Privacy-enhanced digital identity attribute selective disclosure and verification method

Abstract

The invention discloses a privacy-enhanced digital identity attribute selective disclosure and verification method, which is characterized in that a user does not need to provide hash values of all privacy information plaintexts when selectively disclosing privacy information, and the hash values of all the privacy information plaintexts are not required to be provided except the privacy information expected to be disclosed. And the other parts are multiple hash transformations of which the hash values disclosed for verifying the legality of the identity attribute information are all plaintext privacy information. Identity attribute hash is used as a leaf node of a Merkel tree to construct the Merkel tree, root hash is generated, a credential issuing party only signs the Merkel root hash, and a verification party only needs to verify the signature to prove the authenticity and integrity of the identity attribute. Salt value nodes are added in a Merkel tree, identity attributes and hash values thereof are hidden, the difficulty of brute force cracking and rainbow table attacks is increased, and identity information leakage is avoided. When the Merkel tree is constructed, brother nodes are added for leaf nodes of each identity attribute, when the identity attributes are selectively disclosed, other identity attributes can be effectively hidden, and leakage of identity information is avoided.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a method for selectively disclosing and verifying digital identity attributes with enhanced privacy. Background Art

[0002] With the development of information technology such as the Internet, more and more offline businesses are entering the online digital space. There are a large number of identity authentication scenarios in online businesses, such as payment, hotel reservations, ticket bookings, etc., which lead to the abuse of user identity information and serious privacy leakage. Therefore, the digital space needs a secure identity credential that can not only autonomously and selectively disclose the identity information required for business processing, but also prove that the disclosed identity information is credible, and can effectively hide other personal privacy information.

[0003] Existing selective disclosure schemes all require providing a hash value of part of the plaintext identity or identity information variants. Due to the existence of user identity attributes:

[0004] 1) Identity attributes with less information (such as gender only male or female)

[0005] 2) Statistically regular identity attributes (surname, province of birth)

[0006] If a large amount of selectively disclosed data is obtained by illegal individuals or organizations, they may be able to obtain identity attribute information through these rules without cracking the hash algorithm.

[0007] In addition, the existing partial selective disclosure scheme requires a separate signature for all identity attributes. When the number of identity attributes in the digital identity is large, the scheme needs to consume more resources when issuing the certificate. In addition, the digital certificate contains many data items and the certificate is large. This scheme only needs to sign the Merkle hash tree root of the identity information once. Summary of the invention

[0008] In view of the deficiencies of the prior art, the present invention aims to provide a privacy-enhanced digital identity attribute selective disclosure and verification method.

[0009] In order to achieve the above object, the present invention adopts the following technical solution:

[0010] A privacy-enhanced digital identity attribute selective disclosure and verification method, comprising the following steps:

[0011] Step 1: Initialization:

[0012] (1.1) The user sends personal identity information to a trusted third party. The personal identity information contains multiple identity attributes;

[0013] (1.2) A trusted third party generates a public-private key pair, with the public key being Pub andy, the private key is pri andy ;

[0014] (1.3) A trusted third party generates a random number seed rootNonce to generate a salt value corresponding to each identity attribute of the user's personal identity information;

[0015] (1.4) A trusted third party defines a salt generation algorithm SGA;

[0016] (1.5) The user obtains rootNonce and SGA from a trusted third party;

[0017] (1.6) The verifier obtains Pub from a trusted third party andy ;

[0018] Step 2: The trusted third party builds the Merkle tree, generates the Merkle root and sends it down:

[0019] (2.1) A trusted third party calculates the salt value:

[0020] Each identity attribute of the user's personal identity information corresponds to a salt value, and the salt value Salt is derived from the rootNonce and the user's identity attribute under the SGA algorithm;

[0021] (2.2) The trusted third party constructs a Merkle tree based on each identity attribute of the user's personal identity information and the corresponding salt value:

[0022] 2.2.1. Calculate the hash value of the leaf node: Calculate the hash value of each identity attribute of the user's personal identity information and the hash value of the salt value corresponding to each identity attribute as each leaf node, and the leaf node corresponding to each identity attribute and its corresponding salt value is a brother node;

[0023] 2.2.2. Recursively calculate the hash value of the parent node: starting from the leaf node, traverse the nodes of this layer and calculate the parent nodes of the upper layer in turn; the parent node is created by concatenating the hash values ​​of its child nodes;

