An authentication method and apparatus

Abstract

The application provides an authentication method, comprising receiving an authentication request sent by a user terminal; in response to the authentication request, determining a digest of an access control policy circuit; generating a first non-interactive zero-knowledge proof value to prove that the digest is generated legally; sending the first challenge message, the digest and the first non-interactive zero-knowledge proof value to the user terminal; receiving a second non-interactive zero-knowledge proof value and a ciphertext sent by the user terminal; wherein the second non-interactive zero-knowledge proof value is generated for the first challenge message to prove that the user terminal is a legal registration and the ciphertext is generated legally; the ciphertext is generated by encrypting the private key of the user terminal based on the digest; performing legality verification on the second non-interactive zero-knowledge proof value, and if the verification is passed, determining the private key of the user terminal as an input of the access control policy circuit based on the ciphertext and the access control policy circuit, and an output value of the access control policy circuit; and determining whether the user terminal passes the authentication based on the output value of the access control policy circuit.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computer computing and information security, and in particular, to an authentication method and device. BACKGROUND

[0002] An anonymous credential system supports users to authenticate to a service provider in an anonymous manner, so as to obtain access to the service provided by the service provider. Specifically, the anonymous credential system mainly includes two protocols, a registration protocol and an authentication protocol. In the registration protocol, a user registers to a service provider in real name, and obtains a valid credential capable of proving the identity thereof; in the authentication protocol, the user proves the legitimacy of the identity thereof to the service provider in an anonymous manner. The security requirements of the anonymous credential system mainly include: 1) authentication, i.e., a user who has not registered cannot pass the authentication of the service provider; and 2) anonymity, i.e., the service provider cannot obtain any identity information about the user or associate any two authentication activities of the same user through the authentication protocol. Since such a cryptographic primitive is proposed, the anonymous credential system not only has theoretical research value, but also is widely applied to identity management systems in the actual world to obtain privacy protection authentication features. Well-known examples include Idemix under IBM and U-Prove under Microsoft.

[0003] Of course, the anonymity guarantee provided by the anonymous credential system is a double-edged sword. Since it can perfectly hide the identity information of the user in the authentication process, it also encourages some users to perform malicious service access activities, such as publishing rumors or destroying web services, but due to the anonymity guarantee of the protocol, it can evade the punishment of the service provider. SUMMARY

[0004] Embodiments of the present application provide an authentication method, which realizes the supervision of authentication activities on the basis of guaranteeing the anonymity of the identity of a user.

[0005] In a first aspect, the present application provides an authentication method applied to a server, comprising: receiving authentication request information sent by a user terminal; determining an access control policy circuit summary in response to the authentication request information, the access control policy circuit representing an access control policy of the server; generating a first non-interactive zero-knowledge proof value based on a non-interactive zero-knowledge proof system to prove that the summary is generated legally; sending the first challenge message, the summary and the first non-interactive zero-knowledge proof value to the user terminal; receiving a second non-interactive zero-knowledge proof value and a ciphertext sent by the user terminal; wherein the second non-interactive zero-knowledge proof value and the ciphertext are generated by the user terminal after passing the verification of the first non-interactive zero-knowledge proof value; the second non-interactive zero-knowledge proof value is generated based on the non-interactive zero-knowledge proof system for the first challenge message to prove that the user terminal is a legal registration and the ciphertext is a legal generation; the ciphertext is generated by encrypting the private key of the user terminal based on the summary in the encryption algorithm of the succinct function calculation; verifying the legality of the second non-interactive zero-knowledge proof value, if the verification is passed, determining the private key of the user terminal as the input of the access control policy circuit based on the ciphertext and the access control policy circuit, and the output value of the access control policy circuit; determining whether the user terminal passes the authentication based on the output value of the access control policy circuit.

[0006] The authentication method provided by the present application can make the identity verifier (i.e. the server) formulate an arbitrary access control policy, and verify whether the user (i.e. the user terminal) meets the conditions without disclosing the access control policy, and then make a decision whether to provide services to the user; on the other hand, the user needs to verify the identity with the secret private key mastered by the user, but does not need to disclose any private key related information to the verifier during the process. That is, the authentication method provided by the present application realizes the supervision of anonymous access through the access control policy of the server.

[0007] In one possible implementation, the authentication method further comprises receiving a label sent by the user terminal, and the second non-interactive zero-knowledge proof value is further used to prove that the label has been bound to the identity of the user terminal, and the label is used to identify the current authentication process of the user terminal.

[0008] In this possible implementation, the design of adding the label can select a randomly generated label in each authentication activity, and the label can make the verifier (i.e. the server) identify the current authentication process of the user.

[0009] In another possible implementation, the label comprises a first random number and a second random number, the first random number is randomly selected from a key space of a pseudo-random function, and the second random number is determined by the pseudo-random function based on the first random number and the private key of the user terminal.

[0010] In another possible implementation, the digest is calculated by the access control policy circuit based on the public reference string, and the digest function is calculated based on a third random number, wherein the public reference string is generated by the public reference string generator in the succinct function calculation based on the security parameter and a size parameter of the access control policy circuit.

[0011] In another possible implementation, the size parameter of the access control policy circuit includes a number of gate circuits of the access control policy circuit.

[0012] In another possible implementation, the calculation parameter of the encryption algorithm is a fourth random number.

[0013] In another possible implementation, based on the output value of the access control policy circuit, it is determined whether the user terminal is authenticated, including: if the output value is 1, it is determined that the user terminal is authenticated, and if the output value is 0, it is determined that the user terminal is not authenticated.

