bilinear map e has three properties: (1) Bilinearity: and There is e(u a ,v b )=e(uv) ab (2) Non-degeneracy: (3) Computability: e can be calculated efficiently.

[0062] 2.2 Knowledge Signature

[0063] For any polynomial-time nondeterministic relation NP language The knowledge signature consists of parameter generation (Gen), signature (Sign) and verification (Verify) algorithms:

[0064] (1)Gen(1 λ )→pp: Input security parameter 1 λ , the algorithm produces a public parameter pp.

[0065] (2) Sign(y,x,m)→Π: Input message m and an NP relation (x,y), the algorithm generates a knowledge signature

[0066] (3)Verify(y,Π,m)→0 / 1: Input message m, And the knowledge signature Π, if the verification is successful, output 1, otherwise output 0.

[0067] The interactive zero-knowledge proof protocol can be converted into a knowledge signature using the Fiat-Shamir transform. If the knowledge signature satisfies the requirements of correctness, simulatability, and extractability, then the knowledge signature is SimExt-Secure.

[0068] 2.3 Unlinkable Editable Signatures

[0069] The present invention applies Sander's polynomial-based unlinkable editable signature (URS) to credential issuance. Sander's URS signature is chosen because it is very efficient for selective disclosure of attributes, supports relational proofs of hidden attributes, and its public key size is linearly proportional to the number of user attributes q.

[0070] The URS signature consists of the initialization (URS.Setup), key generation (URS.KeyGen), signature (URS.Sign), signature derivation (URS.Derive), and verification (URS.Verify) algorithms:

[0071] (1)Setup(1 λ ,n)→pp: Input security parameter λ and a positive integer n, the algorithm generates public parameters

[0072] (2)KeyGen(pp)→(sk,pk): Input the public parameter pp, the algorithm selects calculate and Set private key sk = (x, y) and public key

[0073] (3) To sign n messages The algorithm selects calculate Then, set and And output

[0074] (4) Input Message Signature Public key pk, index set of leaked attributes The algorithm selects calculate For all calculate Then calculate Finally, the output selects the set of leaked attributes The derived signature of

[0075] (5) Select the set of leaked attributes Signature is correct if: and in If the signature is correct, output 1, otherwise output 0.

[0076] Under the random oracle model and the general group model, URS signatures satisfy the unforgeability and unlinkability properties.

[0077] 3 System Algorithm

[0078] 3.1 Variable Symbols

[0079] Table 1: Symbolic variables

[0080]

[0081]

[0082]

[0083] The system of the present invention includes the following algorithms: system initialization algorithm (Setup), publisher key distribution algorithm (TTPKeyGen), tracer key generation algorithm (TraceKeyGen), user credential application (Obtain) and issuance (Issue) algorithm, credential aggregation algorithm (CredAgg), credential display (Show) and verification (Verify) algorithm, and user tracking algorithm (Trace).

[0084] 3.2 System Initialization Algorithm

[0085] Setup(1 λ ,n I ,t I ,n T ,t T ,q)→pp: Input security parameter 1 λ , the publisher's threshold (n I ,t I ), the threshold value of the tracker (n T ,t T ) and the maximum number of user attributes q, TTP generates a bilinear group and select Output system parameters

[0086]

[0087] 3.3 Publisher Key Distribution Algorithm

[0088] Input system parameter pp, TTP generates verification key pk, and I Publisher distributes key pairs TTP selects (x,y) as the master private key and calculates the public key of the URS signature as the system verification key pk; then, TTP selects 2(q+2) coefficients belonging to t I -1 polynomial, and use Shamir's secret sharing scheme to calculate each publisher I i The private key share isk i and public key share ipk i , where (i∈[1,n I ]); Finally, the TTP publicly verifies the key pk and the public key of each publisher And the private key of each publisher isk i Transmitted to the corresponding publisher I through a secret channel i .

[0089] (1) Select two random numbers and calculate

[0090]

[0091] (2) Select 2(q+1) times (t I -1) coefficient belongs to The polynomial of And set

[0092]

[0093] (3) For each i∈[1,n I ],calculate and

[0094] (4) Set the verification key For each i∈[1,n I ], set the private key isk i =(x i ,y i,1 ,y i,2 ,…,y i,q+1 ,y i,q+3 ,…,y i,2(q+1) ) and public key

[0095] 3.4 Tracker Key Generation Algorithm

[0096] TraceKeyGen(pp)→(tsk i ,tpk i ): Input system parameters pp, T i Generate ElGamal encryption private key tsk i and public key tpk i . T i Select a random element and calculate Then store the private key tsk i And publish the public key (i, tpk i ).

