A selective disclosure certificate method based on a batch verifier supporting batch verification

Abstract

The present application relates to a kind of selective disclosure certificate method based on aggregator supporting batch verification.The traditional certificate method cannot provide batch certification when a large number of certificates need to be verified, and the verification of the certificate needs to use bilinear pair operation, with large overhead, and in the case of multiple certificate verification, it will bring high operation cost to the verifier.In order to make the user only keep a single certificate evidence to complete the verification of batch certificate, the method can aggregate the certificate evidence owned by the user, so that a single evidence can complete the verification of multiple certificates.In the case of multiple certificate verification, the certificate verification is still completed with low time consumption, the function of certificate system is further expanded, and it is suitable for application scenarios with limited computing resources.Based on bilinear pairing aggregator, the present application completes the function expansion of threshold issuance selective disclosure certificate system, and plays a positive role in promoting the realization of certificate system with more functions and practicality.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of information security, and particularly relates to a selective disclosure certificate method based on an aggregator and supporting batch verification. BACKGROUND

[0002] Anonymous certificate methods aim to protect user privacy while issuing certificates. A one-time pseudonym is established between the user and an authoritative authority. After the authority verifies the pseudonym's validity, the user calculates the certificate based on their attributes. The authority then verifies the certificate's compliance with issuance rules against the submitted certificate and pseudonym. If verification is successful, the certificate is valid. The user can subsequently prove their possession of the certificate to others using zero-knowledge proofs (ZKP). However, the problem with anonymous certificates is that the user attributes contained in the certificate can either be fully disclosed or encoded as a single value and hidden entirely. Neither of these options is conducive to the further expansion of the certificate system. When all user attributes are disclosed, user privacy cannot be guaranteed; conversely, hiding all attributes creates a lack of oversight. Threshold Issuance Selective Disclosure Credentials (TICs) offer a trade-off between the aforementioned issues. Certificate issuance is distributed; only when a user's collected certificates reach a threshold t can the user aggregate these issued certificates into a single valid certificate using Lagrange Interpolation Polynomial. When a certificate needs to be presented and certain attributes revealed, the user can construct a ZKP (Zero-Know-What-If) for those attributes and submit it to a verifier for verification. However, while TICs can aggregate individual certificates, they do not support batch certificate verification or the aggregation of certificate evidence. This limits the system's applicability to a wider range of scenarios. Considering a single user possessing multiple certificates, certificate verification becomes extremely time-consuming, and for cases requiring multiple verifications, a corresponding ZKP needs to be generated each time, increasing the user's computational burden. In cryptography, an aggregator is a one-way membership function. It can be used to identify whether a candidate is a member of a set without revealing the members of the set in the process. Aggregators can generally be divided into RSA-based aggregators and bilinear-pairing-based aggregators. In comparison, bilinear-pairing-based aggregators are more versatile and have no specific requirements for the selection of aggregating elements, while RSA-based aggregators require the selected elements to be prime numbers. In addition, bilinear-pairing aggregators have smaller proof size and faster verification speed. Using bilinear-pairing aggregators will enable the existing threshold-based selective disclosure certificates to be functionally extended, solving the aforementioned problems and making them suitable for a wider range of application scenarios. Summary of the Invention

[0003] The purpose of this invention is to provide a selective disclosure certificate method based on an aggregator that supports batch verification, in order to solve the problems of being unable to perform batch verification of certificates and being unable to aggregate evidence in threshold-based selective disclosure certificates.

[0004] To achieve the above objectives, the technical solution of the present invention is: a selective disclosure certificate method based on an aggregator that supports batch verification, comprising the following steps:

[0005] S101. The Key Distribution Center (KGC) runs the system initialization function to generate publicly available system parameters.