[0014] In another possible implementation, the authentication method further includes scoring the current authentication activity of the user terminal based on the label.

[0015] In this possible implementation, the service end can score the authentication activity of the user terminal based on the label, and add the score to the access control policy in the next authentication of the user terminal. Several authentication activities can be linked, for example, when the authentication activity score of the user terminal is lower than the threshold value for a preset number of times, the access of the user terminal is refused.

[0016] In another possible implementation, the authentication method further includes that the label has attribute information, and the access control policy circuit is adjusted based on the attribute information of the label.

[0017] In this possible implementation, the user terminal gives the label different attributes, and the service end adds the attribute to the access control policy, for example, the label has age attribute information (such as adult or minor), and the service end adds the age attribute information to the access control policy, such as prohibiting the user under the age of eighteen from accessing.

[0018] In another possible implementation, the non-interactive zero-knowledge proof system and the succinct function calculation are constructed based on an anti-quantum attack assumption to realize that the entire authentication scheme is anti-quantum attack.

[0019] Secondly, this application provides an authentication method applied to a user terminal, comprising: sending authentication request information to a server; receiving a first challenge message, a digest, and a first non-interactive zero-knowledge proof value sent by the server, wherein the digest is a digest of the server's access control policy circuit, and the access control policy circuit represents the server's access control policy; the first non-interactive zero-knowledge proof value is generated based on a non-interactive zero-knowledge proof system to prove the legality of the digest generation; performing a legality verification on the first non-interactive zero-knowledge proof value, and if the verification passes, running an encryption algorithm in a concise function computation to encrypt the user terminal's private key based on the digest to obtain ciphertext; generating a second non-interactive zero-knowledge proof value for the first challenge message based on the non-interactive zero-knowledge proof system to prove that the user terminal is legally registered and that the ciphertext is legally generated; sending the second zero-knowledge proof value and the ciphertext to the server so that the server can perform a legality verification on the second non-interactive zero-knowledge proof value, and if the verification passes, determining, based on the ciphertext and the access control policy circuit, the user terminal's private key as the input of the access control policy circuit and the output value of the access control policy circuit; and determining whether the user terminal has passed authentication based on the output value of the access control policy circuit.

[0020] In one possible implementation, the authentication method further includes generating a tag bound to the user's identity and sending the tag to the server. A second non-interactive zero-knowledge proof value is also used to prove that the tag is bound to the user's identity. The tag is used to identify the current authentication process of the user.

[0021] In another possible implementation, the tag includes a first random number and a second random number, the first random number being randomly selected from the key space of a pseudo-random function, and the second random number being determined by the pseudo-random function based on the first random number and the user's private key.

[0022] In another possible implementation, the digest function in the concise function computation is calculated based on a common reference string and an access control policy circuit. The computation parameter of the digest function is a second random number. The common reference string in the concise function computation is generated by a common reference string generator based on security parameters and the size parameter of the access control policy circuit.

[0023] In another possible implementation, the size parameter of the access control policy circuit includes the number of gates in the access control policy circuit.

[0024] In another possible implementation, the encryption algorithm's computational parameter is a fourth random number.

[0025] In another possible implementation, the authentication status of the user terminal is determined based on the output value of the access control policy circuit, including: if the output value is 1, the user terminal is determined to be authenticated; if the output value is 0, the user terminal is determined to be unauthenticated.

[0026] In another possible implementation, the tag is also used by the server to score the current authentication activity of the user based on the tag.

[0027] In another possible implementation, the tag has attribute information, which is used by the server to adjust the access control policy circuitry based on the tag's attribute information.

[0028] In another possible implementation, non-interactive zero-knowledge proof systems and concise function computations are constructed using the assumption of quantum attack-resistant security.

[0029] Thirdly, this application provides an authentication system, including a server and a user terminal, wherein the server is used to implement the method described in the first aspect, and the user terminal is used to implement the method described in the second aspect.

[0030] Fourthly, this application provides a computing device including a memory and a processor, wherein the memory stores instructions that, when executed by the processor, cause the method described in the first aspect or the method described in the second aspect to be implemented.

[0031] Fifthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, causes the method described in the first aspect or the method described in the second aspect to be implemented.

[0032] In a sixth aspect, embodiments of this application also provide a computer program or computer program product, the computer program or computer program product including instructions that, when executed, cause a computer to perform the method described in the first aspect or the second aspect.

[0033] In a seventh aspect, embodiments of this application also provide a chip including at least one processor and a communication interface, wherein the processor is configured to execute the method described in the first aspect or the second aspect. Attached Figure Description

[0034] Figure 1 This application provides an illustration of an application scenario for an authentication method.

[0035] Figure 2 A flowchart illustrating a registration method provided in this application embodiment;

[0036] Figure 3 A flowchart of an authentication method provided in this application embodiment;

[0037] Figure 4 A flowchart of another authentication method provided in this application embodiment;

[0038] Figure 5A schematic diagram of the structure of a computing device provided in an embodiment of this application. Detailed Implementation

[0039] The technical solution of this application will be further described in detail below with reference to the accompanying drawings and embodiments.

[0040] To facilitate understanding, the meanings of the technical terms used in the text are explained below.

[0041] Anonymous credential system: This system allows users to authenticate with service providers anonymously, thereby gaining access to the services offered by the service providers. It mainly includes two protocols: first, the user registers their identity with the service provider and obtains credentials; then, when accessing services, the user must first authenticate with the service provider, displaying valid credentials anonymously.

