A traceable decentralized digital identity authentication method and system supporting anti-sybil attack

Abstract

This invention proposes a traceable, decentralized digital identity authentication method and system that supports Sybil attack resistance. The method includes a supervisory committee module, a user module, a certificate authority (CA) module, and a blockchain module. The supervisory committee module generates public and private keys. The user module obtains a traceability string, a unique string, and user attribute information of the user to be authenticated, and encrypts the traceability string. The CA module generates a credential based on the user attribute information and the encrypted traceability string. The user module generates a unique identifier, a traceability identifier, a Sybil attack-resistant zero-knowledge proof, and a traceability-guaranteed zero-knowledge proof. The blockchain module verifies the two zero-knowledge proofs. If verification succeeds, decentralized digital identity authentication is performed; if verification fails, decentralized digital identity authentication is not performed and identity authentication fails. This invention ensures user privacy and security, and ensures that the DID cannot be tampered with and is not controlled by a third-party central organization.

Description

Technical Field

[0001] The present invention belongs to the field of blockchain digital identity security, and specifically relates to a traceable decentralized digital identity authentication method and system that supports anti-Sybil attack. Background Art

[0002] Digital identity and its authentication are the cornerstones of digital economic security. Traditional centralized identity authentication systems, due to complex certificate management systems, inherent privacy vulnerabilities, low authentication efficiency, and high risk of cyberattacks, cannot meet the security and efficiency requirements of large-scale applications. To address the shortcomings of traditional centralized identity management and better protect user privacy, the concept of decentralized digital identity (DID) is currently gaining widespread attention in academia and industry. The basic concept of DID is to store user identity information on decentralized servers, thereby preventing a single entity from controlling their data. Based on cryptographic techniques, users can present their trusted credentials to third parties without the need for intermediaries, ensuring their identity remains transparent and protecting their privacy. Compared to traditional identity systems based on public key infrastructure, DID digital identity systems offer advantages such as ensuring data authenticity and trustworthiness and protecting user privacy.

[0003] Existing DID-related research primarily focuses on privacy protection and efficiency, but has yet to adequately address the Know Your Customer (KYC) needs of financial institutions such as banks. This requires identifying malicious users and revoking their credentials while promptly tracing back to the DIDs generated based on those credentials, thereby denying further operations. Furthermore, systems such as anonymous voting need to combat Sybil attacks, ensuring that the voting identity is a real person and that each person can only cast one vote, rather than registering multiple DIDs to cast multiple votes. Therefore, research on how to efficiently trace malicious users and combat Sybil attacks is essential to protect the interests of legitimate users, prevent economic losses from related malicious attacks, and further enhance the practicality of DIDs.

[0004] The present invention proposes a traceable decentralized digital identity authentication method and system that supports anti-Sybil attacks. It can efficiently find all DIDs issued to malicious users while hiding the association between DIDs and credentials and the association between multiple DIDs held by users, so that they can be disabled in time to prevent further losses. At the same time, it can resist Sybil attacks and prevent users from maliciously registering multiple duplicate identities, affecting the fairness of certain activities. In addition, all generated DIDs will be stored on the chain, thereby ensuring high availability and non-tamperability. Summary of the Invention

[0005] To solve the problems in the prior art, the present invention provides a traceable decentralized digital identity authentication method and system that supports anti-Sybil attack.

[0006] The technical solution adopted in the present invention is as follows:

[0007] In a first aspect, the present invention discloses a traceable decentralized digital identity authentication system that supports anti-Sybil attack, including a supervisory committee module, a user module, a CA module, and a blockchain module;

[0008] The supervisory committee module is used to generate public and private keys and broadcast the public key;

[0009] The CA module is used to generate and issue certificates, and input the generated certificates into the user module;

[0010] The user module is used to receive the unique string, user attribute information and traceability string of the user to be authenticated, generate a unique identifier and a traceability identifier, and apply for a certificate from the CA module. The user module is capable of generating a zero-knowledge proof to ensure traceability and a zero-knowledge proof to resist Sybil attacks, and input the unique identifier, traceability identifier and two zero-knowledge proofs into the blockchain module;

[0011] The blockchain module stores an identity information list, a unique identity tree, a traceability identification tree, and a unique identification list. The blockchain module verifies whether the unique identification exists in the unique identification list. If so, the identity authentication fails. If not, the blockchain module verifies the zero-knowledge proof against Sybil attacks. The blockchain module verifies whether the traceability identification exists in the traceability identification tree. If so, the identity authentication fails. If not, the blockchain module verifies the zero-knowledge proof for ensuring traceability. If both zero-knowledge proofs are successfully verified, decentralized digital identity authentication is performed, and the authentication result and the traceability identification are stored in the traceability identification tree, and the unique identification is stored in the unique identification list. Otherwise, decentralized digital identity authentication is not performed and the identity authentication fails.

