Identity authentication method, device and medium based on anonymous credential

Abstract

The application discloses an identity authentication method and device based on anonymous credentials and a medium, wherein the method comprises the following steps: a mobile terminal sends an anonymous token acquisition request to a server; the server sends a signed blinded token to the mobile terminal; the mobile terminal performs a deblinding operation to obtain an anonymous token and store the anonymous token in a local database; the mobile terminal generates a dynamic password by using the stored anonymous token; a web-based client sends an identity authentication request to the server by using the dynamic password generated by the mobile terminal; the server performs identity authentication according to the dynamic password and outputs an identity authentication result. The method can solve the disadvantages of traditional identity authentication and anonymous credentials, and meet the anonymous credential requirement of multi-factor identity authentication in a high-privacy-protection requirement scene.

Description

Technical Field

[0001] This invention relates to the field of identity authentication technology in applied cryptography, and in particular to identity authentication methods, devices and media based on anonymous credentials. Background Technology

[0002] The statements in this section merely refer to the background art related to this invention and do not necessarily constitute prior art.

[0003] With the advent of the big data era, more and more user privacy information is being exposed online, making user privacy protection a pressing security issue. In real-world scenarios, users often need to authenticate their identity to use a system or service. However, in traditional authentication methods, systems or services often obtain not only necessary user information but also other, even sensitive, information. Therefore, protecting user privacy during the authentication process is a crucial component of user privacy protection. Anonymous credentials, as an important cryptographic component, have been widely used in various scenarios with privacy protection requirements that include secure authentication.

[0004] However, existing anonymous credentials have the following two problems:

[0005] 1. It does not yet support multi-factor authentication (MFA), which prevents it from being widely used in systems with multi-factor authentication methods;

[0006] 2. Currently, only Policharla et al. have formally proposed an anonymous credential protocol with post-quantum security, but its application scenarios differ significantly from identity authentication and cannot be directly ported.

[0007] Therefore, privacy protection mechanisms in multi-factor authentication scenarios urgently require an anonymous credential that supports multi-factor authentication. Furthermore, given the rapid development of quantum computers, designing and implementing a post-quantum multi-factor authentication anonymous credential has significant theoretical and social value. Summary of the Invention

[0008] To address the shortcomings of existing technologies, this invention provides an identity authentication method, device, and medium based on anonymous credentials, which can solve the drawbacks of traditional identity authentication and anonymous credentials, as well as meet the need for anonymous credentials for multi-factor authentication in scenarios with high privacy protection requirements.

[0009] According to a first aspect of the present invention, the present invention provides an identity authentication method based on anonymous credentials, comprising:

[0010] The mobile terminal sends an anonymous token acquisition request to the server. The server sends a signed blinded token to the mobile terminal. The mobile terminal performs a deblinding operation to obtain the anonymous token and stores it in the local database.

[0011] The mobile terminal uses the stored anonymous token to generate a dynamic password. The web client uses the dynamic password generated by the mobile terminal to send an authentication request to the server. The server performs authentication based on the dynamic password and outputs the authentication result.

[0012] According to a second aspect of the present invention, the present invention provides an identity authentication method based on anonymous credentials, applied to a mobile terminal, the method comprising:

[0013] Send an anonymous token acquisition request to the server;

[0014] Receive the blinded token with signature returned by the server;

[0015] Perform a deblinding operation on the signed blinded token to obtain an anonymous token;

[0016] Store anonymous tokens in a local database;

[0017] Generate dynamic passwords using stored anonymous tokens;

[0018] The dynamic password is used to implement identity authentication for the web client. The web client sends an identity authentication request to the server using the dynamic password, the server performs identity authentication based on the dynamic password, and outputs the identity authentication result.

[0019] According to a third aspect of the present invention, the present invention provides an identity authentication method based on anonymous credentials, applied to a server, the method comprising:

[0020] Obtain the anonymous token acquisition request sent by the mobile terminal;

[0021] Perform a signature operation on the blinded token;

[0022] Send the signed blind token to the mobile terminal;

[0023] Receive dynamic password and authentication request sent by web client; the dynamic password is generated by the mobile terminal deblinding the signed blinded token to obtain an anonymous token;

[0024] Authentication is performed based on the dynamic password, and the authentication result is output.

[0025] According to a fourth aspect of the present invention, the present invention provides an identity authentication method based on anonymous credentials, applied to a web-based client, the method comprising:

[0026] Send the dynamic password and authentication request to the server;

[0027] Receive the authentication result from the server;

[0028] The dynamic password is generated by the mobile terminal based on the anonymous token. The anonymous token is obtained by the mobile terminal sending an anonymous token acquisition request to the server, the server sending the signed blinded token to the mobile terminal, and the mobile terminal performing a deblinding operation.