[0042] A monitorable anonymous credential system: Building upon traditional anonymous credential systems, this system allows service providers to monitor users who have made malicious access attempts, such as blocking access from malicious users.

[0043] Anonymous credential system based on blacklist: The service provider maintains a blacklist to record malicious authentication. When a user performs an authentication protocol, they need to prove that they have not performed any access behavior on the blacklist.

[0044] Reputation-based anonymous credential system: This system further refines the access policy of a blacklist-based anonymous credential system, allowing service providers to score each user's authentication behavior. When a user wants to authenticate, they need to prove that the total score of all their previous access activities meets a threshold set by the service provider.

[0045] Concise function computation is a two-party computation protocol in cryptography. Roughly speaking, it mainly involves a server and a user. The server holds a public circuit C, and the user holds a private input x. This protocol ensures that the server can compute the circuit output C(x) with minimal computational effort on the user side, without obtaining any information about the user x.

[0046] A pseudo-random function scheme is a cryptographic primitive that computes a function value based on a key and an input. Its security is guaranteed by ensuring that, with the key hidden, the output of a pseudo-random function is indistinguishable from the output of a true random function for the same input.

[0047] Digital signature schemes are cryptographic primitives primarily used to ensure the reliability of message sources. After a signer signs a message, the verifier, upon receiving the message and its signature, can confirm that the message was indeed signed and verified by the signer.

[0048] Zero-knowledge proof system: a common term in cryptography that allows a prover to assure a verifier that they possess secret information without revealing any information about that secret.

[0049] To address the issue that some users can conduct malicious service access activities in existing anonymous credential systems, evading service provider penalties due to the anonymity guarantee of the protocol, anonymous credential systems that enable service providers to monitor malicious user access have gained attention. Hereinafter, we will refer to this type of anonymous credential system as a monitorable anonymous credential system.

[0050] The first approach is an anonymous credential system based on a revocation center. To empower service providers to monitor malicious users, this solution relies on a trusted revocation center. For malicious user authentication attempts, the revocation center can deanonymize the authentication, effectively unlocking the user's anonymous authentication and thus obtaining their identity. This allows the center to block the user's subsequent access to the service. In simpler terms, to implement the revocation function, the authentication protocol of this type of anonymous credential system requires users to additionally encrypt their identity information before transmitting it to the service provider. When a user commits malicious behavior, the revocation center can decrypt this ciphertext to obtain the user's identity information.

[0051] Such anonymous credential systems can provide service providers with oversight of malicious users. However, the drawback of this construction method lies in the assumption that the revocation center is trustworthy, meaning it is believed not to engage in any malicious activity. But once the revocation center is corrupted, the privacy of all users will be compromised. Furthermore, this construction does not align with the current mainstream direction of protocol research, which emphasizes decentralization to reduce the security assumptions required by the protocol.

[0052] The second approach is a blacklist-based anonymous credential system. Considering that the aforementioned revocation-center-based anonymous credential system relies on a third party, a blacklist-based system was proposed to eliminate this dependence. In this system, malicious users no longer revoke their identities through a trusted revocation center. Instead, once a user engages in any malicious activity, their subsequent service access will be blocked. Specifically, to achieve this, the authentication protocol requires the service provider to send the user an additional blacklist containing all malicious access behaviors; the user must also prove to the service provider that they have not initiated any authentication activity involving malicious behavior listed on the blacklist. Further work refines the service provider's access control policy, allowing the service provider to score each user's access activity; in this sense, the blacklist becomes a scoring table. When authenticating, users need to prove to the service provider that their total score from past access activities meets a pre-set threshold. This type of system is called a reputation-based anonymous credential system.

[0053] The advantage of a blacklist-based (including its subsequent reputation-based) anonymous credential system is that it eliminates the reliance on trusted third parties, instead having the service provider maintain the corresponding revocation information themselves, and this revocation information itself does not compromise user privacy.

[0054] However, the aforementioned blacklist-based solution has the following shortcomings: First, during protocol interaction, the service provider (SP) needs to send the entire blacklist to the user, and the user needs to access the entire blacklist. This results in the communication complexity of the protocol (including the user and service provider sides) being related to the size of the blacklist during the authentication process. Second, in this solution, the size of the proof that the user needs to generate in the authentication protocol is linearly related to the size of the blacklist, leading to high computational load and low efficiency on the user side in practical applications. Finally, the access policy of the supervised anonymous credential system needs to be based on the blacklist, which lacks expressiveness.

[0055] In other words, a blacklist-based, regulated anonymous credential system has the following problems:

[0056] Scalability is a significant issue. In all constructs of a blacklist-based, manageable anonymous credential system, the service provider must send the blacklist information to each user during authentication. However, when the system is large—that is, with a large number of users and frequent authentication actions—the blacklist size becomes substantial. Besides the transmission burden, the computational load required for users to generate corresponding proofs based on the blacklist content to complete access authentication also increases considerably with a large blacklist, making it difficult for average users to handle, thus posing a scalability problem.