[0006] S102, The Key Distribution Center (KGC) selects two polynomials of degree t-1 to generate Au for each authoritative institution. i The key is sent to the authoritative authority, Au. i And they publish their public keys, authoritative bodies such as Bu i Responsible for aggregating subsequently verified certificates and calculating the aggregated value of the certificates;

[0007] S103. The user calculates the commitment value for attribute m, uses a hash function to calculate the hash value, then uses its own generated EI-Gamal key-value pair to blind the message, calculates the relevant zero-knowledge proof, and sends the evidence to various authoritative institutions (Au). i ;

[0008] S104, various authoritative institutions Au i Upon receiving content from a user, the system first verifies the validity of the evidence generated by the user. If the evidence is valid, the authoritative agency Au... i Perform a blind signature on the user using your own private key; otherwise, output ⊥ to terminate.

[0009] S105, The user received an authoritative document from Au. i After blind signing, the blind signature is deblinded to obtain the i-th authoritative institution Au. i Some of the certificates generated;

[0010] S106. The user aggregates the deblinded partial certificates using a threshold number of certificates to obtain a valid single certificate.

[0011] S107. The user will use the aggregated valid certificates as proof, construct parameters for selectively disclosing attribute m, and send the generated information, including evidence, to various authoritative institutions Bu. i ;

[0012] S108, various authoritative institutions that received the information i It can verify the user's evidence. If the verification passes, it outputs 1; otherwise, it outputs 0. (Authoritative body Bu) iThe verified certificate is posted on the bulletin board, and the aggregator's secret input f is sent through an encrypted channel to calculate and publish the aggregate value of the certificate;

[0013] S109. When it is necessary to prove that one has multiple certificates, the user can aggregate the certificates he / she owns after receiving the secret input. When it is necessary to present the certificates, only the aggregated value is used for batch proof. The verifier uses the aggregated value and the aggregated value provided by the user for batch verification.

[0014] S110. The user aggregates the verified certificate evidence, combining multiple pieces of evidence into a single piece of evidence so that batch certificate verification can be completed using only a single piece of evidence. The verifier uses the accumulated value and the aggregated certificate evidence provided by the user for batch verification.

[0015] Compared with existing technologies, the present invention has the following beneficial effects: Without changing the threshold-based selective disclosure certificate issuance, the present invention adds batch verification and evidence aggregation functions by using a bilinear pairing-based aggregator. This allows users to aggregate certificates when they have multiple certificates, perform batch verification of certificates, or aggregate existing certificate evidence. This greatly reduces the computational workload of verifiers when verifying certificates and users when presenting certificates. Users no longer need to perform tedious zero-knowledge proof calculations every time they present a certificate, which further expands the threshold-based selective disclosure certificate system and helps it to be applied to a wider range of scenarios. Attached Figure Description

[0016] Fig. 1 This is a flowchart of the method of the present invention.

[0017] Fig. 2 This is a flowchart of a selectively disclosed certificate that supports batch verification based on an aggregator.

[0018] Fig. 3 This is a model diagram of a selective disclosure certificate system based on an aggregator that supports batch verification. Detailed Implementation

[0019] The technical solution of the present invention will now be described in detail with reference to the accompanying drawings.

[0020] First, the symbols and their definitions are as follows:

[0021] Au i The i-th authoritative institution is responsible for issuing some certificates.

[0022] Bu i The i-th authoritative body is responsible for verifying and aggregating certificates.

[0023] G1: An additive cyclic group of order p.

[0024] G2: An additive cyclic group of order p.

[0025] G T : A multiplicative cyclic group of order p.

[0026] g1, h1: Generators of group G1.

[0027] g2: Generator of group G2.

[0028] v, w: polynomials of degree t-1.

[0029] x, y: constant terms of polynomials v, w.

[0030] [1, N]: The set of integers that are not less than 1 and not greater than N.

[0031] sk i Au, the i-th authoritative institution i The private key.

[0032] x i Au, the i-th authoritative institution i The first part of the private key.

[0033] y i Au, the i-th authoritative institution i The second part of the private key.

[0034] vk i The i-th authoritative institution Au i The verification key.

[0035] α i Au, the i-th authoritative institution i The first part of the verification key.

[0036] β i Au, the i-th authoritative institution i The second part of the verification key.