[0029] According to a fifth aspect of the present invention, a mobile terminal is provided, the mobile terminal comprising:

[0030] The first sending unit is used to send an anonymous token acquisition request to the server;

[0031] The first receiving unit is used to receive the signed blinded token returned by the server;

[0032] The deblinding unit is used to deblind the signed blinded token to obtain the anonymous token;

[0033] Storage unit, used to store anonymous tokens in a local database;

[0034] The password generation unit is used to generate dynamic passwords using stored anonymous tokens;

[0035] The dynamic password is used to implement identity authentication for the web client. The web client sends an identity authentication request to the server using the dynamic password, the server performs identity authentication based on the dynamic password, and outputs the identity authentication result.

[0036] According to a sixth aspect of the present invention, the present invention provides a server, the server comprising:

[0037] The acquisition unit is used to acquire anonymous token acquisition requests sent by the mobile terminal;

[0038] The signature unit is used to sign blinded tokens.

[0039] The second sending unit is used to send the signed blinded token to the mobile terminal;

[0040] The second receiving unit is used to receive dynamic passwords and authentication requests sent by the web client; the dynamic password is generated by the mobile terminal deblinding the signed blinded token to obtain an anonymous token.

[0041] The identity authentication unit is used to authenticate the identity based on the dynamic password and output the authentication result.

[0042] According to a seventh aspect of the present invention, a web-based client is provided, the web-based client comprising:

[0043] The third sending unit is used to send the dynamic password and authentication request to the server;

[0044] The third receiving unit is used to receive the authentication result returned by the server.

[0045] The dynamic password is generated by the mobile terminal based on the anonymous token. The anonymous token is obtained by the mobile terminal sending an anonymous token acquisition request to the server, the server sending the signed blinded token to the mobile terminal, and the mobile terminal performing a deblinding operation.

[0046] According to an eighth aspect of the present invention, the present invention provides an identity authentication system based on anonymous credentials;

[0047] An anonymous credential-based identity authentication system includes: a mobile terminal, a server, and a web-based client; the server communicates with both the mobile terminal and the web-based client.

[0048] The mobile terminal sends an anonymous token acquisition request to the server. The server sends a signed blinded token to the mobile terminal. The mobile terminal performs a deblinding operation to obtain the anonymous token and stores it in the local database.

[0049] The mobile terminal uses the stored anonymous token to generate a dynamic password. The web client uses the dynamic password generated by the mobile terminal to send an authentication request to the server. The server performs authentication based on the dynamic password and outputs the authentication result.

[0050] According to a ninth aspect of the present invention, a storage medium is provided that stores a plurality of instructions adapted to be loaded by a processor to execute any authentication method as described above.

[0051] One of the above technical solutions has the following advantages or beneficial effects:

[0052] (1) This invention provides a post-quantum two-factor anonymous credential protocol based on ring fault-tolerant learning. This protocol can provide anonymous credential authentication services without disclosing the user's login privacy information and meets high privacy protection requirements.

[0053] (2) The post-quantum two-factor anonymity credential based on ring fault-tolerant learning provided by the present invention applies time-based one-time cryptography to the anonymity credential. Compared with traditional anonymity credentials, it has the advantage of supporting two-factor authentication in its construction, and its security is enhanced.

[0054] (3) The post-quantum two-factor anonymity certificate based on ring fault-tolerant learning provided by this invention uses a verifiable random pseudo-random function, which has the advantage of resisting quantum attacks in terms of security. Attached Figure Description

[0055] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0056] Figure 1 This is a flowchart of the method in Example 1;

[0057] Figure 2 This is a system architecture diagram for Example 1. Detailed Implementation

[0058] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0059] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments of the invention. Furthermore, it should be understood that the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0060] Terminology introduction:

[0061] Ring Learning with Errors (RLWE), given a security parameter λ, f(x) is a cyclotomic polynomial Φ. m (x), and satisfy the equation Let R = Z[x] / f(x) and integers q = q(λ) ≥ 2. For the following two distributions:

[0062] (1)

[0063] (2) Uniform distribution For example, {a,b:a←R} q ,b←R q}

[0064] The decision-RLWE problem is to distinguish between the two distributions mentioned above;

[0065] Time-based One-Time Password (TOTP) is an algorithm that calculates a one-time password based on a pre-shared key and the current time. TOTP is an example of Hash Message Authentication Code (HMAC), which combines a private key with the current timestamp and uses a cryptographic hash function to generate the one-time password. We define TOTP as TOTP = HOTP(K,T), where T is an integer representing the number of time steps between the initial counter time T0 and the current Unix time, and HOTP(K,C) = Truncate(HMAC(K,C)), where the Truncate function converts the HMAC value to a HOTP value, and K and C represent the shared key and counter value, respectively.

[0066] A Verifiable Oblivious Pseudorandom Function (VOPRF) is a two-party protocol between a client and a server used to compute the output of a pseudorandom function (PRF). The server provides the PRF key, and the client provides the PRF input. At the end of the protocol, the client learns the PRF output but not any information about the PRF key, and the server learns neither the PRF input nor the PRF output. OPRF can also satisfy the concept of "verifiability," hence the name VOPRF. VOPRF ensures that the client can verify whether the server used a specific private key during the protocol execution.