[0024] 2.2.3. Until there is only one node at the top of the Merkle tree, which is the root node, calculate the hash value of the root node to get the MerkleRoot;

[0025] (2.3) The trusted third party uses its own private key Pri andy Sign the MerkleRoot to generate the signature value S(Pri andy ,MerkleRoot), and then MerkleRoot MerkleRoot and its signature value S(Pri andy ,MerkleRoot) is sent to the user;

[0026] Step 3: The user selects the identity attributes to be disclosed, calculates the Merkle path and sends it to the verifier:

[0027] (3.1) The user derives the salt value of the identity attribute from the rootNonce;

[0028] (3.2) The user selects the identity attributes to be disclosed and calculates the corresponding Merkle path accordingly;

[0029] (3.3) The identity attributes to be disclosed by the user, the hash values ​​of each node on the Merkle path, and the signature value S (Pri) of the Merkle root obtained from the trusted third party andy ,MerkleRoot) is sent to the verifier;

[0030] Step 4: The verifier verifies the Merkle root:

[0031] (4.1) The verifier recalculates the MerkleRoot′ based on the identity attributes to be disclosed by the user and the hash values ​​of each node on the Merkle path:

[0032] 4.1.1. Calculate the hash value of the identity attribute to be disclosed;

[0033] 4.1.2. Starting from the leaf node corresponding to the identity attribute to be disclosed, combine the hash values ​​of each node on the Merkle path and recursively calculate the hash value of the parent node upwards;

[0034] 4.1.3. Derive the hash value of the root node and obtain the MerkleRoot′;

[0035] (4.2) The verifier verifies the Merkle root:

[0036] The verifier uses the public key Pub Andy and MerkleRoot′, verify S(Pri Andy ,MerkleRoot), if the verification is successful, the identity attributes disclosed by the user are credible, and the verifier has successfully verified the identity attributes disclosed by the user.

[0037] Furthermore, the specific process of step (3.2) is:

[0038] (3.2.1) Select the identity attribute to be disclosed and calculate its hash value;

[0039] (3.2.2) Add the sibling nodes of the leaf node corresponding to the identity attribute to be disclosed to the Merkle path;

[0040] (3.2.3) Calculate the hash value of the parent node of the leaf node corresponding to the identity attribute to be disclosed, and based on this, find the sibling node of the parent node of the leaf node corresponding to the identity attribute to be disclosed and add it to the Merkle path;

[0041] (3.2.4) Recursively execute step (3.2.3), calculate the hash value of the corresponding parent node layer by layer and add the sibling nodes of the corresponding parent node to the Merkle path until the root node of the Merkle tree is calculated.

[0042] The present invention also provides a trusted third-party computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, step 2 of the above method is implemented.

[0043] The present invention also provides a trusted third-party computer device, including a processor and a memory, wherein the memory is used to store a computer program; when the processor is used to execute the computer program, step 2 of the above method is implemented.

[0044] The present invention also provides a user-side computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, step three of the above method is implemented.

[0045] The present invention also provides a user-side computer device, comprising a processor and a memory, wherein the memory is used to store a computer program; when the processor is used to execute the computer program, step three of the above method is implemented.

[0046] The present invention also provides a computer-readable storage medium for a verification party, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, step 4 of the above method is implemented.

[0047] The present invention also provides a verification party computer device, including a processor and a memory, wherein the memory is used to store a computer program; when the processor is used to execute the computer program, step four of the above method is implemented.

[0048] The beneficial effects of the present invention are:

[0049] 1. By utilizing the method of the present invention, when a user selectively discloses private information to the outside, it is not necessary to provide the hash values ​​of all the plaintext private information. Except for the private information that the user wishes to disclose, the remaining hash values ​​disclosed to verify the legitimacy of the identity attribute information are all multiple hash transformations of the plaintext private information.

[0050] 2. The method of the present invention uses the identity attribute hash as the leaf node of the Merkle tree to construct a Merkle tree and generate a root hash. The credential issuer only signs the Merkle root hash, and the verifier only needs to verify this signature to prove the authenticity and integrity of the identity attribute.

[0051] 3. The method of the present invention adds a salt value node in the Merkle tree to hide identity attributes and their hash values, increase the difficulty of brute force cracking and rainbow table attacks, and avoid identity information leakage.