[0057] The expressiveness of access control policies is a problem. Previous, manageable anonymous credential systems that didn't rely on a trusted revocation center only supported simple access control policies. On one hand, service providers' access control policies were relatively simple, such as revoking user access by simply comparing behavior against a blacklist. On the other hand, service providers could only rely on publicly available information to determine which user behavior should be classified as malicious. This made existing manageable anonymous credential systems unsuitable for applications requiring more sophisticated judgment policies. For example, if a user's multiple authentication attempts could lead to malicious behavior, then all of these authentication attempts should be considered malicious. However, because the security requirements of anonymous credential systems dictate that a user's authentication attempts cannot be linked to each other to ensure user privacy, this system does not support such access control policies.

[0058] Privacy concerns arise with access policies. All previous, overseen anonymous credential systems, including the second approach, that did not rely on a trusted revocation center assumed their access control policies to be public by default—meaning everyone could access them. However, in certain scenarios, service providers may wish to hide their access control policies for privacy reasons.

[0059] To address the aforementioned issues, this application proposes a novel method for constructing a supervised anonymous credential system. Utilizing concise function computation, it allows the authenticator to define arbitrary access control policies and verify user compliance without revealing these policies. Conversely, users verify their identity using their private keys without disclosing any private key-related information to the authenticator. Furthermore, in some other examples, a tag design is incorporated, allowing the authenticator to select a randomly generated tag for each authentication activity. This tag identifies the user and can be subsequently assigned different attributes, which can then be incorporated into the access control policy conditions.

[0060] The supervised anonymous credential system provided in this application mainly includes four algorithms:

[0061] Setup: This algorithm is used to establish the system and generate the corresponding system parameters. These system parameters are publicly available and can be accessed by both the server and the client.

[0062] SPSetup: This algorithm is run by the service provider. Input security parameters (e.g., 1) λ Output the public-private key pair (spk, ssk) of the service provider, where spk is the service provider's public key and ssk is its private key.

[0063] Registration: This agreement is for the interaction between the service provider and the user. Upon successful completion, the user will receive a credential issued by the service provider.

[0064] Authentication: This protocol is completed through interaction between the service provider and the user. After execution, the service provider (SP) outputs success / failure to indicate whether the user has passed authentication. During protocol execution, the SP outputs access control policies to the user; a registered user can only pass authentication if these access control policies are met.

[0065] This application provides an authentication method based on a supervised anonymous credential system. The following detailed description of the authentication method provided by this application, in conjunction with the accompanying drawings, provides a comprehensive overview.

[0066] Figure 1 This is a schematic diagram illustrating an application scenario of an authentication method provided in this application embodiment. It includes a server 10 and a user terminal 20 connected via a communication connection. The server 10 and user terminal 20 can communicate wirelessly or via a wired connection. This application embodiment does not specifically limit the communication connection method between the server 10 and the user terminal 20.

[0067] Server 10 can provide other services or software applications, including both non-virtual and virtual environments. In some embodiments, these services may be provided as web-based services or cloud services, such as to users on the client side under a Software as a Service (SaaS) model.

[0068] like Figure 1 As shown, a user can send an authentication request to the server using client 20. The server 10 responds to the authentication request and authenticates the user. Once the authentication is successful, the server allows client 20 to access server 10 and provides services to client 20.

[0069] Understandably, only users who have been legally registered and whose authentication activities comply with the server's access control policies can pass the authentication process.

[0070] User terminal 20 can be various types of computer devices, such as portable handheld devices, general-purpose computers (e.g., personal computers or laptops), workstation computers, wearable devices, etc. These computer devices may run various types and versions of software applications and operating systems, such as Microsoft Windows, Apple iOS, UNIX-like operating systems, Linux or Linux-like operating systems (e.g., Google Chrome OS); or various mobile operating systems, such as Microsoft Windows Mobile OS, Windows Phone, Android, iPhone OS, etc. Portable handheld devices can include cellular phones, smartphones, tablets, personal digital assistants (PDAs), etc. Wearable devices can include head-mounted displays and smartwatches, etc.

[0071] Server 10 may be a server device comprising one or more general-purpose computers, special-purpose server computers (e.g., personal computer servers, UNIX servers, terminal servers), blade servers, mainframe computers, server clusters, or any other suitable arrangement or combination of server devices. The server device may include one or more virtual machines running a virtual operating system, or other computing architectures involving virtualization, such as one or more flexible pools of logical storage devices that can be virtualized to maintain virtual storage devices for the server. In various embodiments, server 130 may run one or more services or software applications that provide the functionality described below.

[0072] The underlying cryptographic components involved in the authentication method provided in this application embodiment mainly include: a pseudorandom function (PRF) scheme, a latonic function evaluation (LFE) scheme, a digital signature scheme Sig, and a non-interactive zero-knowledge proof system (NIZKAoK).

[0073] The pseudo-random function PRF = (KeyGen, Eval) comprises two algorithms: KeyGen and Eval. The KeyGen algorithm takes security parameters as input and outputs a key k. The Eval algorithm takes the key k and an input x as input and outputs a function-computed value y, denoted as y = Eval(k, x). Furthermore, we use... Represents the key space. Represents the input space of the function and This represents the function's output space.

[0074] The concise function computation LFE = (CrsGen, Compress, Enc, Dec) comprises four algorithms: CrsGen, Compress, Enc, and Dec. CrsGen takes security parameters and the circuit size C as input and outputs a uniformly random common reference string (crs). Compress is a random algorithm that takes crs and circuit C as input and outputs a short digest, using the random number r. The Enc algorithm takes crs, the digest, and message x as input and outputs the ciphertext ct, using the random number r′. The Dec algorithm takes crs, C, ct, and r as input and outputs the message y, satisfying y = C(x), meaning y is the computation result of circuit C when the input is x.