[0012] Furthermore, the user attribute information includes a user ID number and a user name; a unique identity is stored in the identity information list, and the unique identity is stored in the identity information list in the form of a key-value pair, wherein the key-value pair is a key-value pair with the user ID number as the key and the unique identity as the key value, and the identity information list is empty at the initial moment; the unique identity tree is a Merkle tree structure, and the unique identity tree is composed of unique identities, and the unique identity tree is empty at the initial moment; the traceability identification tree is a Merkle tree structure, and the traceability identification tree is composed of a key-value pair with the traceability identification as the key and the decentralized digital identity as the key value, and the traceability identification tree is empty at the initial moment; the unique identification list is composed of a unique identification, and the unique identification list is empty at the initial moment.

[0013] Furthermore, the user module generates a zero-knowledge proof to ensure traceability, including:

[0014] The user module obtains the trace identifier trace_str based on the trace string trace_key, and inputs the trace identifier trace_str into the blockchain module. The trace identifier trace_str is:

[0015] trace_str=hash(trace_key,counter+1)

[0016] Where hash(*) is a hash function; counter is the number of times the credential corresponding to the traceability string yrace_key is used to apply for a decentralized digital identity. The initial counter is 0.

[0017] The user module generates a zero-knowledge proof to ensure traceability based on four equations:

[0018] trace_str=hash(trace_key,counter+1)

[0019] encrypted_trace_key=encryption(PK c ,trace_key)

[0020] prev_trace_str=hash(trace_key,counter)

[0021] trace_str_tree.exist(prev_trace_str)=1

[0022] Among them, encryption(*) is an encryption function based on elliptic curve; PK c is the public key; prev_trace_str is the trace string corresponding to the certificate of trace_key, which is the counter-time trace identification of the decentralized digital identity; trace_str_tree is the trace identification tree; trace_str_tree.exist(v) is used to determine whether v exists in trace_str_tree, and trace_str_tree.exist(v) = 1 indicates that it exists;

[0023] Among them, when the counter is 0, only the traceability-guaranteed zero-knowledge proof is generated based on the first two equations.

[0024] Furthermore, the user module generates a Sybil-resistant zero-knowledge proof, including:

[0025] The user module obtains the unique identifier unique_str based on the unique string unique_key and inputs the unique identifier unique_str into the blockchain module. The unique identifier unique_str is:

[0026] unique_str=hash(unique_key,context)

[0027] Among them, context represents the purpose of the decentralized digital identity finally obtained;

[0028] The user module generates a Sybil-resistant zero-knowledge proof based on three equations:

[0029] unique_str=hash(unique_key,context)

[0030] encrypted_unique_key=encryption(PK c ,unique_key)

[0031] unique_id_tree.exist(encrypted_unique_key)=1

[0032] Here, unique_id_tree is a unique identity tree, unique_id_tree.exist(v) is used to determine whether v exists in unique_id_tree, and unique_id_tree.exist(encrypted_unique_key)=1 indicates existence.

[0033] In a second aspect, the present invention discloses a traceable decentralized digital identity authentication method implemented using the system, comprising the following steps:

[0034] 1) The Supervisory Committee module generates public and private keys based on a distributed key generation protocol;

[0035] 2) The user module obtains the unique string of the user to be authenticated and the user attribute information of the user, obtains the unique identity based on the unique string, and then inputs the unique identity and user attribute information into the blockchain module; the blockchain module checks whether the user attribute information exists in the identity information list. If so, the identity authentication fails; if not, the unique identity is stored in the identity information list and the unique identity is stored in the unique identity tree;

[0036] 3) The user module obtains the traceability string of the user to be authenticated and encrypts the traceability string. The user module inputs the user attribute information and the encrypted traceability string into the CA module. The CA module generates a certificate and outputs it to the user module.

[0037] 4) The user module obtains a unique identifier and a Sybil-resistant zero-knowledge proof based on the unique string. The user module obtains a traceability identifier and a zero-knowledge proof of traceability based on the traceability string, and inputs the two zero-knowledge proofs, the unique identifier, and the traceability identifier into the blockchain module.

[0038] 5) The blockchain module checks whether the unique identifier exists in the unique identifier list. If so, the identity authentication fails. If not, the blockchain module verifies whether the received anti-Sybil attack zero-knowledge proof can satisfy the three equations for generating the anti-Sybil attack zero-knowledge proof based on the public key, unique identifier, unique identity tree, and unique identifier list. If all the equations are satisfied, the verification succeeds. Otherwise, the verification fails, and the identity authentication fails.