[0037] α: t authoritative institutions Au i The first part of the verification key is the aggregated value.

[0038] β: t authoritative institutions Au i The second part of the verification key is the aggregated value.

[0039] d: The private key of the EI-Gamal key-value pair selected by the user.

[0040] γ: The public key of the EI-Gamal key-value pair selected by the user.

[0041] m: User attribute.

[0042] o, k: Random values ​​in the prime field selected by the user for the commitment.

[0043] c m : The commitment value calculated by the user for attribute m.

[0044] Enc(): An encryption function that uses the public key of the EI-Gamal key-value pair selected by the user for encryption and the private key for decryption.

[0045] H: Cryptographic hash function.

[0046] h: The hash value of the user commitment.

[0047] NIZK(): {}: Zero-knowledge proof, the content inside () is the privacy input, and the content inside {} is the public statement about the privacy input.

[0048] π s : User-generated zero-knowledge proofs when preparing blind signatures.

[0049] π v : Zero-knowledge proofs used by users to validate certificate generation.

[0050] c: Ciphertext encrypted using EI-Gamal.

[0051] The result of the i-th authoritative institution, Aui, performing a blind signature on the user message.

[0052] The i-th authoritative institution Au i Blind signature, Part 1.

[0053] The i-th authoritative institution Au i Blind signature, Part 2.

[0054] The second part of the certificate aggregation.

[0055] s: The second part of the certificate aggregate value.

[0056] Two independent prime fields F p .

[0057] The i-th authoritative institution Au i The output is partially blinded certificate.

[0058] σ i User's opinion on the i-th authoritative institution Au i The blinded certificate is a partial certificate after the blinding process.

[0059] σ1, σ2, ..., σt A collection of certificates gathered by the user.

[0060] ψ: The aggregated certificate.

[0061] l i Lagrange interpolation coefficients.

[0062] vk: The verification key recovered using Lagrange interpolation.

[0063] r, r′: Random values ​​belonging to the prime number field selected by the user for rerandomization.

[0064] κ, υ: User-constructed parameters for selectively disclosing attribute m.

[0065] e(P, Q): Bilinear mapping.

[0066] A X Set X = {a1′, b1′, ..., a} |X| ′,b |X| The aggregate value of ′}.

[0067] {a1′,b1′,...,a |X| ′,b |X| ′}: The collection of certificates after rerandomization.

[0068] T: Set of rerandomized certificates {a1′, b1′, ..., a t ′,b t ′}.

[0069] π I : Set the evidence set I = {π1, π2, ..., π} |I| A single piece of evidence aggregated together.

[0070] f: Aggregator secret input.

[0071] x(f): A polynomial with respect to the secret input f.

[0072] Except element a i The aggregate value of ′.

[0073] Except element b i The aggregate value of ′.

[0074] I(f): The aggregate value of the elements in set I.

[0075] Y(f): The aggregate value of all elements except those in set I.

[0076] A′ X : The updated aggregator.

[0077] ⊥: Termination symbol.

[0078] DLP problem: Discrete Logarithm Difficulty.

[0079] This invention provides a selective certificate disclosure method based on an aggregator that supports batch verification.

[0080] The most crucial concept of this invention lies in the fact that the threshold-based selective disclosure of certificates does not take into account the cases of batch proof and certificate evidence aggregation. When the user is an organization, the proof calculation for holding a large number of certificates becomes extremely cumbersome. Using a bilinear pairing aggregator can greatly reduce the overhead of such proof calculations. Considering that the RSA aggregator only supports the aggregation of prime elements, while the bilinear pairing aggregator overcomes this limitation, it is easier to apply to certificate systems for further expansion. By using the properties of homomorphic operations to perform aggregation operations on a large number of certificates, valid certificates are aggregated into a single value as parameters. When a user performs batch verification, they only need to calculate the aggregated value that does not include their own certificate. The verifier uses this aggregated value, the user's certificate, and the overall aggregated value to perform verification using a bilinear mapping. Batch verification can be completed in a single operation, greatly reducing the computational cost required by both the user and the verifier.