[0067] Example 1: This example provides an identity authentication method based on anonymous credentials;

[0068] like Figure 1 and Figure 2 As shown, the identity authentication method based on anonymous credentials includes:

[0069] S101: The mobile terminal sends an anonymous token acquisition request to the server. The server sends the signed blinded token to the mobile terminal. The mobile terminal performs a deblinding operation, obtains the anonymous token, and stores it in the local database.

[0070] S102: The mobile terminal uses the stored anonymous token to generate a dynamic password. The web client uses the dynamic password generated by the mobile terminal to send an authentication request to the server. The server performs authentication based on the dynamic password and outputs the authentication result.

[0071] Further, in step S101: the mobile terminal sends an anonymous token acquisition request to the server, the server sends the signed blinded token to the mobile terminal, the mobile terminal performs a deblinding operation to obtain the anonymous token and stores it in the local database, specifically including:

[0072] S101-1: The mobile terminal obtains the username and password entered by the user, randomly selects a message string and a blinding factor, calculates several blinding tokens, generates a first proof file, and sends the username, password, blinding tokens and the first proof file to the server.

[0073] S101-2: The server verifies the username and password sent by the mobile terminal. If the verification is successful, the server verifies the first proof document sent by the mobile terminal. If the first proof document verification is also successful, the server signs the blinding token, generates a second proof document and a commitment, and sends the second proof document, the commitment and the signed blinding token to the mobile terminal.

[0074] S101-3: The mobile terminal verifies the second proof document sent by the server. If the second proof document passes the verification, the mobile terminal deblinds the signed blinded token to obtain an anonymous token. The mobile terminal stores the anonymous token in the local database for future use. If the verification fails, the process ends.

[0075] Further, in S101-1: the mobile terminal obtains the username and password input by the user, randomly selects a message string and a blinding factor, calculates several blinding tokens, generates a first proof file, and sends the username, password, blinding tokens, and first proof file to the server, specifically including:

[0076] The mobile terminal obtains the username and password entered by the user.

[0077] The mobile terminal randomly selects message string x. i 、R(χ σ The element blind factor s on ) i 、R(χ σ ) 1×l Error element on Wherein, R(χ) σ ) represents a polynomial of degree (n-1), in the form a0+a1X+…+a n-1 X n-1 And the coefficient a of the polynomial i , i∈[0,n-1], satisfying a discrete Gaussian distribution χ σ Distribution on; R(χ σ ) 1×lThis represents a 1x1, l-column polynomial matrix, where each element is a polynomial, and the polynomial is R(χ). σ Calculate the elements on the left:

[0078]

[0079]

[0080] in, Represents message string x i The processed value; Represents message string x i The value of a0 or a1 corresponding to the Lth bit is determined by the condition: if the Lth bit is 1, it corresponds to a1; otherwise, it corresponds to a0. Here, a0 and a1 are elements agreed upon by the server and client, and are randomly selected from... The elements on Let R represent a 1xl polynomial matrix, where each element of the polynomial matrix is ​​R. q The elements above, of which Let represent the group of integers of order q. <X n +1> represents a cycloplegic polynomial; G -1 The function G represents the bit decomposition of a polynomial matrix. -1 (A) = B, where G -1 The i-th column of (A) is A i ∈R q The bit decomposition of the function yields a binary polynomial. This function can convert a 1x1x1 polynomial matrix into an lx1x1 polynomial matrix. 'a' is an element agreed upon by both the server and client, whose value is uniformly and randomly selected from... The elements on the index; the prime number q represents the order; This represents the calculated blind token.

[0081] Subsequently, the mobile terminal generates the first proof document:

[0082]

[0083] Where, x i It is a message string, s i It is a blinding factor. The error element is crs1; crs1 is a common reference string, agreed upon by the server and client, consisting of the challenge polynomial ch, the new blind factor s′, the new error element e1′, and the new string x′, where ch is uniformly and randomly selected from R. q Above, s′ is uniformly and randomly selected from R(χ). σ On R(χ), e1′ is uniformly and randomly selected from R(χ). σ) 1×l Above, x′ is a message string selected uniformly and randomly; These are blinding tokens; a, a0, and a1 are elements agreed upon by common convention; the colon represents a separator, the part before the colon is the statement, and the part after the colon is the witness. Representing the first proof system, it generated as well as

[0084] in For a x The calculation of ′, and the calculation Similarly, when calculating x i Replace with x′, Depend on as well as constitute.

[0085] The mobile terminal generated a total of m blind-processed tokens. The mobile terminal user's input (username, password) and the first proof document and blind token They were sent to the server together.