[0039] The blockchain module checks whether the traceability identifier exists in the traceability identifier tree. If so, the identity authentication fails. If not, the blockchain module verifies whether the received zero-knowledge proof of traceability can satisfy the four equations for generating the zero-knowledge proof of traceability based on the traceability identifier, public key, and traceability identifier tree. If all the equations are satisfied, the verification succeeds. Otherwise, the verification fails, and the identity authentication fails.

[0040] If both zero-knowledge proofs are successfully verified, decentralized digital identity authentication is performed, and the result and the traceability identifier are stored in the traceability identifier tree, and the unique identifier is stored in the unique identifier list; otherwise, decentralized digital identity authentication is not performed and the identity authentication fails.

[0041] Compared with the prior art, the beneficial effects and innovations of the present invention are mainly reflected in the following three aspects:

[0042] (1) The present invention proposes a traceable decentralized digital identity authentication method. Based on threshold cryptography, it can reduce the risk of legitimate user privacy being leaked by malicious organizations. At least t members are required to decrypt the user's information, thereby ensuring that the user's privacy will not be leaked by a small number of malicious members. It can also hide the association information between the credential and the DID, as well as between multiple DIDs held by the same user. At the same time, for revoked credentials, all DIDs generated based on the credential can be traced back and revoked in a timely manner to prevent further damage. In addition, the verification process is based on zero-knowledge proof, which further guarantees the privacy security of users.

[0043] (2) The present invention proposes a digital identity authentication method that is resistant to Sybil attacks, which can ensure that the DID generated for each credential for each purpose is unique, while ensuring that the user's identity is not leaked.

[0044] (3) The relevant DID and credential information in the present invention are all stored on the blockchain. On the one hand, the high availability based on the blockchain ensures that the system will not be affected by single point failures. On the other hand, the blockchain also supports immutability and is not controlled by a third-party central agency. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a flowchart of the traceable decentralized digital identity authentication method that supports anti-Sybil attacks of the present invention;

[0046] Figure 2 This is the architecture diagram of the traceable decentralized digital identity authentication system that supports anti-Sybil attacks of the present invention;

[0047] Figure 3 Schematic diagram of the traceability proof generation and verification algorithm of the present invention;

[0048] Figure 4 Schematic diagram of the anti-Sybil attack proof generation and verification algorithm of the present invention;

[0049] Figure 5 This is a schematic diagram of the DID tracing process generated based on revoked credential authentication in the present invention. DETAILED DESCRIPTION

[0050] The present invention will be further described and illustrated below in conjunction with specific embodiments. The embodiments are merely illustrative of the present disclosure and do not limit its scope. The technical features of the various embodiments of the present invention may be combined accordingly, provided that there is no conflict between them.

[0051] In response to the problems existing in current decentralized digital identity management, such as the inability to efficiently revoke digital identities held by malicious users and the lack of support for anti-Sybil attacks, the present invention proposes a traceable decentralized digital identity authentication method and system that supports anti-Sybil attacks. Through threshold cryptography and zero-knowledge proof schemes, the association between normal user digital identities and corresponding credentials is hidden, while the uniqueness of the issued identity is detected based on the unique identifier to achieve anti-Sybil attack resistance. Threshold decryption is used to trace all DIDs generated by revoked credentials, thereby achieving efficient tracing of anonymous digital identities.

[0052] The main structure of the present invention is as follows Figure 2 As shown in the figure, it mainly consists of four main components: the supervisory committee module, the CA module, the user module, and the blockchain module. The interaction between these components is shown in the figure. Figure 2 shown.

[0053] The present invention's traceable decentralized digital identity authentication system supporting anti-sybil attacks includes a regulatory committee module, a user module, a CA module, and a blockchain module;

[0054] The supervisory committee module is used to generate a public key and a private key and broadcast the public key; wherein the supervisory committee module generates the public key and the private key based on a distributed key generation protocol;

[0055] The CA module is used to generate and issue a certificate, and issue the generated certificate to the user module (i.e., input the generated certificate into the user module);

[0056] The user module is used to receive the unique string, user attribute information and traceability string of the user to be authenticated, generate a unique identifier and a traceability identifier, and apply for a certificate from the CA module. The user module is capable of generating a zero-knowledge proof to ensure traceability and a zero-knowledge proof to resist Sybil attacks, and input the unique identifier, traceability identifier and two zero-knowledge proofs into the blockchain module;

[0057] The blockchain module stores an identity information list, a unique identity tree, a traceability identification tree, and a unique identification list. The blockchain module verifies whether the unique identification exists in the unique identification list. If so, the identity authentication fails. If not, the blockchain module verifies the zero-knowledge proof against Sybil attacks. The blockchain module verifies whether the traceability identification exists in the traceability identification tree. If so, the identity authentication fails. If not, the blockchain module verifies the zero-knowledge proof for ensuring traceability. If both zero-knowledge proofs are successfully verified, decentralized digital identity authentication is performed, and the authentication result and the traceability identification are stored in the traceability identification tree, and the unique identification is stored in the unique identification list. Otherwise, decentralized digital identity authentication is not performed and the identity authentication fails.