[0075] The digital signature scheme Sig = (KeyGen, Sign, Verify) comprises three algorithms. The KeyGen algorithm takes security parameters as input and outputs a public-private key pair (pk, sk). The Sign algorithm takes the message m and the private key sk as input and outputs the signature σ. The Verify algorithm takes pk, m, and σ as input and outputs bits b to represent the validity of the signature.

[0076] The non-interactive zero-knowledge proof system NIZKAok={(ω):(x,ω)∈R}[m] represents a prover's proof that they possess the evidence ω corresponding to the statement x, satisfying (x,ω)∈R, given a challenge message m. (x,ω)∈R indicates that x and ω satisfy a certain relation R. The space representation of the challenge message is...

[0077] This application provides a general construction for an anonymous credential system based on an arbitrary secure pseudo-random function PRF = (PRF.KeyGen, PRF.Eval), a concise function computation LFE = (LFE.CrsGen, LFE.Compress, LFE.Enc, LFE.Dec), a digital signature scheme Sig = (Sig.KeyGen, Sig.Sign, Sig.Verify), and a non-interactive zero-knowledge proof system NIZKAok, as follows:

[0078] Setup: Input security parameters, output public parameters pp = (x, crs), where x ∈ D IN ,crs←LFE.CrsGen(1 λ (params).

[0079] SPSetup: SP runs Sig.Setup(1 λ)→(sk,pk), setting ssk=sk, spk=pk. Here, ssk represents the private information of the SP, and spk represents the public information. Initialization list

[0080] For a user to pass the server's authentication, they must be a legitimate registered user. The following describes a registration method provided by an embodiment of this application.

[0081] Figure 2 This is a flowchart illustrating a registration method provided in an embodiment of this application. This registration method may also be referred to as a registration protocol, such as... Figure 2 As shown, in the registration agreement, the user first sends a "registration request" to the SP. The SP then retrieves the request from the challenge message space. The system randomly selects a challenge message m and returns message m to the user. Next, the user generates their own public / private key pair: first, it runs PRF.KeyGen(1... λ The user's private key is usk, and their public key is upk. Then, the user generates a zero-knowledge proof π = NIZKPoK{(usk):upk = F}. usk (x)}[m], and returns (upk,π) to SP. After receiving (upk,π), SP first verifies the validity of π. If valid, it then checks whether upk belongs to the registered list. If it belongs to the category, return registration failure; otherwise, SP runs σ = Sig.Sign(ssk,upk), adding upk to the list. The system then processes the data and returns σ to the user. At this point, the user obtains credentials (σ, usk), and the registration agreement is complete.

[0082] It should be noted that, unless otherwise specified, the terms SP, service provider, and server mentioned in this article have the same meaning.

[0083] Figure 3 This is a flowchart illustrating an authentication method provided in an embodiment of this application. The authentication method can also be referred to as an authentication protocol.

[0084] like Figure 3 As shown, before the authentication protocol begins, the SP's private inputs are ssk and the access control policy circuit C. The user's private inputs are their credentials (σ, usk). At the start of the authentication protocol, the user first sends an "authentication request" to the SP. The SP randomly selects a challenge message m′ and runs a digest. c =LFE.Compress(C;r), and generate a non-interactive zero-knowledge proof π = NIZIAoK{(r):digest c=Compress(C;r)}, then digest c π is sent to the user. The user verifies the validity of the non-interactive zero-knowledge proof value π generated by the server. If valid, the user calculates CT = Enc(digest). c (usk), and generate non-interactive zero-knowledge proofs:

[0085] πNIZKAoK{(upk,usk,σ,r′):1=Sig.Verify(upk,spk,σ),upk=PRF.Eval(usk,x),CT=LFE.Enc(crs,digest c ,usk;r′)}[m′.

[0086] Then CT and π are sent to SP. Next, SP first checks the validity of π, then calculates C(usk) = LFE.Dec(C,CT), and returns the value of C(usk) to the user, completing the authentication protocol.

[0087] Among them, the non-interactive zero-knowledge proof π=NIZIAoK{(r):digest c =Compress(C;r)} is used to prove the digest. c It is a legitimate generation, meaning it is generated through a digest. c Through digest c =LFE.Compress(C; r) algorithm generation. Non-interactive zero-knowledge proof: π = NIZKAoK{(upk,usk,σ,r′): 1 = Sig.Verify(upk,spk,σ),upk = PRF.Eval(usk,x),CT = LFE.Enc(crs,digest c [m'] is generated by the user in response to the challenge message m' sent by the server, used to prove that the user is a legitimate registered user and that the ciphertext is legitimately generated, that is, the ciphertext CT is based on the algorithm CT = LFE.Enc(crs,digest c Generates ,usk;r′), where crs,digest c`usk` is the input to the LFE.Enc algorithm, and `r′` is the random number used in the LFE.Enc algorithm. The server can calculate the user's private key `usk` without obtaining it using the algorithm C(usk) = LFE.Dec(C,CT). Substituting `usk` into the user's access control policy circuit C, the server will determine the value. If the output of control policy circuit C is 1, it indicates that the user is authenticated, and the server allows the user to access the server to obtain services. If the output of control policy circuit C is 1, it indicates that the user is not authenticated, and the server will deny the user's access to the server.