[0086] Further, in S101-2: the server verifies the username and password sent by the mobile terminal. If the verification passes, the server verifies the first proof document sent by the mobile terminal. If the first proof document verification also passes, the server signs the blinding token, generates a second proof document and a commitment, and sends the second proof document, the commitment, and the signed blinding token to the mobile terminal. Specifically, this includes:

[0087] The server verifies the username and password sent by the mobile terminal. If the verification is successful, it then verifies the first authentication document sent by the mobile terminal. in Representing the first verification system, the verification process is verification. Whether it is true or false; if true, the verification passes. as well as From c x ′=a·s′+e1′+a x 'modq,

[0088] Among them, a x ′=a x′,1 ·G -1 (…(a x′,L-1 ·G -1 (a x′,L))…)modq, ch, s′, e1′, x′ come from crs1.

[0089] If the first proof document passes verification, the server signs the blinding token to obtain a signed blinding token.

[0090]

[0091] in, Represents the blinding token; k represents the key pre-assigned to the user; e′ i It is a uniform random number from R(χ) σ ) 1×l The element selected above is considered an error element; q is the order, which is a prime number.

[0092] The server generates a commitment c = a·k + e mod q, where e is the selected faulty element, and q is a uniformly random element drawn from R(χ). σ ) 1×l The selected element.

[0093] At the same time, the server generates a second proof document.

[0094]

[0095] Where k represents the key pre-assigned to the user, e′ i `e` is the error element, and `crs2` is the error element chosen when generating the commitment; `crs2` is the common reference string, agreed upon by the server and client, consisting of the challenge polynomial `ch`, the new key `k′`, the new error element `e″`, and the error element `e′` of the newly generated commitment, where `ch` is uniformly and randomly selected from `R`. q Above, k′ is uniformly and randomly selected from R(χ). σ On ), e″ is uniformly and randomly selected from R(χ). σ ) 1×l Above, e′ is uniformly and randomly selected from R(χ). σ ) 1×l Above; colon: indicates separation, the part before the colon is the statement, and the part after the colon is the evidence; Representing the second proof system, π was generated. k , and π e , where π k =ch·k+k′modq、 π e =ch·e+e′modq, Just from π k , and π e constitute.

[0096] The server then returns a signed, blinded token to the mobile terminal. Second supporting document The commitment c and the necessary information AuxMsg, where the necessary information AuxMsg refers to the result of the authentication.

[0097] Further, in S101-3: the mobile terminal verifies the second proof document sent by the server. If the second proof document passes verification, the mobile terminal deblinds the signed blinded token and stores the deblinded token in its local database for future use. If the verification fails, the process ends. Specifically, this includes:

[0098] The mobile terminal verifies the second proof document sent by the server. The verification process uses the common reference string CRS2, commitment C, and blinding token. Signed blind token prove The verification process adopts In progress, among which This represents the second verification system; the verification process is verification. and aπ k +π e If the equation modq = ch·c + c'modq is true at both ends, then the verification passes. c′=a·k′+e′modq, as well as From ch, k′, e″, and e′ come from crs2.

[0099] If the verification fails, the process ends. If the verification succeeds, the mobile terminal deblinds the signed blinded token to obtain the signature value of the anonymous token.

[0100]

[0101] in, s represents the signature value portion of the anonymous token. i Let q denote the blind factor, and p denote the prime number less than q that is chosen.

[0102] This indicates that the result will be rounded to the nearest natural number (rounding down in the case of a tie), from... Turn to Where p is a prime number less than q, this operation can deblind the received signed blinded token;

[0103] Subsequently, the mobile terminal will send the anonymous token. Stored in a local database for future use; where x i This represents the random string portion of the i-th anonymous token. x represents i The signature value of the corresponding i-th anonymous token, where m is the number of anonymous tokens generated at one time.

[0104] Further, in step S102: the mobile terminal generates a dynamic password using the stored anonymous token, and the web client sends an authentication request to the server using the dynamic password generated by the mobile terminal. The server performs authentication based on the dynamic password and outputs the authentication result, specifically including:

[0105] S102-1: When the number of unused anonymous tokens on the mobile terminal is greater than zero, the mobile terminal randomly selects an anonymous token from the local database. Based on the selected anonymous token, the mobile terminal calculates the shared key between the mobile terminal and the server. Based on the shared key and the current timestamp, the mobile terminal calculates the dynamic password. The mobile terminal displays the strings of the dynamic password and the anonymous token on the mobile terminal's screen for the user to use.

[0106] S102-2: The web client receives the username entered by the user, the string displayed on the mobile terminal, and the dynamic password, and sends a login request to the server.

[0107] S102-3: After receiving a login request, the server first checks whether the anonymous token has been used based on the received string. If it has not been used, the server recalculates the dynamic password and compares it with the dynamic password uploaded by the web client. If they match, the server sends a login success request to the web client; otherwise, the server returns a login failure message to the user.

[0108] Further, in S102-1: when the number of unused tokens on the mobile terminal is greater than zero, the mobile terminal randomly selects an anonymous token from the local database. Based on the selected anonymous token, the mobile terminal calculates a shared key between the mobile terminal and the server. Based on the shared key and the current timestamp, the mobile terminal calculates a dynamic password. The mobile terminal displays the dynamic password and the anonymous token string on its screen for user use. Specifically, this includes:

[0109] When the number of unused tokens on the mobile terminal is greater than zero, an unused anonymous token (x, y) is popped from the local database. x ), where x is the random string part of the anonymous token, y x It is the signature value part of the anonymous token.