[0058] Among them, the user attribute information includes the user ID number and the user name; the identity information list stores a unique identity, and the unique identity is stored in the identity information list in the form of a key-value pair, which is a key-value pair with the user ID number as the key and the unique identity as the key value. The identity information list is empty at the initial moment; the unique identity tree is a Merkle tree structure, and the unique identity tree is composed of a unique identity tree. The unique identity tree at the initial moment is empty; the traceability identification tree is a Merkle tree structure, and the traceability identification tree is composed of a key-value pair with the traceability identification as the key and the decentralized digital identity as the key value. The traceability identification tree at the initial moment is empty; the unique identification list is composed of a unique identification, and the unique identification list at the initial moment is empty.

[0059] The supervisory committee module includes n supervisory committee members, who generate public keys PK based on the distributed key generation protocol (DKG)c and private key sk c , where PK c is public, and sk c Each member holds a portion of the secret share of the private key based on secret sharing. Specifically, each member jointly generates a private key based on the Verifiable Secret Sharing (VSS) method without obtaining the private key itself. After completion, each member has the same public key PK c , and each member's unique private key secret share; for c Encrypted information requires the cooperation of at least t (t≤n) members to complete decryption. Even if any t-1 participants conspire, they cannot decrypt the information. Therefore, the scheme has strong anti-attack capabilities. The supervisory committee module is also responsible for tracing and revoking DIDs held by malicious users.

[0060] Before the user module applies for a certificate from the CA module, the user module obtains a unique identity encrypted_unique_key based on the unique string unique_key. The unique identity encrypted_unique_key is:

[0061] encrypted_unique_key=encryption(PK c ,unique_key)

[0062] Among them, encryption(*) is an encryption function based on elliptic curve; PK c is the public key;

[0063] The user module inputs the unique identity and user attribute information into the blockchain module; the blockchain module checks whether the user attribute information exists in the identity information list. If so, identity authentication is no longer performed and identity authentication fails; if not, the unique identity is stored in the identity information list and the unique identity is stored in the unique identity tree, and identity authentication continues.

[0064] The Certificate Authority (CA) module is used to issue credentials, which serve as proof of the user's relevant permissions. The user module encrypts the traceability string using the elliptic curve encryption algorithm based on the public key, and inputs the user attribute information and the encrypted traceability string into the CA module. The CA module generates a credential, that is, the CA module packages the user attribute information and the encrypted traceability string encrypted_trace_key together into a complete credential; the CA module outputs the generated credential to the user module; the credential includes the user attribute information and the encrypted traceability string.

[0065] In a specific embodiment of the present invention, the user module generates a zero-knowledge proof to ensure traceability, including:

[0066] The user module obtains the trace identifier trace_str based on the trace string trace_key, and inputs the trace identifier trace_str into the blockchain module. The trace identifier trace_str is:

[0067] trace_str=hash(trace_key,counter+1)

[0068] Where hash(*) is a hash function; counter is the number of times the certificate corresponding to the trace string trace_key is used to apply for a decentralized digital identity. The initial counter is 0.

[0069] The user module generates a zero-knowledge proof to ensure traceability based on four equations:

[0070] trace_str=hash(trace_key,counter+1)

[0071] encrypted_trace_key=encryption(PK c ,trace_key)

[0072] prev_trace_str=hash(trace_key,counter)

[0073] trace_str_tree.exist(prev_trace_str)=1

[0074] Among them, encryption(*) is an encryption function based on elliptic curve; PK c is the public key; prev_trace_str is the trace string corresponding to the certificate of trace_key, which is the counter-time trace identification of the decentralized digital identity; trace_str_tree is the trace identification tree; trace_str_tree.exist(v) is used to determine whether v exists in trace_str_tree, trace_str_tree.exist(v) = 1 indicates that it exists; otherwise, it does not exist;

[0075] Among them, when the counter is 0, only the traceability-guaranteed zero-knowledge proof is generated based on the first two equations.