[0097] 3.5 User Credential Application and Release Algorithm

[0098]

[0099] 1. U calculates user registration information: (1) In order to Calculate the blind signature, U temporarily generates an ElGamal encryption private key z and public key Z = g z , and calculate each attribute m j The ciphertext of (j∈[1,q]) (2) In order to combine t I Partial attribute certificate aggregation, each publisher needs to be in the same random element h = g r The signature is calculated as follows, where r is unknown, so U uses a collision-resistant hash function to calculate h = HASH2 (id), where h is a random element naturally bound to the user's identity; (3) U selects a unique private key usk and calculates the public key upk = h usk ; (4) To support threshold tracking, U randomly selects a number of t T The -1 coefficient belongs to Polynomial And use Shamir's secret sharing scheme to split usk into n T share s i =f usk (i), U uses the ElGamal encryption algorithm to encrypt each share of usk i encryption And calculate the verification data shared by the private key usk according to the Feldman verifiable secret sharing scheme (5) In order to prove the correctness of the above calculation to all publishers, U calculates the knowledge signature

[0100] Π1=ZKSoK{(z,m1,…,m q ,usk,r1,…r q ,k1,…, ):Z=g z , And register information Sent to all publishers.

[0101] 2. When Π1 passes the verification, I i Calculate upk and private attribute ciphertext The blind signature of Return U; In addition, I i Store the registration information reg

[0102] 3. After receiving the blind signature (α′, β′), U uses the homomorphism of ElGamal encryption to deblind the signature and calculate σ i =β′(α′) -z ,verify Get the private attribute cred i =(h,σ i ).

[0103] 3.6 Credential Aggregation Algorithm

[0104] CredAgg({cred i} i∈I ,pp)→cred:When U receives t I After executing this algorithm, we can get the partial attribute certificate. U Computing Then calculate if U stores cred = (h, σ) locally, otherwise output ⊥.

[0105] 3.7 Credential Display and Verification Algorithm

[0106] U and V interact to perform a credential display protocol. In this protocol, U can anonymously disclose a subset of attributes to V. First, U derives the URS signature cred. Then, U computes a knowledge signature π2 to prove to V that it knows usk. Finally, U displays the token tok and sends it to V. If tok is verified, V returns 1 and stores tok; otherwise, it returns 0.

[0107] (1) User record Select random number Calculation: σ 1′ =h r ,σ 2′ =σ r (σ 1′ ) t , For all calculate calculate Calculate C = (σ 1′ ) usk And knowledge signature Π2: ZKSoK{usk:C=(σ 1′ ) usk}.set up and sent to the verifier.

[0108] (2) The verifier verifies the knowledge signature Π2, for all calculate examine and

[0109] 3.8 User Tracking Algorithm

[0110] t T Trackers cooperate to execute the user identity tracking algorithm. In order to determine the user identity id that generates the token tok, the trackers traverse the latest user registration list. Read each user's registration information and verify whether the usk hidden in tok is consistent with the one recovered from the user's registration information. If they are consistent, the algorithm outputs the corresponding user identity id. If there is no user information that meets the conditions, output ⊥.

[0111] (1) For all ids, T i Read stored in The user registration information in Parsed as and calculate

[0112] (2)T i To other t I -1 tracker Broadcast T i =(id,i,S id,i );

[0113] (3) From After receiving the information, T i Calculation: For each calculate if Output id.

[0114] (4) If If all the registration information in does not satisfy the above equation, then output ⊥.

[0115] use:

[0116] Existing anonymous credential schemes are still not deployable in distributed systems. This invention supports threshold-based credential issuance and identity tracking. This allows for investigation of illegal and malicious user behavior while protecting user privacy. User identity tracking can help governments and businesses implement internal governance, such as identity management, data auditing, and personnel accountability. By assigning tracking rights to multiple trackers, tracking procedures can only be executed if a threshold number of trackers cooperate, preventing the abuse of tracking rights.

[0117] The following two examples illustrate the application of the present invention. The present invention can be applied to an anonymous reporting system and an anonymous currency system based on a permissioned blockchain. These two systems respectively use the present invention as a building block to achieve fine-grained authentication, traceability, and privacy protection.