[0088] The authentication method provided in this application utilizes concise function computation, allowing the authenticator (i.e., the server) to formulate arbitrary access control policies and verify whether the user (i.e., the client) meets the conditions without revealing the access control policies, thereby deciding whether to provide services to the user. On the other hand, the user needs to verify their identity using their secret private key, but in the process, they do not need to reveal any private key-related information to the authenticator. In other words, the authentication method provided in this application achieves supervision of anonymous access through the server-side access control policies.

[0089] Meanwhile, the server reduces the size of access control policies and communication complexity by performing digest calculations on the access control policies.

[0090] In another example, an authentication method provided in this application embodiment also includes a tag generated by the user terminal to identify the current authentication process of the user terminal.

[0091] Figure 4 A flowchart illustrating another authentication method provided in this application embodiment. Figure 4 As shown, before the authentication protocol begins, the SP's private inputs are ssk and the access control policy circuit C. The user's private input is their credentials (σ, usk). At the start of the authentication protocol, the user first sends an "authentication request" to the SP. The SP randomly selects a challenge message m′ and runs a digest. c =LFE.Compress(C;r), and generate a non-interactive zero-knowledge proof π = NIZIAoK{(r):digest c =Compress(C;r)}, then digest c π is sent to the user. The user verifies the validity of the non-interactive zero-knowledge proof value π generated by the server. If valid, the user calculates CT = Enc(digest). c (usk), randomly selected Calculate t = PRF.Eval(usk, μ) and generate a non-interactive zero-knowledge proof:

[0092] π=NIZKAoK{(upk,usk,σ,r′):t=PRF.Eval(usk,μ),1=Sig.Verify(upk,spk,σ),upk=PRF.Eval(usk,x),CT=LFE.Enc(crs,digest c ,usk;r′)}[m′]. Then send CT,μ,t,π to SP. Next, SP first checks the validity of π, then calculates C(usk)=LFE.Dec(C,CT), and returns the value of C(usk) to the user, completing the authentication protocol.

[0093] Among them, the non-interactive zero-knowledge proof π=NIZIAoK{(r):digest c =Compress(C;r)} is used to prove the digest. c It is a legitimate generation, meaning it was generated via digest. c =LFE.Compress(C;r) algorithm generation. μ,t represent tags bound to the user identity, used to identify the current authentication process on the user's end. Non-interactive zero-knowledge proof: π = NIZKAoK{(upk,usk,σ,r′):t = PRF.Eval(usk,μ),1 = Sig.Verify(upk,spk,σ),upk = PRF.Eval(usk,x),CT = LFE.Enc(crs,digest c [m'] is generated by the user in response to the challenge message m' sent by the server, used to prove that the user is a legitimate registered user and that the ciphertext is legitimately generated. The tags μ and t are bound to the user's identity, that is, μ and t have the following relationship t=PRF.Eval(usk,μ); the ciphertext CT is based on the algorithm CT=LFE.Enc(crs,digest c Generates ,usk;r′), where crs,digest c `usk` is the input to the LFE.Enc algorithm, and `r′` is the random number used in the LFE.Enc algorithm. The server can calculate the user's private key `usk` without obtaining it using the algorithm C(usk) = LFE.Dec(C,CT). Substituting `usk` into the user's access control policy circuit C, the server will determine the value. If the output of control policy circuit C is 1, it indicates that the user is authenticated, and the server allows the user to access the server to obtain services. If the output of control policy circuit C is 1, it indicates that the user is not authenticated, and the server will deny the user's access to the server.

[0094] What is easy to understand is that digest c=LFE.Compress(C; r) indicates that the LFE.Compress operation requires a random number r, meaning that r is the computation parameter of the algorithm. The LFE.Compress algorithm takes crs and the access control policy circuit C as inputs. crs is generated based on the common reference string generator in concise function computation, using security parameters and the size parameter of the access control policy circuit. In other words, the LFE.CrsGen algorithm takes the security parameters and the size parameter of the access control policy circuit C as inputs and outputs crs. The size parameter of the access control policy circuit C can be understood as the number of gates or the depth of the access control policy circuit. Since the size parameter of the access control policy circuit C and the security parameters are both known, and crs is also known, those skilled in the art typically omit the known parameters in formulas. Therefore, the digest calculation is: digest c =LFE.Compress(crs,C;r), but the usual writing convention is: digest c =LFE.Compress(C;r).

[0095] The authentication method provided in this application incorporates a tag design, allowing the server to select a randomly generated tag for each authentication activity. This tag enables the verifier (i.e., the server) to identify the user's current authentication process. The server then scores the user's current authentication activity based on this tag, and can also combine this score with the user's past authentication activities. If the score falls below a preset threshold, the user's access is blocked; similarly, if the user's N consecutive authentication activities fall below the preset threshold, access is blocked. This prevents situations where a single user authentication attempt evades monitoring, but multiple authentication attempts combine to generate malicious behavior.

[0096] In another example, the label has attribute information, and the access control policy circuit is adjusted based on the label's attribute information. That is, the user assigns different attributes to the label, and the server adds the attribute to the access control policy. For example, if the label has age attribute information (e.g., adult or minor), the server adds the age attribute information to the access control policy, such as prohibiting authentication by users who are 18 years old.

[0097] In another example, the non-interactive zero-knowledge proof system and concise function computation involved in the authentication method provided in this application embodiment are constructed based on the assumption of quantum attack resistance, so as to realize the entire authentication scheme is quantum attack resistant. That is to say, the underlying security components of the supervised anonymous credential system on which the registration method and / or authentication method of this application embodiment are based are all quantum attack resistant underlying components.