[0076] The user module generates Sybil-resistant zero-knowledge proofs, including:

[0077] The user module obtains the unique identifier unique_str based on the unique string unique_key and inputs the unique identifier unique_str into the blockchain module. The unique identifier unique_str is:

[0078] unique_str=hash(unique_key,context)

[0079] Among them, context represents the purpose of the decentralized digital identity finally obtained;

[0080] The user module generates a Sybil-resistant zero-knowledge proof based on three equations:

[0081] unique_str=hash(unique_key,context)

[0082] encrypted_unique_key=encryption(PK c ,unique_key)

[0083] unique_id_tree.exist(encrypted_unique_key)=1

[0084] Here, unique_id_tree is a unique identity tree, unique_id_tree.exist(v) is used to determine whether v exists in unique_id_tree, and unique_id_tree.exist(encrypted_unique_key)=1 indicates existence; otherwise, it does not exist.

[0085] The blockchain module verifies two zero-knowledge proofs, including:

[0086] The blockchain module checks whether the unique identifier exists in the unique identifier list. If so, the identity authentication fails. If not, the blockchain module verifies whether the received anti-Sybil attack zero-knowledge proof can satisfy the three equations for generating the anti-Sybil attack zero-knowledge proof based on the public key, unique identifier, unique identity tree, and unique identifier list. If all the equations are satisfied, the verification succeeds. Otherwise, the verification fails, and the identity authentication fails.

[0087] The blockchain module searches for the traceability identifier in the traceability identifier tree. If so, the identity authentication fails. If not, the blockchain module verifies whether the received zero-knowledge proof of traceability can satisfy the four equations for generating the zero-knowledge proof of traceability based on the traceability identifier, public key, and traceability identifier tree. If all the equations are satisfied, the verification succeeds. Otherwise, the verification fails, and the identity authentication fails.

[0088] If both zero-knowledge proofs are successfully verified, decentralized digital identity authentication is performed, and the result and the traceability identifier are stored in the traceability identifier tree, and the unique identifier is stored in the unique identifier list; otherwise, decentralized digital identity authentication is not performed and the identity authentication fails.

[0089] like Figure 5 As shown in Figure 1, the Supervisory Committee module can trace and revoke DIDs held by malicious users (i.e., the identity authentication system can be used to trace the decentralized digital identity corresponding to the revoked certificate and revoke the decentralized digital identity), specifically:

[0090] After the CA revokes the malicious user's credentials, all DIDs generated based on the credentials need to be revoked in a timely manner.

[0091] The Supervisory Committee module first determines the revoked certificate and obtains the encrypted trace string in the certificate. Then, more than t members of the Supervisory Committee jointly decrypt the trace string corresponding to the certificate based on the threshold decryption method (the Supervisory Committee module decrypts the encrypted trace string based on the private key to obtain the trace string).

[0092] The supervisory committee module obtains a series of trace identifiers trace_str(i) based on the obtained trace string.

[0093] trace_str(i)=hash(trace_key,i)

[0094] Where i = 0, 1…;

[0095] The Supervisory Committee module searches for the corresponding decentralized digital identity in the traceability identification tree of the blockchain module based on the obtained trace_str(i), and deletes the found decentralized digital identity;

[0096] Specifically: initialize i = 0, then calculate trace_str(0) = hash(trace_key, 0), then check whether trace_str(0) exists in did_list. If so, revoke the DID corresponding to trace_str(0), and add i+1. Then repeat the above calculation, search, and revocation operations until trace_str(i) no longer exists in did_list. At this time, it means that the tracing operation is complete, that is, all DIDs generated by the revoked credentials have been traced.

[0097] Compared with existing methods, the scheme based on threshold cryptography has a feasible mechanism to resist Sybil attacks. On the premise of hiding the association between credentials and DID, it realizes the efficient tracing of DIDs generated based on revoked credentials, and has a strong privacy protection effect for legitimate users.

[0098] Specifically, the traceability zero-knowledge proof generation and verification process of the present invention is as follows: Figure 3 As shown; First, for the user module, its main function is to generate trace_str and the corresponding zero-knowledge proof π t Specifically, the user module generates zero-knowledge proof π based on the zkSNARK protocol t , where zkSNARK is a non-interactive zero-knowledge proof protocol. Based on this, the user module proves that the DID corresponding to prev_trace_str = hash(trace_key, counter) has been issued, that is, the identifier already exists in the trace_str_tree, but trace_str has not yet been registered. At the same time, the user module generates trace_str = hash(trace_key, counter+1) based on trace_key and the counter indicating the number of times the credential has been used to apply for a DID.