[0110] The constructor H2 has the function expression H2(x,y)=Hash(x,y), where Hash function represents a hash function. The SM3 cryptographic hash algorithm is selected. H2(x,y)=z means that the input x and y are hashed to obtain the hash value z.

[0111] The anonymous token (x, y) x The input of function H2 is used as the input, and the output of function H2 is used as the shared key K between the mobile terminal and the server.

[0112] K = H2(x,y) x );

[0113] Subsequently, the mobile terminal uses the shared key K, combined with the current timestamp Tc, to calculate the dynamic password totp for the time-based one-time password (TOTP):

[0114] totp = op(HMAC(K,Tc));

[0115] op(X) = X mod 10 d ;

[0116]

[0117] In this function, HMAC operates on the current timestamp Tc using the key K to obtain a message digest. H is the hash function, the SM3 cryptographic hash algorithm is selected, K is the key, m is the message to be authenticated, and || represents concatenation. XOR represents the message digest, opad is the outer padding, and ipad is the inner padding. The op function converts the message digest into a fixed-length numeric password, where X is the message digest, mod is the modulo operator, and d is the length of the dynamic password. In this example, d is 6.

[0118] Finally, the mobile terminal displays the dynamic password along with 'x' on the mobile terminal interface for the user to use.

[0119] Further, in step S102-2: the web client receives the username entered by the user, the string displayed on the mobile terminal, and the dynamic password; the web client then sends a login request to the server, specifically including:

[0120] The web client receives the username (username), x, and dynamic password (totp) entered by the user, and then sends a login request to the server.

[0121] Further, in S102-3: After receiving the login request, the server first checks whether the token has already been used based on the received string. If it has not been used, the server recalculates the dynamic password and compares it with the dynamic password uploaded by the web client. If they match, the server sends a login success request to the web client; if it has already been used, the server returns login failure information, specifically including:

[0122] After receiving the login request, the server first checks whether token x has already been used. If it has not been used, it calculates the following in sequence:

[0123]

[0124]

[0125]

[0126]

[0127]

[0128] op(X) = X mod 10 d ;

[0129] in, This represents the value of message string x after processing; This represents the value of a0 or a1 corresponding to the Lth bit of the message string x. If the Lth bit is 1, it corresponds to a1; otherwise, it corresponds to a0. -1 The function represents a bit decomposition of a polynomial matrix, transforming a 1x1 polynomial matrix into an lx1 polynomial matrix, expressed as G. -1 (A) = B, where G -1 The i-th column of (A) is A i ∈R q The bit decomposition of k results in a binary polynomial; k represents the signature key. Representative to The value of the signature, This indicates that the result will be rounded to the nearest natural number (rounding down in the case of a tie), from... Turn to Where p is a prime number less than q; The shared key is calculated; the H2 function expression is H2(x,y)=Hash(x,y), where Hash function represents the hash function, and the SM3 cryptographic hash algorithm is selected. H2(x,y)=z means that the input x and y are hashed to obtain the hash value z; the HMAC function uses the current timestamp Tc and the key K to obtain the message digest, where H is the hash function, the SM3 cryptographic hash algorithm is preferred, K is the key, m is the message to be authenticated, and || represents concatenation. XOR represents the message digest, opad is the outer padding, and ipad is the inner padding; the op function can convert the message digest into a fixed-length numeric password, where X is the message digest, mod is the modulo operator, and d is the length of the dynamic password. In this example, d is 6. This represents the TOTP dynamic password calculated by the server.

[0130] The server will receive the TOTP dynamic password. The authentication result (x) is compared with the TOTP dynamic password "totp" sent by the web client. If they match, the login is successful, and the server returns the necessary information, i.e., the authentication result, denoted as AuxMsg, to the web client. The server stores x for future checks. Conversely, if the result has already been used, the login fails, and the server returns relevant error messages.

[0131] This invention proposes a post-quantum two-factor anonymity credential protocol based on ring fault-tolerant learning. The protocol comprises two operational phases: a token issuance phase and a token redemption phase. The token issuance phase is used by mobile terminals to obtain anonymous tokens; the token redemption phase is used by web clients to authenticate identities using anonymous tokens. The post-quantum two-factor anonymity credential protocol provided by this invention employs verifiable randomized functions, time-based one-time cryptographic algorithms, and other techniques to provide post-quantum two-factor anonymity credential authentication without compromising personal privacy, achieving the design goals of low latency, anonymity, two-factor authentication security, and post-quantum security.

[0132] The token issuance phase is used for mobile terminals to obtain anonymous tokens. VOPRF is used in this process. The mobile terminal generates a blinding factor and a random string, calculates a blinded token, and sends the blinded token to the server. The server signs the blinded token, makes a proof, and sends it to the mobile terminal. The mobile terminal deblinds the signed blinded token and verifies the proof.