[0118] (1) Anonymous reporting is a process in which users can submit reporting evidence to the supervisory department without revealing their identity. The privacy protection feature of the anonymous reporting system can effectively eliminate the concerns of whistleblowers about possible retaliation by criminals. In 2019, Europe passed the EU Whistleblower Protection Directive, which legalized anonymous reporting. An accurate anonymous report helps solve difficult problems, but false or misleading information may make the investigation of the case more complicated. Therefore, in order to curb malicious reporting behavior, it is necessary to trace the identity of those who submit false or misleading reports. However, user identity tracking must be very cautious, because malicious identity tracking will destroy anonymity, thereby bringing the risk of retaliation to users who report illegal behavior. Recently, Wang et al. proposed an anonymous reporting system using blockchain (Monero) and ring signatures, but their system does not support identity tracking. In order to meet the above needs, an anonymous reporting system with an accountability mechanism can be implemented based on the present invention.

[0119] The system is constructed based on the present invention. Figure 2 As shown in Figure 1, the reporting system has five participating entities: multiple publishers, multiple trackers, a public database that only adds data, reporters, and the supervisory department that accepts reports. The reporter provides user registration information to the publisher (step 1). The publisher checks the reporter's registration information, stores it in the database (step 2), and issues a certificate for his private attributes (step 3). The reporter will t I The partial credentials are aggregated into a complete attribute credential (step 4). The whistleblower executes the credential display algorithm, embeds the report content into the zero-knowledge proof π1, and submits the credential display token to the supervisory department. The supervisory department verifies the token and evaluates the authenticity of the report. If a false or misleading report is found, the tracker will be required to track the identity of the whistleblower (step 6). In order to ensure that user identity tracking is not executed maliciously, the algorithm can be used by t TThe trackers cooperate to execute the tracking algorithm (step 7) and return the identity of the whistleblower to the supervision department (step 8). In this system, it is assumed that there is a secure channel between the whistleblower and the supervision department, so the report is not encrypted.

[0120] The use of the present invention prevents malicious disclosure of the identity of the informant (step 7, ⑧). The efficient selection of the disclosure certificate (step 5) not only protects the privacy of the informant, but also provides a flexible authentication strategy and increases the credibility of the report.

[0121] (2) Anonymous currency system is a common application of blockchain. In many business scenarios, the full life cycle management of digital assets can be achieved through simple operations such as currency issuance and transfer. At present, most blockchain-based currency systems, such as Zerocash and Monero, are permissionless. However, due to the needs of internal governance such as identity management, access control and auditability, governments and enterprises prefer to use currency systems based on permissioned blockchains. Androulaki et al. proposed a privacy-protecting and auditable anonymous currency system in a permissioned chain system based on a threshold signature scheme, a public key encryption scheme and a verifiable random function. The architectural model of Androulaki et al. does not consider attribute selection disclosure and threshold traceability, so the threshold signature scheme used by them can be replaced by the scheme of the present invention.

[0122] like Figure 3 As shown, in the architectural model of Androulaki et al., there are six participating entities: multiple authorities, users, blockchains, issuers, auditors, and authenticators. Authorities are trusted participants that jointly issue credentials for all participants and track the identities of malicious users. Users own digital currencies that represent some real-world assets and trade their digital currencies with other users. The blockchain is an immutable public ledger. The issuer is a special user who is authorized to create currency. The auditor is authorized to audit user transactions. The authenticator is a trusted party that provides temporary credentials to users to ensure the validity of their transaction tokens. The steps for integrating the present invention into the framework of Androulaki et al. are as follows: the user sends registration information containing private attributes to multiple authorities (step 1), the authority writes the registration information into the blockchain (step 2), and issues long-term attribute-based credentials to the user (step 3). The user obtains t I The user can then execute the credential display algorithm (step 5). When tracking the identity of the user who displays the token, t T Each authority can query the registration information in the blockchain (step 6) and cooperate in the tracking process (step 7).

[0123] The proposed method's efficient selective attribute disclosure feature can provide flexible transaction strategies for anonymous currency systems and prevent some malicious transactions without compromising user privacy. Furthermore, its threshold tracking algorithm can provide reliable tracking capabilities even when the original auditor is offline or malfunctions.

[0124] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0125] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0126] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0127] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0128] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any other manner. Any person skilled in the art may utilize the above-disclosed technical content to modify or modify the present invention into equivalent embodiments. However, any simple modifications, equivalent variations, and modifications to the above embodiments that do not depart from the technical content of the present invention and are based on the technical essence of the present invention remain within the scope of protection of the present invention.