[0081] Please refer to Figs. 1-3 A selective certificate disclosure method based on an aggregator that supports batch verification includes the following steps:

[0082] S101. The Key Distribution Center (KGC) runs the system initialization function to generate publicly available system parameters.

[0083] S102, The Key Distribution Center (KGC) selects two polynomials of degree t-1 to generate Au for each authoritative institution. i The key is sent to the authoritative authority, Au. i And they publicly disclose their verification keys, authoritative bodies such as Bu i Responsible for aggregating subsequently verified certificates and calculating the aggregated value of the certificates;

[0084] S103. The user calculates the commitment value for attribute m, uses a hash function to calculate the hash value, then uses its own generated EI-Gamal key-value pair to blind the message, calculates the relevant zero-knowledge proof, and sends the evidence to various authoritative institutions (Au). i ;

[0085] S104, various authoritative institutions Au i Upon receiving content from a user, the system first verifies the validity of the evidence generated by the user. If the evidence is valid, the authoritative agency Au... i Perform a blind signature on the user using your own private key; otherwise, output ⊥ to terminate.

[0086] S105, The user received an authoritative document from Au. i After blind signing, the signature is deblinded to obtain the i-th authoritative institution Au. i Some of the certificates generated;

[0087] S106. The user aggregates the deblinded partial certificates using a threshold number of certificates to obtain a valid single certificate.

[0088] S107. The user will use the aggregated valid certificates as proof, construct parameters for selectively disclosing attribute m, and send the generated evidence and other information to various authoritative institutions Bu. i ;

[0089] S108. The node receiving the message can verify the user's evidence. If the verification passes, output 1; otherwise, output 0. The authoritative organization Bu... i The verified certificate is posted on the bulletin board, and the aggregator's secret input f is sent through an encrypted channel to calculate and publish the aggregate value of the certificate;

[0090] S109. When it is necessary to prove that one has multiple certificates, the user can aggregate the certificates he / she owns after receiving the secret input. When it is necessary to present the certificates, only the aggregated value is used for batch proof. The verifier uses the aggregated value and the aggregated value provided by the user for batch verification.

[0091] S110. The user aggregates the verified certificate evidence, combining multiple pieces of evidence into a single piece of evidence so that batch certificate verification can be completed using only a single piece of evidence. The verifier uses the accumulated value and the aggregated certificate evidence provided by the user to perform batch verification.

[0092] Furthermore, the detailed process of the above steps is as follows:

[0093] Step S101 specifically includes:

[0094] The key distribution center (KGC) knows the security parameter λ. First, it constructs an asymmetric bilinear group D = (G1, G2, G...). T The generators of group G1 are g1 and h1, the generator of group G2 is g2, p is a prime number of length λ bits, and the parameters of the system are (G1, G2, G...). T (p, g1, g2, h1).

[0095] In step S102, the Key Distribution Center (KGC) selects two polynomials of degree t-1 to generate Au for each authoritative institution. i The key is sent to the authoritative authority, Au. i And they publicly disclose their verification keys, authoritative bodies such as Bu iResponsible for aggregating subsequently verified certificates and calculating the aggregated certificate value, specifically including:

[0096] The polynomials v and w selected by the Key Distribution Center (KGC) both have a degree of t-1, and their coefficients are in the field F. p Select from the list and set (x, y) = (v(0), w(0)), and distribute to the i-th authority Au in [1, ..., n]. i private key sk i =(x i y i = (v(i), w(i)), and publish the verification key of the authoritative organization Aui.