[0098] The authentication method provided in this application is based on a manageable anonymous credential system. By selecting different instantiations of the underlying cryptographic components, we can obtain the performance parameters of the corresponding anonymous credential system. The complexity of the manageable anonymous credential system given in this application is:

[0099] The communication complexity is O(d logN)·poly(λ);

[0100] The computational complexity on the user side is O(d logN)·poly(λ);

[0101] The computational complexity of the server is

[0102] The authentication protocol requires 4 rounds of interaction.

[0103] Where N is the size of the access control policy specified by the service provider, d is the circuit depth of the access control policy, λ is the security parameter, and poly is a polynomial function.

[0104] Currently, the best-performing and most manageable anonymous credential systems are mainly constructed in the following sections: blacklist-based anonymous credential systems [BL07, TAKS07, TAKS08] and reputation-based anonymous credential systems [AKS12, AK12]. Table 1 compares the scheme corresponding to the embodiments of this application with previously existing manageable anonymous credential systems. Since a major improvement of the embodiments of this application is that the communication and computational complexity are no longer linearly related to N, for clear comparison, we omit the product of all polynomials related to the circuit depth (denoted as d) and security parameters (denoted as λ) of the access control policy in Table 1.

[0105]

[0106] Table 1. Performance Comparison of this Application with Existing Regulatory Anonymous Credential Systems

[0107] Existing managed anonymous credential systems primarily rely on pseudo-random functions, signature schemes, and zero-knowledge proof systems. Unlike previous methods, this application presents a novel approach to constructing managed anonymous credential systems, resulting in an order-of-magnitude improvement in efficiency. Specifically, this application proposes for the first time the application of LFE functions to construct managed anonymous credential systems, combining them with other cryptographic primitives to provide a provably secure managed anonymous credential system scheme. This new construction method not only improves efficiency but also enhances security, enabling the anonymous credential system to support the hiding of access policies and improving the expressiveness of access policies on the service provider side.

[0108] This application is the first to apply concise function computation to the construction of an anonymous credential system. Furthermore, by employing quantum-resistant and secure underlying components, the method for constructing a manageable anonymous credential system presented in this application achieves the following effects:

[0109] The computational and communication complexity on the client side is only related to the logarithm of the blacklist size. In other words, the computational load on the client side is logarithmically related to the size of the access control policy.

[0110] The authentication method provided in this application has a communication complexity that is logarithmically related to the size of the access control policy. The anonymous credential system given in this application has scalability, that is, it is suitable for large-scale real-world application scenarios.

[0111] It enables service providers to develop arbitrary, highly expressive access policies based on all of a user's historical access behavior.

[0112] It can protect the privacy of service provider access policies.

[0113] The solution presented in this application has post-quantum security.

[0114] This application embodiment also provides a computing device, including at least one processor, a memory, and a communication interface, wherein the processor is used to execute... Figures 2-4 The method described.

[0115] Figure 5 A schematic diagram of the structure of a computing device provided in an embodiment of this application.

[0116] like Figure 5 As shown, the computing device 500 includes at least one processor 501, a memory 502, and a communication interface 503. The processor 501, memory 502, and communication interface 503 are communicatively connected, which can be achieved via a wired (e.g., bus) or wireless connection. The communication interface 503 is used to receive data sent by other devices; the memory 502 stores computer instructions, which the processor 501 executes to perform the authentication method in the aforementioned method embodiments.

[0117] It should be understood that in the embodiments of this application, the processor 501 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0118] The memory 502 may include read-only memory and random access memory, and provides instructions and data to the processor 501. The memory 502 may also include non-volatile random access memory.

[0119] The memory 502 can be volatile memory or non-volatile memory, or it can include both. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0120] It should be understood that the computing device 500 according to the embodiments of this application can execute the implementation of the embodiments of this application. Figures 2-4 The method shown is described in detail above, and will not be repeated here for the sake of brevity.

[0121] This application provides an authentication system, including a server and a user terminal. The server interacts with the user terminal to implement the authentication method provided in this application.

[0122] This application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, causes the method described in the first aspect or the method described in the second aspect to be implemented.

[0123] This application also provides a computer program or computer program product that includes instructions that, when executed, cause a computer to perform the methods mentioned above.

[0124] This application also provides a chip including at least one processor and a communication interface, wherein the processor is used to execute the methods mentioned above.

[0125] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0126] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented in hardware, processor-executed software modules, or a combination of both. The software modules can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art.

[0127] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of this application. It should be understood that the above description is only a specific embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An authentication method, characterized in that, Applied to the server side, including: Receive authentication request information sent by the user client; In response to the authentication request information, a summary of the access control policy circuit is determined, wherein the access control policy circuit represents the access control policy of the server. Based on a non-interactive zero-knowledge proof system, a first non-interactive zero-knowledge proof value is generated to prove that the digest generation is legitimate; Send a first challenge message, the summary, and a first non-interactive zero-knowledge proof value to the user terminal; The system receives a second non-interactive zero-knowledge proof value and ciphertext sent by the user terminal; wherein the second non-interactive zero-knowledge proof value and ciphertext are generated by the user terminal after the first non-interactive zero-knowledge proof value is verified; the second non-interactive zero-knowledge proof value is generated based on the non-interactive zero-knowledge proof system in response to the first challenge message, to prove that the user terminal is a legitimate registration and that the ciphertext is a legitimately generated message; the ciphertext is generated by encrypting the user terminal's private key based on the digest using an encryption algorithm in concise function computation. The second non-interactive zero-knowledge proof value is validated for legality. If the validation passes, the private key of the user terminal is determined as the input of the access control policy circuit based on the ciphertext and the access control policy circuit, and the output value of the access control policy circuit is calculated. Based on the output value of the access control policy circuit, it is determined whether the user terminal has passed authentication.