[0129] This patent is not limited to the above-mentioned optimal implementation method. Anyone can derive various other forms of attribute-based anonymous credential systems that support threshold aggregation based on the inspiration of this patent. All equal changes and modifications made according to the scope of the patent application of this invention should be covered by this patent.

Claims

1. An attribute-based anonymous credential system supporting threshold aggregation, characterized by: It includes the following six entities: TTP, as a one-time trusted third party, is responsible for setting up the system initially and I A publisher distributes public and private key pairs; I i , as an independent publisher, is used to issue some attribute credentials for users; the system is set up with n I publishers, and as long as there are at least t I As long as there is an honest publisher online, the complete attribute certificate can be issued to the user; T i , as an independent tracker, used to track user identity; the system is set up with n T trackers, and as long as at least t T If there is an honest tracker online, the user tracking program can be executed; U has a set of private attributes, I t in it I A publisher requests a credential and then obtains t I Partial attribute credentials can be aggregated into a complete attribute credential; when revealing the credential, U needs to disclose a subset of attributes to V or provide a relationship proof of hidden attributes; V,is a credential verifier, used to verify the correctness of the credential display token generated by the user; It is a public database that only adds data. When a user registers, the publisher stores the user registration information in When tracking a user, the tracker Traverse user registration information; The basic workflow of the system is as follows: TTP sets the system parameters and sets the I Publishers distribute keys; each tracker T i (i∈[1,n T ]) Generate a public-private key pair for tracking user identity and publish its public key; When user U applies for attribute credentials, U sends I The publisher submits an application; Each online publisher publishes some attribute credentials for U and stores the user registration information in the user registration list From t I After a publisher receives a partial attribute certificate, U aggregates all partial attribute certificates into a complete attribute certificate. When the certificate needs to be displayed, U calculates a certificate display token and discloses a subset of attributes or calculates a relationship proof of hidden attributes. When any token generated by user U needs to be tracked, t T Online trackers collaborate to track user identities; Sander's polynomial-based unlinkable editable signature (URS) is applied to credential issuance. In the credential issuance algorithm, the user uses Shamir's secret sharing scheme to divide his private key into n T The ciphertext of all shares is shared and each share is encrypted using the ElGamal encryption scheme, and then the ciphertext of all shares is sent to all publishers as part of the registration information; in the credential disclosure algorithm, the user calculates a knowledge signature of a private key; in the tracking algorithm, the tracker uses a pairing-based equation to determine whether the private key hidden in the knowledge signature is consistent with the private key hidden in the registration information.

2. The attribute-based anonymous credential system supporting threshold aggregation according to claim 1, characterized in that: As a blockchain, when a user registers, the publisher writes the user registration information into the blockchain by initiating a transaction protocol.

3. The attribute-based anonymous credential system supporting threshold aggregation according to claim 1, characterized in that: In the credential issuance algorithm, the user uses the ElGamal algorithm to encrypt each private attribute and calculate the knowledge signature of each ciphertext to prove the correctness of all ciphertexts; after the user receives the signature of the ciphertext, it uses its homomorphism to deblind the signature to obtain the credential of the private attribute.

4. The attribute-based anonymous credential system supporting threshold aggregation according to claim 3, characterized in that: The knowledge signature is specifically: For any polynomial-time nondeterministic relation NP language The knowledge signature consists of three algorithms: parameter generation Gen, signature Sign, and signature Verify: (1)Gen(1 λ )→pp: Input security parameter 1 λ , generating public parameters pp; (2) Sign(y,x,m)→Π: Input message m and an NP relation (x,y) to generate a knowledge signature (3)Verify(y,Π,m)→0 / 1: Input message m, And the knowledge signature Π, if the verification is successful, output 1, otherwise output 0.