[0133] The token exchange stage is used by the web client to authenticate the identity using the anonymous token stored on the mobile terminal. During this process, the mobile terminal uses the anonymous token to calculate a dynamic password, and the web client uses the dynamic password to send it to the server for verification. The server then determines the correctness of the password.

[0134] Furthermore, the method also includes: the decisional-RLWE hypothesis and the TOTP algorithm flow;

[0135] The decisional-RLWE hypothesis is a ring-based fault-tolerant learning problem used to substantiate the post-quantum security of the protocol.

[0136] The TOTP algorithm process is used for two-factor authentication using anonymous tokens, thereby proving the security of the protocol's two-factor authentication.

[0137] The decisional-RLWE hypothesis specifically includes the following steps:

[0138] Given the safety parameter λ, the cyclotomic polynomial Let f(x) be an irreducible unit polynomial and satisfy the equation R = Z[x] / f(x) and integers q = q(λ) ≥ 2. For the following two distributions:

[0139] (1)

[0140] (2) Uniform distribution For example, {a,b:a←R} q ,b←R q}

[0141] If anyone is from a uniform distribution Distinguishing Independent Sample Distributions The probabilities of both distributions are negligible, so it can be said that the two distributions mentioned above are computationally indistinguishable.

[0142] The TOTP algorithm process specifically includes the following steps:

[0143] Step A1: Key Generation Phase: A unique key is generated when setting up TOTP for an account. This key is shared between the user's device and the authentication server;

[0144] Step A2: Password Usage Stage: The TOTP algorithm combines the key and the current time, applies a hash function to generate a one-time dynamic password, and uses this password for authentication.

[0145] The specific implementation process of step A1 includes the following sub-steps:

[0146] Step A1.1: The server generates key K and sends key K to the client;

[0147] Step A1.2: The client receives K and saves it.

[0148] The specific implementation process of step A2 includes the following sub-steps:

[0149] Step A2.1: The client uses the current timestamp Tc and the key K to calculate the dynamic password totp = op(HMAC(K,Tc)), where the HMAC function can obtain the message digest using the key K on the current timestamp Tc, expressed as follows: Where H is the hash function, preferably the SM3 cryptographic hash algorithm, K is the key, m is the message to be authenticated, and || represents concatenation. `X` represents XOR, `opad` is the outer padding, and `ipad` is the inner padding; the `op` function converts a message digest into a fixed-length numeric password, expressed as `op(X) = X mod 10`. d Where X is the message digest, mod is the modulo operator, and d is the length of the dynamic password, which is 6 in this embodiment. When a user needs to log in, they enter their username and dynamic password, which are then sent to the server for verification.

[0150] Step A2.2: The server uses the current timestamp Tc and the corresponding user's key K to calculate the password totp = op(HMAC(K,Tc)). Then, it compares totp with the password. If they are the same, authentication is successful; otherwise, authentication fails. The server also returns necessary information to the client, denoted as AuxMsg.

[0151] The post-quantum two-factor anonymity credential protocol based on ring fault-tolerant learning provided by this invention includes a token issuance stage and a token redemption stage. In the token issuance stage, the mobile terminal generates an anonymous token using VOPRF. During this process, the mobile terminal generates a blinding factor and a random string, calculates a blinded token, and sends the blinded token to the server. The server signs the blinded token, provides a proof, and sends it to the mobile terminal. The mobile terminal deblinds the signed blinded token and verifies the proof. In the token redemption stage, the web client uses the anonymous token stored on the mobile terminal for authentication. During this process, the mobile terminal uses the anonymous token to calculate a dynamic password, and the web client uses the dynamic password to send it to the server for verification. The server then determines the correctness of the password.

[0152] This invention provides two-factor anonymous credentials. This solution applies TOTP to anonymous credentials, giving them the advantages of two-factor authentication.

[0153] This invention can provide post-quantum two-factor anonymity credentials: This scheme is based on the RLWE hypothesis and uses VOPRF, which gives the anonymity credentials the advantage of resistance to quantum attacks.

[0154] This invention provides users with a convenient and secure method for identity authentication.

[0155] Example 2: This embodiment of the invention provides an identity authentication method based on anonymous credentials, applied to a mobile terminal. The method includes:

[0156] Send an anonymous token acquisition request to the server;

[0157] Receive the blinded token with signature returned by the server;

[0158] Perform a deblinding operation on the signed blinded token to obtain an anonymous token;

[0159] Store anonymous tokens in a local database;

[0160] Generate dynamic passwords using stored anonymous tokens;

[0161] The dynamic password is used to implement identity authentication for the web client. The web client sends an identity authentication request to the server using the dynamic password, the server performs identity authentication based on the dynamic password, and outputs the identity authentication result.

[0162] Other aspects and implementation details of the authentication method are the same as or similar to those of the authentication method described above, and will not be repeated here.