[0099] Next, input the public input and private input into the zkSNARK, where public input represents the public input, i.e. the parameters known by both the user module and the blockchain module, including: trace_str, trace_str_tree, PK c , and private input represents the private input, that is, the privacy information you want to protect, including: trace_key, counter, encrypted_trace_key. zkSNARK verifies whether the following equation is true. If successful, it generates proof π t ;

[0100] trace_str=hash(trace_key,counter+1)

[0101] encrypted_trace_key=encryption(PK c ,trace_key)

[0102] prev_trace_str=hash(trace_key,counter)

[0103] trace_str_tree.exist(prev_trace_str)=1

[0104] Then, the blockchain module first checks whether trace_str exists in trace_str_tree. If so, the verification fails. If not, it then verifies π based on zkSNARK. t Is it true? If the verification passes, it means the equation is true, traceability is met, and the verification is successful; if the verification fails, it directly returns failure;

[0105] Specifically, the anti-sybil attack zero-knowledge proof generation and verification process of the present invention is as follows: Figure 4 As shown; First, for the user module, its main function is to generate unique_str and the corresponding zero-knowledge proof π s Specifically, the user module generates zero-knowledge proof π based on the zkSNARK protocol s ;

[0106] Next, the public input and private input are input into the zkSNARK, where the public input parameters include: PK c , unique_str, unique_id_tree, context, and the private input parameters include: unique_key. zkSNARK verifies whether the following equation is true. If successful, it generates proof π s ;

[0107] unique_str=hash(unique_key,context)

[0108] encrypted_unique_key=encryption(PK c ,unique_key)

[0109] unique_id_tree.exist(encrypted_unique_key)=1

[0110] Then, the blockchain module first checks whether unique_str exists in unique_str_list. If so, the verification fails. If not, it then verifies π based on zkSNARK. s Is it true? If the verification passes, it means the equation is true, traceability is met, and the verification is successful; if the verification fails, it returns failure directly.

[0111] like Figure 1 As shown, it is a schematic flow chart of the traceable decentralized digital identity authentication method that supports anti-Sybil attack of the present invention.

[0112] This embodiment also provides a traceable decentralized digital identity authentication method that supports anti-Sybil attacks, including the following steps:

[0113] 1) The Supervisory Committee module generates public and private keys based on a distributed key generation protocol;

[0114] 2) The user module obtains the unique string of the user to be authenticated and the user attribute information of the user, obtains the unique identity based on the unique string, and then inputs the unique identity and user attribute information into the blockchain module; the blockchain module checks whether the user attribute information exists in the identity information list. If so, the identity authentication fails; if not, the unique identity is stored in the identity information list and the unique identity is stored in the unique identity tree;

[0115] 3) The user module obtains the traceability string of the user to be authenticated and encrypts the traceability string. The user module inputs the user attribute information and the encrypted traceability string into the CA module. The CA module generates a certificate and outputs it to the user module.

[0116] 4) The user module obtains a unique identifier and a Sybil-resistant zero-knowledge proof based on the unique string. The user module obtains a traceability identifier and a zero-knowledge proof of traceability based on the traceability string, and inputs the two zero-knowledge proofs, the unique identifier, and the traceability identifier into the blockchain module.

[0117] 5) The blockchain module checks whether the unique identifier exists in the unique identifier list. If so, the identity authentication fails. If not, the blockchain module verifies whether the received anti-Sybil attack zero-knowledge proof can satisfy the three equations for generating the anti-Sybil attack zero-knowledge proof based on the public key, unique identifier, unique identity tree, and unique identifier list. If all the equations are satisfied, the verification succeeds. Otherwise, the verification fails, and the identity authentication fails.

[0118] The blockchain module checks whether the traceability identifier exists in the traceability identifier tree. If so, the identity authentication fails. If not, the blockchain module verifies whether the received zero-knowledge proof of traceability can satisfy the four equations for generating the zero-knowledge proof of traceability based on the traceability identifier, public key, and traceability identifier tree. If all the equations are satisfied, the verification succeeds. Otherwise, the verification fails, and the identity authentication fails.

[0119] If both zero-knowledge proofs are successfully verified, decentralized digital identity authentication is performed, and the result and the traceability identifier are stored in the traceability identifier tree, and the unique identifier is stored in the unique identifier list; otherwise, decentralized digital identity authentication is not performed and the identity authentication fails.

[0120] The above-described embodiments merely illustrate several implementations of the present invention, and while the descriptions are relatively specific and detailed, they are not to be construed as limiting the scope of the present invention. Persons skilled in the art will readily appreciate that variations and modifications may be made without departing from the spirit of the present invention, and all such variations and modifications fall within the scope of protection of the present invention.