[0097] In step S103, the user calculates the commitment value for attribute m, generates a hash value using a hash function, then uses the user-generated EI-Gamal key-value pair to blind the message, calculates the relevant zero-knowledge proof, and sends it to various authoritative institutions. Specifically, this includes:

[0098] User selects EI-Gamal key-value pair Select a random number o∈F p Calculate the commitment value with respect to attribute m. Use the hash function to calculate the hash value h = H(c). m The user selects a random value k∈F. p Encryption operations are performed using encryption functions. Zero-knowledge proofs generated Where (d, m, o, k) represents the user's private input, i.e., the input values ​​known only to the user, and (γ, c) represents the user's private input. m c) represents evidence generated by the user regarding private input. The verifier can only obtain this evidence and uses public information to verify that the user's evidence regarding private input is correct.

[0099] The authoritative body Au is mentioned in step S104. i Upon receiving the content sent by the user, the system first verifies the authenticity of the evidence generated by the user. If the evidence is authentic, the authoritative institution performs a blind signature on the user's document using its private key; otherwise, it outputs ⊥ to terminate the process. Specifically, this includes:

[0100] The i-th authoritative institution Au i The private key is sk i =(x i y i ), Analyze c = (a, b), calculate about c m The hash value h = H(c) m This verifies whether the user's argument is correct. When the user's evidence is correct, the authoritative body Au...i Build a blinded partial certificate component The resulting blindness-enhanced certificate consists of two parts: the blindness-enhanced certificate is... Otherwise, if the user's evidence fails verification, the authoritative agency Au i Output ⊥ Termination.

[0101] In step S105, after receiving the blind signature from the authoritative institution, the user deblinds the signature to obtain the i-th authoritative institution Au. i Some of the certificates include:

[0102] User analysis of blinded certificate section in Calculate the partial certificates after deblinding

[0103] In step S106, the user aggregates the deblinded partial certificates they have obtained to obtain a valid single certificate, specifically including:

[0104] The user selects t partial certificates for certificate aggregation, where t is a threshold, to form a valid certificate. The calculation steps are as follows: (σ1, σ2, ..., σ t )→(σ), where For i∈[1,...,t], calculate l i The Lagrange multipliers are calculated as follows: This represents the restoration of the index using Lagrange interpolation; Because of the operation on the index, according to the DLP problem, the authoritative institution Au i Or the user cannot know v(0) and w(0), and the second part of the aggregate certificate Therefore, the final single valid certificate generated is σ = (h, h x+y·m ).

[0105] In step S107, the user verifies the aggregated valid certificates, constructs parameters for selectively disclosing attribute m, and sends the generated evidence and other information to various authoritative institutions Bu. i Specifically, it includes:

[0106] User parsing σ = (h, s), verification key vk = (g2, α, β) = (g2, g2 x g2 y The user selects a random number r. For rerandomization, the certificate after rerandomization is calculated as σ′=(h′,s′)=(h r′ s r′The user, based on attribute m, has a blinding factor r ∈ F. p Construct κ=αβ m g2 r ,υ=(h′) r Computational zero-knowledge proofs Where (m, r) is the private input known only to the user, and κ, υ are evidence regarding the private input (m, r).

[0107] In step S108, the node receiving the information can verify the user's evidence. If the verification passes, it outputs 1; otherwise, it outputs 0. The authoritative body Bu... i The verified certificate is posted on a bulletin board, and the aggregator's secret input f is sent via an encrypted channel to calculate and publish the aggregated value of the certificate. Specifically, this includes:

[0108] Verifier's analysis σ′=(h′,s′)=(h r′ s r′ First, the verifier verifies whether the user's evidence is correct. Then, the verifier ensures that h′≠1 and verifies whether the bilinear mapping satisfies e(h′,κ)=e(s′υ,g2), where e(h r′ g2 x g2 my g2 r ) = e(g1, g2) (x+my+r)r′ And e(s′v,g2)=e(h′) (x+my+r) g2) = e(g1, g2) (x+my+r)r When the verification is successful, the authoritative agency Bu i The user-submitted rerandomized certificate is posted on the bulletin board, and the secret input f is sent to the verified user via an encrypted channel. The user's certificate σ′=(h′,s′)=(a′,b′) is parsed and the aggregator value A′ is updated. X =A X (f+a′)(f+b′) When the authoritative agency Bu i When the set of certificates to be aggregated is T, the value of the updated aggregator is calculated as follows:

[0109] In step S109, when it is necessary to prove that a user possesses multiple certificates, the user, after receiving the secret input, can aggregate the certificates they own. When it is necessary to present the certificates, only the aggregated value is used for batch verification. The verifier uses the aggregated value and the aggregated value provided by the user for batch verification, specifically including:

[0110] The user owns a set of verified, rerandomized certificates {ψ1, ψ2, ..., ψ}. UIn cases where a batch of certificates needs to be presented at once, the user scans all T certificates on the bulletin board and calculates the evidence that they possess the certificate set. The verifier uses the aggregated certificate values ​​from the bulletin board and the certificate evidence provided by the user for verification, and uses a bilinear mapping to verify whether the equation is satisfied. If the equation verification passes, it means that the user has n valid certificates, and the verifier only needs to perform the bilinear equation verification once to complete the batch certificate verification.

[0111] In step S110, the user aggregates the verified certificate evidence, combining multiple pieces of evidence into a single piece so that batch certificate verification can be completed using only a single piece of evidence. The verifier uses the accumulated value and the aggregated certificate evidence provided by the user for batch verification, specifically including:

[0112] If the user already possesses a set of certificate evidence π1, π2, ..., π |I| Polynomials concerning the secret input f Calculate the removal of element a i The aggregate value of ′ Calculate the removal of element b i The aggregate value of ′ Calculate the aggregate value excluding elements from set I. Using the partial fraction expansion theorem, calculate the aggregate value of all elements except those in set I. Therefore, the user aggregates |I| certificate evidences into a single piece of evidence π. I =g1 Y(f) The aggregation of certificate evidence has been completed. The verifier uses all the aggregated certificate values ​​from the bulletin board and the certificate evidence provided by the user for verification, using a bilinear mapping to verify whether the equation is satisfied. If the equation verification passes, it means that the user has valid evidence of aggregation, and the verifier only needs to perform one bilinear equation verification to complete the batch certificate verification.

[0113] As described above, this invention, without altering the original threshold-based selective disclosure certificate system architecture, extends and optimizes the original method by incorporating a bilinear pairing aggregator. It upgrades the original system, which only supported single verification, to a certificate system supporting batch certificate verification and evidence aggregation. Users can perform batch certificate verification when multiple certificates are required; users can also aggregate certificate evidence, retaining only a single piece of evidence to complete batch certificate verification, reducing the space required for storing evidence and the time cost of recalculating evidence. Therefore, this invention further expands the application scenarios of selective disclosure certificate systems, saving computational and storage costs on the user side and computational costs on the verification side, and has practical application prospects.

[0114] The above are preferred embodiments of the present invention. Any changes made to the technical solution of the present invention that do not exceed the scope of the technical solution of the present invention shall fall within the protection scope of the present invention.

Claims

1. A selective certificate disclosure method based on an aggregator that supports batch verification, characterized in that, Includes the following steps: S101, Key Distribution Center (KGC) runs the system initialization function to generate public system parameters; S102, The Key Distribution Center (KGC) selects two polynomials of degree t-1 to generate Au for each authoritative institution. i The key is sent to the authoritative authority, Au. i And they publicly disclose their verification keys, authoritative bodies such as Bu i Responsible for aggregating subsequently verified certificates and calculating the aggregated value of the certificates; S103. The user calculates the commitment value for attribute m, uses a hash function to calculate the hash value, then uses its own generated EI-Gamal key-value pair to blind the message, calculates the relevant zero-knowledge proof, and sends the evidence to various authoritative institutions (Au). i ; S104, various authoritative institutions Au i Upon receiving content from a user, the system first verifies the validity of the evidence generated by the user. If the evidence is valid, the authoritative agency Au... i Perform a blind signature on the user using your own private key; otherwise, output ⊥ to terminate. S105, The user received an authoritative document from Au. i After blind signing, the blind signature is deblinded to obtain the i-th authoritative institution Au. i Some of the certificates generated; S106. The user aggregates the deblinded partial certificates using a threshold number of certificates to obtain a valid single certificate. S107. The user will use the aggregated valid certificates as proof, construct parameters for selectively disclosing attribute m, and send the generated information, including evidence, to various authoritative institutions Bu. i ; S108, various authoritative institutions that received the information i It can verify the user's evidence. If the verification passes, it outputs 1; otherwise, it outputs 0. (Authoritative body Bu) i The verified certificate is posted on the bulletin board, and the aggregator's secret input f is sent through an encrypted channel to calculate and publish the aggregate value of the certificate; S109. When it is necessary to prove that one has multiple certificates, the user can aggregate the certificates he / she owns after receiving the secret input. When it is necessary to present the certificates, only the aggregated value is used for batch proof. The verifier uses the aggregated value and the aggregated value provided by the user for batch verification. S110. The user aggregates the verified certificate evidence, combining multiple pieces of evidence into a single piece of evidence so that batch certificate verification can be completed using only a single piece of evidence. The verifier uses the accumulated value and the aggregated certificate evidence provided by the user for batch verification.