2. The method according to claim 1, characterized in that, It also includes receiving a tag sent by the user terminal, wherein the second non-interactive zero-knowledge proof value is further used to prove that the tag has been bound to the identity of the user terminal, and the tag is used to identify the current authentication process of the user terminal.

3. The method according to claim 2, characterized in that, The tag includes a first random number and a second random number. The first random number is randomly selected from the key space of the pseudo-random function, and the second random number is determined by the pseudo-random function based on the first random number and the private key of the user terminal.

4. The method according to claim 1, characterized in that, The digest is calculated by the digest function in the concise function calculation based on the common reference string and the access control policy circuit. The calculation parameter of the digest function is a third random number. The common reference string is generated by the common reference string generator in the concise function calculation based on security parameters and the size parameter of the access control policy circuit.

5. The method according to claim 4, characterized in that, The size parameter of the access control policy circuit includes the number of gate circuits in the access control policy circuit.

6. The method according to claim 1, characterized in that, The calculation parameter of the encryption algorithm is the fourth random number.

7. The method according to claim 1, characterized in that, Determining whether the user terminal has passed authentication based on the output value of the access control policy circuit includes: If the output value is 1, it is determined that the user terminal has passed authentication; if the output value is 0, it is determined that the user terminal has failed authentication.

8. The method according to claim 2, characterized in that, Also includes: The current authentication activity of the user terminal is scored based on the tags.

9. The method according to claim 2, characterized in that, Also includes: The tag has attribute information, and the access control policy circuit is adjusted based on the attribute information of the tag.

10. The method according to any one of claims 1-9, characterized in that, The non-interactive zero-knowledge proof system and the concise function computation are constructed based on the assumption of quantum attack resistance.

11. An authentication method, characterized in that, Applied to the user end, including: Send authentication request information to the server; The system receives a first challenge message, a digest, and a first non-interactive zero-knowledge proof value sent by the server. The digest is a digest of the server's access control policy circuit, and the access control policy circuit represents the server's access control policy. The first non-interactive zero-knowledge proof value is generated based on a non-interactive zero-knowledge proof system to prove that the digest was generated legally. The first non-interactive zero-knowledge proof value is validated for legality. If the validation passes, the encryption algorithm in the concise function computation is run to encrypt the private key of the user terminal based on the digest to obtain ciphertext. Based on the non-interactive zero-knowledge proof system, a second non-interactive zero-knowledge proof value is generated for the first challenge message to prove that the user terminal is a legitimate registration and the ciphertext is a legitimate generation. The second non-interactive zero-knowledge proof value and the ciphertext are sent to the server so that the server can verify the validity of the second non-interactive zero-knowledge proof value. If the verification passes, the server determines, based on the ciphertext and the access control policy circuit, whether the user's private key is used as the input of the access control policy circuit and whether the user has passed authentication.

12. The method according to claim 11, characterized in that, It also includes generating a tag bound to the user's identity and sending the tag to the server. The second non-interactive zero-knowledge proof value is also used to prove that the tag has been bound to the user's identity. The tag is used to identify the current authentication process of the user.

13. The method according to claim 12, characterized in that, The tag includes a first random number and a second random number. The first random number is randomly selected from the key space of the pseudo-random function, and the second random number is determined by the pseudo-random function based on the first random number and the private key of the user terminal.

14. The method according to claim 11, characterized in that, The digest is calculated by the digest function in the concise function calculation based on the common reference string and the access control policy circuit. The calculation parameter of the digest function is a second random number. The common reference string is generated by the common reference string generator in the concise function calculation based on security parameters and the size parameter of the access control policy circuit.

15. The method according to claim 14, characterized in that, The size parameter of the access control policy circuit includes the number of gate circuits in the access control policy circuit.

16. The method according to claim 11, characterized in that, The calculation parameter of the encryption algorithm is the fourth random number.

17. The method according to claim 11, characterized in that, Determining whether the user terminal has passed authentication based on the output value of the access control policy circuit includes: If the output value is 1, it is determined that the user terminal has passed authentication; if the output value is 0, it is determined that the user terminal has failed authentication.

18. The method according to claim 12, characterized in that, The tag is also used by the server to score the user's current authentication activity based on the tag.

19. The method according to claim 12, characterized in that, The tag has attribute information, which is used by the server to adjust the access control policy circuit based on the tag's attribute information.

20. The method according to any one of claims 11-19, characterized in that, The non-interactive zero-knowledge proof system and the concise function computation are constructed based on the assumption of quantum attack resistance.

21. An authentication system, characterized in that, It includes a server and a user, wherein the server is used to implement the method as described in any one of claims 1-10, and the user is used to implement the method as described in any one of claims 11-20.

22. A computing device, comprising a memory and a processor, characterized in that, The memory stores instructions that, when executed by a processor, cause the method as described in any one of claims 1-10, or the method as described in any one of claims 11-20, to be implemented.

23. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it causes the method as described in any one of claims 1-10, or the method as described in any one of claims 11-20, to be implemented.

Images