Claims

1. A traceable decentralized digital identity authentication system that supports anti-sybil attacks, characterized by: Including regulatory committee module, user module, CA module and blockchain module; The supervisory committee module is used to generate public and private keys and broadcast the public key; The CA module is used to generate and issue certificates, and input the generated certificates into the user module; The user module is configured to receive a unique string, user attribute information, and a traceability string of a user to be authenticated, and apply for a credential from the CA module. The user module encrypts the traceability string based on a public key, and inputs the user attribute information and the encrypted traceability string into the CA module, so that the CA module generates a credential; the credential includes the user attribute information and the encrypted traceability string; the user module obtains a unique identifier and a Sybil-resistant zero-knowledge proof based on the unique string, obtains a traceability identifier and a zero-knowledge proof of traceability based on the traceability string, and inputs the unique identifier, traceability identifier, and two zero-knowledge proofs into the blockchain module; The blockchain module stores an identity information list, a unique identity tree, a traceability identification tree, and a unique identification list. The blockchain module verifies whether the unique identification exists in the unique identification list. If so, the identity authentication fails. If not, the blockchain module verifies the zero-knowledge proof against Sybil attacks. The blockchain module verifies whether the traceability identification exists in the traceability identification tree. If so, the identity authentication fails. If not, the blockchain module verifies the zero-knowledge proof for ensuring traceability. If both zero-knowledge proofs are successfully verified, decentralized digital identity authentication is performed, and the authentication result and the traceability identification are stored in the traceability identification tree, and the unique identification is stored in the unique identification list. Otherwise, decentralized digital identity authentication is not performed and the identity authentication fails.

2. The system according to claim 1, wherein: The supervisory committee module generates public keys and private keys based on a distributed key generation protocol.

3. The system according to claim 2, characterized in that The user attribute information includes the user ID number and the user name; the identity information list stores a unique identity, which is stored in the identity information list in the form of a key-value pair, wherein the key-value pair is a key-value pair with the user ID number as the key and the unique identity as the key value, and the identity information list is empty at the initial moment; the unique identity tree is a Merkle tree structure, the unique identity tree is composed of unique identities, and the unique identity tree is empty at the initial moment; the traceability identification tree is a Merkle tree structure, the traceability identification tree is composed of a key-value pair with the traceability identification as the key and the decentralized digital identity as the key value, and the traceability identification tree is empty at the initial moment; the unique identification list is composed of unique identifications, and the unique identification list is empty at the initial moment.

4. The system according to claim 3, characterized in that Before the user module applies for a certificate from the CA module, the user module obtains a unique identity encrypted_unique_key based on the unique string unique_key. The unique identity encrypted_unique_key is: encrypted_unique_key=encryption(PK c ,unique_key) Among them, encryption(*) is an encryption function based on elliptic curve; PK c is the public key; The user module inputs the unique identity and user attribute information into the blockchain module; the blockchain module checks whether the user attribute information exists in the identity information list. If so, identity authentication is no longer performed and identity authentication fails; if not, the unique identity is stored in the identity information list and the unique identity is stored in the unique identity tree, and identity authentication continues.

5. The system according to claim 4, characterized in that The user module obtains a traceability identifier based on the traceability string and ensures zero-knowledge proof of traceability, including: The user module obtains the trace identifier trace_str based on the trace string trace_key, and inputs the trace identifier trace_str into the blockchain module. The trace identifier trace_str is: trace_str=hash(trace_key,counter+1) Where hash(*) is a hash function; counter is the number of times the certificate corresponding to the trace string trace_key is used to apply for a decentralized digital identity. The initial counter is 0. The user module generates a zero-knowledge proof to ensure traceability based on four equations: trace_str=hash(trace_key,counter+1) encrypted_trace_key=encryption(PK c ,trace_key) prev_trace_str=hash(trace_key,counter) trace_str_tree.exist(prev_trace_str)=1 Among them, encryption(*) is an encryption function based on elliptic curve; PK c is the public key; prec_trace_str is the trace string corresponding to the certificate of trace_key, which is the counter-th generation of the decentralized digital identity traceability identification; trace_str_tree is the traceability identification tree; trace_str_tree.exist(v) is used to determine whether v exists in trace_str_tree, and trace_str_tree.exist(v) = 1 indicates that it exists; Among them, when the counter is 0, only the traceability-guaranteed zero-knowledge proof is generated based on the first two equations.