[0163] Example 3: This invention provides an identity authentication method based on anonymous credentials, applied to a server. The method includes:

[0164] Obtain the anonymous token acquisition request sent by the mobile terminal;

[0165] Perform a signature operation on the blinded token;

[0166] Send the signed blind token to the mobile terminal;

[0167] Receive dynamic password and authentication request sent by web client; the dynamic password is generated by the mobile terminal deblinding the signed blinded token to obtain an anonymous token;

[0168] Authentication is performed based on the dynamic password, and the authentication result is output.

[0169] Other aspects and implementation details of the authentication method are the same as or similar to those of the authentication method described above, and will not be repeated here.

[0170] Example 4: This invention provides an identity authentication method based on anonymous credentials, applied to a web-based client. The method includes:

[0171] Send the dynamic password and authentication request to the server;

[0172] Receive the authentication result from the server;

[0173] The dynamic password is generated by the mobile terminal based on the anonymous token. The anonymous token is obtained by the mobile terminal sending an anonymous token acquisition request to the server, the server sending the signed blinded token to the mobile terminal, and the mobile terminal performing a deblinding operation.

[0174] Other aspects and implementation details of the authentication method are the same as or similar to those of the authentication method described above, and will not be repeated here.

[0175] Example 5: The present invention provides a mobile terminal, the mobile terminal comprising:

[0176] The first sending unit is used to send an anonymous token acquisition request to the server;

[0177] The first receiving unit is used to receive the signed blinded token returned by the server;

[0178] The deblinding unit is used to deblind the signed blinded token to obtain the anonymous token;

[0179] Storage unit, used to store anonymous tokens in a local database;

[0180] The password generation unit is used to generate dynamic passwords using stored anonymous tokens;

[0181] The dynamic password is used to implement identity authentication for the web client. The web client sends an identity authentication request to the server using the dynamic password, the server performs identity authentication based on the dynamic password, and outputs the identity authentication result.

[0182] Other aspects and implementation details of the authentication method are the same as or similar to those of the authentication method described above, and will not be repeated here.

[0183] Example 6: The present invention provides a server, the server comprising:

[0184] The acquisition unit is used to acquire anonymous token acquisition requests sent by the mobile terminal;

[0185] The signature unit is used to sign blinded tokens.

[0186] The second sending unit is used to send the signed blinded token to the mobile terminal;

[0187] The second receiving unit is used to receive dynamic passwords and authentication requests sent by the web client; the dynamic password is generated by the mobile terminal deblinding the signed blinded token to obtain an anonymous token.

[0188] The identity authentication unit is used to authenticate the identity based on the dynamic password and output the authentication result.

[0189] Example 7: The present invention provides a web-based client, which includes:

[0190] The third sending unit is used to send the dynamic password and authentication request to the server;

[0191] The third receiving unit is used to receive the authentication result returned by the server.

[0192] The dynamic password is generated by the mobile terminal based on the anonymous token. The anonymous token is obtained by the mobile terminal sending an anonymous token acquisition request to the server, the server sending the signed blinded token to the mobile terminal, and the mobile terminal performing a deblinding operation.

[0193] Other aspects and implementation details of the authentication method are the same as or similar to those of the authentication method described above, and will not be repeated here.

[0194] Example 8: This invention provides an identity authentication system based on anonymous credentials;

[0195] An anonymous credential-based identity authentication system includes: a mobile terminal, a server, and a web-based client; the server communicates with both the mobile terminal and the web-based client.

[0196] The mobile terminal sends an anonymous token acquisition request to the server. The server sends a signed blinded token to the mobile terminal. The mobile terminal performs a deblinding operation to obtain the anonymous token and stores it in the local database.

[0197] The mobile terminal uses the stored anonymous token to generate a dynamic password. The web client uses the dynamic password generated by the mobile terminal to send an authentication request to the server. The server performs authentication based on the dynamic password and outputs the authentication result.

[0198] Other aspects and implementation details of the authentication method are the same as or similar to those of the authentication method described above, and will not be repeated here.

[0199] Example 9: The present invention provides a storage medium storing a plurality of instructions, which are adapted to be loaded by a processor to execute any authentication method as described above.

[0200] Other aspects and implementation details of the authentication method are the same as or similar to those of the authentication method described above, and will not be repeated here.