5. The attribute-based anonymous credential system supporting threshold aggregation according to claim 4, characterized in that: Define the following symbolic variables: The system includes the following algorithms: System initialization algorithm Setup(1 λ ,n I ,t I ,n T ,t T ,q)→pp: Input security parameter 1 λ , the publisher's threshold (n I ,t I ), the threshold value of the tracker (n T ,t T ) and the maximum number of user attributes q, TTP generates a bilinear group in, and is a multiplicative cyclic group of order prime number p, g, yes Random generator for ; mapping is a bilinear map; and choose Output system parameters Publisher Key Distribution Algorithm Input system parameter pp, TTP generates verification key pk, and I Publisher distributes key pairs TTP selects (x,y) as the master private key and calculates the public key of the URS signature as the system verification key pk; then, TTP selects 2(q+2) coefficients belonging to t I -1 polynomial, and use Shamir's secret sharing scheme to calculate each publisher I i The private key share isk i and public key share ipk i , where (i∈[1,n I ]); Finally, the TTP publicly verifies the key pk and the public key of each publisher And the private key of each publisher isk i Transmitted to the corresponding publisher I through a secret channel i ; (1) Select two random numbers And calculate: (2) Select 2(q+1) times (t I -1) coefficient belongs to The polynomial of And set (3) For each i∈[1,n I ], calculate x i =f x (i); and (4) Set the verification key For each i∈[1,n I ], set the private key isk i =(x i ,y i,1 ,y i,2 ,...,y i,q+1 ,y i,q+3 ,...,y i,2(q+1) ) and public key Tracker key generation algorithm TraceKeyGen(pp)→(tsk i ,tpk i ): Input system parameters pp, T i Generate ElGamal encryption private key tsk i and public key tpk i ;T i Select a random element and calculate Then store the private key tsk i And publish the public key (i, tpk i ); User credential application and issuance algorithm (1) U computing user registration information: (1) In order to Calculate the blind signature, U temporarily generates an ElGamal encryption private key z and public key Z = g z , and calculate each attribute m j The ciphertext of (j∈[1,q]) (2) In order to combine t I Partial attribute certificate aggregation, each publisher needs to be in the same random element h = g r The signature is calculated as follows, where r is unknown, so U uses a collision-resistant hash function to calculate h = HASH2 (id), where h is a random element naturally bound to the user's identity; (3) U selects a unique private key usk and calculates the public key upk = h usk ; (4) To support threshold tracking, U randomly selects a number of t T The -1 coefficient belongs to Polynomial And use Shamir's secret sharing scheme to split usk into n T share s i =f usk (i), U uses the ElGamal encryption algorithm to encrypt each share of usk i encryption And calculate the verification data shared by the private key usk according to the Feldman verifiable secret sharing scheme (5) In order to prove the correctness of the above calculation to all publishers, U calculates the knowledge signature: And register information Send to all publishers; (2) When the knowledge signature Π1 passes the verification, I i Calculate upk and private attribute ciphertext The blind signature of Return U; In addition, I i Store the registration information reg (3) After receiving the blind signature (α′, β′), U uses the homomorphism of ElGamal encryption to deblind the signature and calculate σ i =β′(α′) -z ,verify Get the private attribute cred i =(h,σ i ); Credential Aggregation Algorithm When U receives t I This algorithm is executed after each partial attribute certificate; U Computing Then calculate if U stores cred = (h, σ) locally, otherwise output ⊥; Credential display and verification algorithm U and V interact to perform a credential display protocol; in this protocol, U is allowed to anonymously disclose a subset of attributes to V; first, U derives the URS signature cred; then, U calculates a knowledge signature π2 to prove to V that it knows usk; finally, U displays the token tok and sends it to V; if tok is verified, V returns 1 and stores tok, otherwise it returns 0; (1) User record Select random number Calculation: σ 1′ =h r ,σ 2′ =σ r (σ 1′ ) t , For all calculate calculate Calculate C = (σ 1′ ) usk And knowledge signature Π2: ZKSoK{usk:C=(σ 1′ ) usk };set up And send it to the verifier; (2) The verifier verifies the knowledge signature Π2, for all calculate examine and User tracking algorithm t T Trackers cooperate to execute the user identity tracking algorithm; in order to determine the user identity id that generates the token tok, the trackers traverse the latest user registration list Read each user's registration information and verify whether the usk hidden in tok is consistent with the one recovered from the user's registration information; if they are consistent, the algorithm outputs the corresponding user identity id; if the traversal is completed, If there is no user information that meets the conditions, output ⊥; (1) For all ids, T i Read stored in The user registration information in Parsed as and calculate (2)T i To other t I -1 tracker Broadcast T i =(id,i,S id,i ); (3) From {T j } j∈T,j≠i After receiving the information, T i Calculation: For each calculate if Output id; (4) If If all the registration information in does not satisfy the above equation, then output ⊥.

Images