6. The system according to claim 5, characterized in that The user module obtains a unique identifier and a Sybil-resistant zero-knowledge proof based on a unique string, including: The user module obtains the unique identifier unique_str based on the unique string unique_key and inputs the unique identifier unique_str into the blockchain module. The unique identifier unique_str is: unique_str=hash(unique_key,context) Among them, context represents the purpose of the decentralized digital identity finally obtained; The user module generates a Sybil-resistant zero-knowledge proof based on three equations: unique_str=hash(unique_key,context) encrypted_unique_key=encryption(PK c ,unique_key) unique_id_tree.exist(encrypted_unique_key)=1 Here, unique_id_tree is a unique identity tree, unique_id_tree.exist(v) is used to determine whether v exists in unique_id_tree, and unique_id_tree.exist(encrypted_unique_key)=1 indicates existence.

7. The system according to claim 5, characterized in that The system can be used to trace back the decentralized digital identity corresponding to the revoked certificate and revoke the decentralized digital identity; tracing and revoking the decentralized digital identity includes the following steps: The supervisory committee module determines the revoked certificate and obtains the encrypted traceability string in the certificate. The supervisory committee module decrypts the encrypted traceability string based on the private key to obtain the traceability string. The supervisory committee module obtains multiple traceability identifiers trace_str(i) based on the obtained traceability string. trace_str(i)=hash(trace_key,i) Where i = 0, 1…; The supervisory committee module searches for the corresponding decentralized digital identity in the traceability identification tree of the blockchain module based on the obtained trace_str(i), and deletes the found decentralized digital identity.

8. The system according to claim 6, wherein: The blockchain module verifies two zero-knowledge proofs, including: The blockchain module checks whether the unique identifier exists in the unique identifier list. If so, the identity authentication fails. If not, the blockchain module verifies whether the received anti-Sybil attack zero-knowledge proof can satisfy the three equations for generating the anti-Sybil attack zero-knowledge proof based on the public key, unique identifier, unique identity tree, and unique identifier list. If all the equations are satisfied, the verification succeeds. Otherwise, the verification fails, and the identity authentication fails. The blockchain module searches for the traceability identifier in the traceability identifier tree. If so, the identity authentication fails. If not, the blockchain module verifies whether the received zero-knowledge proof of traceability can satisfy the four equations for generating the zero-knowledge proof of traceability based on the traceability identifier, public key, and traceability identifier tree. If all the equations are satisfied, the verification succeeds. Otherwise, the verification fails, and the identity authentication fails. If both zero-knowledge proofs are successfully verified, decentralized digital identity authentication is performed, and the result and the traceability identifier are stored in the traceability identifier tree, and the unique identifier is stored in the unique identifier list; otherwise, decentralized digital identity authentication is not performed and the identity authentication fails.

9. A traceable decentralized digital identity authentication method implemented using the system of claim 8, characterized in that: The following steps are involved: 1) The Supervisory Committee module generates public and private keys based on a distributed key generation protocol; 2) The user module obtains the unique string of the user to be authenticated and the user attribute information of the user, obtains the unique identity based on the unique string, and then inputs the unique identity and user attribute information into the blockchain module; The blockchain module checks whether the user attribute information exists in the identity information list. If so, the identity authentication fails; If it does not exist, the unique identity is stored in the identity information list and the unique identity is stored in the unique identity tree; 3) The user module obtains the traceability string of the user to be authenticated and encrypts the traceability string. The user module inputs the user attribute information and the encrypted traceability string into the CA module. The CA module generates a certificate and outputs it to the user module. 4) The user module obtains a unique identifier and a Sybil-resistant zero-knowledge proof based on the unique string. The user module obtains a traceability identifier and a zero-knowledge proof of traceability based on the traceability string, and inputs the two zero-knowledge proofs, the unique identifier, and the traceability identifier into the blockchain module. 5) The blockchain module checks whether the unique identifier exists in the unique identifier list. If so, the identity authentication fails. If not, the blockchain module verifies whether the received anti-Sybil attack zero-knowledge proof can satisfy the three equations for generating the anti-Sybil attack zero-knowledge proof based on the public key, unique identifier, unique identity tree, and unique identifier list. If all the equations are satisfied, the verification succeeds. Otherwise, the verification fails, and the identity authentication fails. The blockchain module checks whether the traceability identifier exists in the traceability identifier tree. If so, the identity authentication fails; If it does not exist, the blockchain module verifies whether the received zero-knowledge proof of traceability can satisfy the four equations for generating the zero-knowledge proof of traceability based on the traceability identifier, public key, and traceability identifier tree. If all the equations are satisfied, the verification succeeds. Otherwise, the verification fails, and the identity authentication fails. If both zero-knowledge proofs are successfully verified, decentralized digital identity authentication is performed, and the result and the traceability identifier are stored in the traceability identifier tree, and the unique identifier is stored in the unique identifier list; Otherwise, decentralized digital identity authentication will not be performed and the identity authentication will fail.

Images