[0201] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An identity authentication method based on anonymous credentials, characterized by: include: The mobile terminal sends an anonymous token acquisition request to the server. The server sends a signed blinded token to the mobile terminal. The mobile terminal performs a deblinding operation to obtain the anonymous token and stores it in the local database. The mobile terminal uses the stored anonymous token to generate a dynamic password. The web client uses the dynamic password generated by the mobile terminal to send an authentication request to the server. The server performs authentication based on the dynamic password and outputs the authentication result. The mobile terminal sends an anonymous token acquisition request to the server. The server sends a signed, blinded token to the mobile terminal, which then performs a deblinding operation to obtain the anonymous token and stores it in its local database. This process includes: The mobile terminal obtains the username and password entered by the user, randomly selects a message string and a blinding factor, calculates several blinding tokens, generates a first proof file, and sends the username, password, blinding tokens and the first proof file to the server. The server verifies the username and password sent by the mobile terminal. If the verification is successful, the server verifies the first proof document sent by the mobile terminal. If the first proof document verification is also successful, the server signs the blinding token, generates a second proof document and a commitment, and sends the second proof document, commitment and signed blinding token to the mobile terminal. The mobile terminal verifies the second proof document sent by the server. If the second proof document passes the verification, the mobile terminal deblinds the signed blinded token to obtain an anonymous token. The mobile terminal stores the anonymous token in the local database for future use. If the verification fails, the process ends. The mobile terminal uses a stored anonymous token to generate a dynamic password. The web client uses this dynamic password to send an authentication request to the server. The server performs authentication based on the dynamic password and outputs the authentication result, which includes: When the number of unused anonymous tokens on the mobile terminal is greater than zero, the mobile terminal randomly selects an anonymous token from the local database. Based on the selected anonymous token, the mobile terminal calculates the shared key between the mobile terminal and the server. Based on the shared key and the current timestamp, the mobile terminal calculates the dynamic password. The mobile terminal displays the dynamic password and the anonymous token string on the mobile terminal's screen for the user to use. The web client receives the username entered by the user, the string displayed on the mobile terminal, and the dynamic password, and then sends a login request to the server. After receiving a login request, the server first checks whether the anonymous token has already been used based on the received string. If it has not been used, the server recalculates the dynamic password and compares it with the dynamic password uploaded by the web client. If they match, the server sends a login success message to the web client; otherwise, the server returns a login failure message to the user.

2. The identity authentication method based on anonymous credentials according to claim 1, characterized in that, Applied to a mobile terminal, the method includes: Send an anonymous token acquisition request to the server; Receive the blinded token with signature returned by the server; Perform a deblinding operation on the signed blinded token to obtain an anonymous token; Store anonymous tokens in a local database; Generate dynamic passwords using stored anonymous tokens; The dynamic password is used to implement identity authentication for the web client. The web client uses the dynamic password to send an identity authentication request to the server, the server performs identity authentication based on the dynamic password, and outputs the identity authentication result.

3. The identity authentication method based on anonymous credentials according to claim 1, characterized in that, Applied to a server, the method includes: Obtain the anonymous token acquisition request sent by the mobile terminal; Perform a signature operation on the blinded token; Send the signed blind token to the mobile terminal; Receive dynamic passwords and authentication requests sent by the web client; the dynamic password is generated by the mobile terminal deblinding the signed blinded token to obtain an anonymous token; Authentication is performed based on the dynamic password, and the authentication result is output.

4. The identity authentication method based on anonymous credentials according to claim 1, characterized in that, Applied to web-based clients, the method includes: Send the dynamic password and authentication request to the server; Receive the authentication result from the server; The dynamic password is generated by the mobile terminal based on the anonymous token. The anonymous token is obtained by the mobile terminal sending an anonymous token acquisition request to the server, the server sending the signed blinded token to the mobile terminal, and the mobile terminal performing a deblinding operation.

5. A mobile terminal that can implement the identity authentication method based on anonymous credentials as described in claim 2, characterized in that, The mobile terminal includes: The first sending unit is used to send an anonymous token acquisition request to the server; The first receiving unit is used to receive the signed blinded token returned by the server; The deblinding unit is used to deblind the signed blinded token to obtain the anonymous token; Storage unit, used to store anonymous tokens in a local database; The password generation unit is used to generate dynamic passwords using stored anonymous tokens; The dynamic password is used to implement identity authentication for the web client. The web client uses the dynamic password to send an identity authentication request to the server, the server performs identity authentication based on the dynamic password, and outputs the identity authentication result.

6. A server capable of implementing the anonymous credential-based authentication method as described in claim 3, characterized in that, The server includes: The acquisition unit is used to acquire anonymous token acquisition requests sent by the mobile terminal; The signature unit is used to sign blinded tokens. The second sending unit is used to send the signed blinded token to the mobile terminal; The second receiving unit is used to receive dynamic passwords and authentication requests sent by the web client; the dynamic password is generated by the mobile terminal deblinding the signed blinded token to obtain an anonymous token. The identity authentication unit is used to authenticate the identity based on the dynamic password and output the authentication result.

7. A web-based client that implements the anonymous credential-based identity authentication method as described in claim 4, characterized in that, The web-based client includes: The third sending unit is used to send the dynamic password and authentication request to the server; The third receiving unit is used to receive the authentication result returned by the server. The dynamic password is generated by the mobile terminal based on the anonymous token. The anonymous token is obtained by the mobile terminal sending an anonymous token acquisition request to the server, the server sending the signed blinded token to the mobile terminal, and the mobile terminal performing a deblinding operation.

8. A storage medium, characterized in that, The storage medium stores multiple instructions that are adapted to be loaded by a processor to execute the authentication method as described in any one of claims 2-4 above.

Images