2. The selective disclosure certificate method based on an aggregator supporting batch verification according to claim 1, characterized in that, The implementation of step S101 is as follows: The key distribution center (KGC) knows the security parameter λ, and firstly uses the security parameter λ to construct an asymmetric bilinear group D = (G1, G2, G...). T G1 and G2 are additive cyclic groups of order p, and G... T Let G1 be a multiplicative cyclic group of order p, with generators g1 and h1 for group G1 and g2 for group G2. Let p be a prime number of length λ bits. The system parameters are (G1, G2, G...). T ,p,g1,g2,h1).

3. The selective disclosure certificate method based on an aggregator supporting batch verification according to claim 2, characterized in that, The implementation method of step S102 is as follows: the degree of polynomials v and w selected by the key distribution center KGC is t-1, and the coefficients are in the field F. p Select from the options and set (x,y)=(v(0),w(0)), where x and y are the constant terms of the polynomials v and w, and distribute them to the i-th authority Au in [1,…,n]. i private key sk i =(x i ,y i )=(v(i),w(i)),x i For the i-th authoritative institution Au i The first part of the private key, y i For the i-th authoritative institution Au i The second part of the private key is published by the authoritative organization Au. i verification key 4. The selective disclosure certificate method based on an aggregator supporting batch verification according to claim 3, characterized in that, The implementation method of step S103 is as follows: the user selects an EI-Gamal key-value pair. d is the private key of the EI-Gamal key-value pair selected by the user, γ is the public key of the EI-Gamal key-value pair selected by the user, and a random number o∈F is selected. p Calculate the commitment value with respect to attribute m. Use the hash function to calculate the hash value h = H(c) m H is a cryptographic hash function, and the user chooses a random value k∈F. p Encryption operations are performed using encryption functions. Zero-knowledge proofs generated Where (d,m,o,k) represents the user's private input, i.e., the input values ​​known only to the user, and (γ,c) represents the user's private input. m c) This represents evidence generated by the user regarding private input. The verifier can only obtain this evidence and uses public information to verify that the user's evidence regarding private input is correct.

5. The selective disclosure certificate method based on an aggregator supporting batch verification according to claim 4, characterized in that, The implementation method of step S104 is as follows: the i-th authoritative institution Au i The private key is sk i =(x i ,y i ), Analyze c = (a, b), calculate about c m The hash value h = H(c) m This verifies the correctness of the user's evidence. When the user's evidence is correct, the authoritative agency Au... i Build blinded partial certificate component The resulting blindness certificate consists of two parts, namely, the blindness certificate is... Otherwise, if the user's evidence fails verification, the authoritative agency Au i Output ⊥ Termination; The implementation method of step S105 is as follows: User parses the blinded portion of the certificate. in Calculate the partial certificates after deblinding 6. The selective disclosure certificate method based on an aggregator supporting batch verification according to claim 5, characterized in that, The implementation of step S106 is as follows: The user selects t partial certificates for certificate aggregation, where t is a threshold, to form a valid certificate. The calculation steps are as follows: (σ1,σ2,…,σ t )→(σ), where For i∈[1,…,t], calculate l i The Lagrange multipliers are calculated as follows: This represents the restoration of the index using Lagrange interpolation; Because of the operation on the index, according to the DLP problem, the authoritative institution Au i Or the user cannot know v(0) and w(0), and the second part of the aggregate certificate Therefore, the final single valid certificate generated is σ = (h, h x+y·m ).

7. The selective disclosure certificate method based on an aggregator supporting batch verification according to claim 6, characterized in that, The implementation method of step S107 is as follows: the user parses σ=(h,s), and verifies the key vk=(g2,α,β)=(g2,g2 x g2 y The user selects a random number. For rerandomization, the certificate after rerandomization is calculated as σ'=(h',s')=(h r′ ,s r′ The user, based on attribute m, has a blinding factor r ∈ F. p Construct κ=αβ m g2 r ,υ=(h') r Computational zero-knowledge proofs Where (m,r) is the private input known only to the user, and κ,υ are the evidence regarding the private input (m,r).

8. A selective disclosure certificate method based on an aggregator supporting batch verification according to claim 7, characterized in that, The implementation of step S108 is as follows: the verifier parses σ'=(h',s')=(h r′ ,s r First, the verifier verifies whether the user's evidence is correct. Then, the verifier ensures that h' ≠ 1 and verifies whether the bilinear mapping satisfies e(h',κ)=e(s'υ,g2), where e(h',κ)=e(h',αβ) m g2 r )=e(h r′ g2 x g2 my g2 r )=e(g1,g2) (x+my+r)r′ And e(s'υ,g2)=e(h '(x+my+r) g2) = e(g1, g2) (x+my+r)r′ When the verification is successful, the authoritative agency Bu i The user-submitted rerandomized certificate is posted on the bulletin board, and the secret input f is sent to the verified user via an encrypted channel. The user's certificate σ'=(h',s')=(a',b') is parsed and the aggregator value A' is updated. X =A X (f+a′)(f+b′) A X Let X = {a1', b1', ..., a |X| ',b |X| The aggregate value of '}, when the authoritative body Bu i When the set of certificates to be aggregated is T, the value of the updated aggregator is calculated as follows:

9. A selective disclosure certificate method based on an aggregator supporting batch verification according to claim 8, characterized in that, The implementation method of step S109 is as follows: the set of verified and rerandomized certificates owned by the user is {ψ1,ψ2,…,ψ}. |U| In cases where a batch of certificates needs to be presented at once, the user scans all T certificates on the bulletin board and calculates the evidence that they possess the certificates for that set. The verifier uses the aggregated certificate values ​​from the bulletin board and the certificate evidence provided by the user for verification, and uses a bilinear mapping to verify whether the equation is satisfied. If the equation verification passes, it means that the user has n valid certificates, and the verifier only needs to perform the bilinear equation verification once to complete the batch certificate verification.

10. A selective disclosure certificate method based on an aggregator supporting batch verification according to claim 9, characterized in that, The implementation method of step S110 is as follows: if the user already possesses a set of certificate evidence π1,π2,…,π |I| Polynomials concerning the secret input f Calculate the removal of element a i 'aggregate value Calculate the removal of element b i 'aggregate value Calculate the aggregate value excluding elements from set I. Using the partial fraction expansion theorem, calculate the aggregate value of all elements except those in set I. Therefore, the user aggregates |I| certificate evidences into a single piece of evidence π. I =g1 Y(f) The process involves aggregating certificate evidence; the verifier then uses the aggregated certificate values ​​from the bulletin board along with the certificate evidence provided by the user for verification, employing a bilinear mapping to verify whether the equation is satisfied. If the equation verification passes, it means that the user has valid evidence of aggregation, and the verifier only needs to perform the bilinear equation verification once to complete the batch certificate verification.

Images