[0052] 4. When constructing the Merkle tree, the method of the present invention adds a brother node to each identity attribute leaf node, which is a salt value node. When selectively disclosing identity attributes, other identity attributes can be effectively hidden to avoid identity information leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A schematic diagram of the participants in the method of the embodiment of the present invention;

[0054] Figure 2 A schematic diagram of a Merkle tree in a method according to an embodiment of the present invention;

[0055] Figure 3 A schematic diagram of a Merkel path in a method according to an embodiment of the present invention;

[0056] Figure 4 Schematic diagram of Merkel verification in the method of an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The present invention will be further described below in conjunction with the accompanying drawings. It should be noted that this embodiment is based on the technical solution and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to this embodiment.

[0058] This embodiment provides a privacy-enhanced digital identity attribute selective disclosure and verification method, including three participants, user Alice, verification party Bob and trusted third party Andy. Figure 1 shown.

[0059] The method of this embodiment mainly includes the following steps:

[0060] Step 1: Initialization;

[0061] Step 2: The trusted third party builds the Merkle tree, generates the Merkle root and sends it down;

[0062] Step 3: The user selects the identity attributes to be disclosed, calculates the Merkle path and sends it to the verifier;

[0063] Step 4: The verifier verifies the Merkle root.

[0064] The specific process of step one is:

[0065] (1.1) User Alice sends a personal identity information message to the trusted third party Andy. The personal identity information message contains multiple identity attributes.

[0066] (1.2) The trusted third party Andy generates a public-private key pair, with the public key being Pub andy , the private key is Pri andy .

[0067] (1.3) The trusted third party Andy generates a random number seed rootNonce which is used to generate the salt value corresponding to each identity attribute of the user.

[0068] (1.4) The trusted third party Andy defines the Salt Generation Algorithm, or SGA for short.

[0069] (1.5) User Alice obtains rootNonce and SGA from the trusted third party Andy.

[0070] (1.6) The verifier Bob obtains Pub from the trusted third party Andy andy .

[0071] The parameters of each party are summarized in Table 1.

[0072] Table 1

[0073]

[0074]

[0075] The specific process of step 2 is:

[0076] (2.1) The trusted third party Andy calculates the salt value:

[0077] Each identity attribute of the user corresponds to a salt value, and the salt value is derived from the rootNonce and the identity attribute of the user under the SGA algorithm, that is, Slat = SGA (rootNonce, nessage).

[0078] (2.2) The trusted third party Andy builds a Merkle tree: The trusted third party Andy builds a Merkle tree based on each identity attribute of the user and the corresponding salt value.

[0079] Merkle tree Figure 2 As shown, the calculation principle of calculating the Merkle root is as follows:

[0080] (1) Calculate the leaf node hash value:

[0081] Each piece of data in the Merkle tree is hashed to create a leaf node.

[0082] leaf i =H(data i )

[0083] Among them, data i Indicates the i-th data, leaf i is the leaf node corresponding to the i-th data, and H represents the hash algorithm.

[0084] (2) Recursively calculate the parent node hash value:

[0085] Starting from the leaf node, traverse the nodes in this layer and calculate the hash value of the parent node in the upper layer in turn. The parent node is created by concatenating the hash values ​​of its child nodes.

[0086] parent j =H(left_child||right_child)

[0087] parent j It represents the j-th parent node in the upper layer, left_child is the left child node of the parent node, right_child is the right child node of the parent node, and H represents the hash algorithm.

[0088] (3) Derivation of the Merkle root:

[0089] Continue step (2) until there is only one node at the top, calculate its hash value, and obtain the MerkleRoot.

[0090] Merkle Root=H(parent1||parent2)

[0091] Parent1 and parent2 are two child nodes of the lower layer of Merkle Root.

[0092] In this embodiment, the data of the Merkle tree contains two parts. One part is the plaintext data of each identity attribute of the user, which specifically includes data blocks A, B, C, and D of four identity attributes in this embodiment; the other part is the salt value data corresponding to each identity attribute. In this embodiment, the salt value data corresponding to data blocks A, B, C, and D are respectively represented as SaltA, SaltB, SaltC, and SaltD, which are derived from identity attributes A, B, C, and D and rootNonce. Therefore, the calculation process of the Merkle root in this embodiment is as follows:

[0093] 2.2.1. Calculate the hash value of the leaf node: Calculate the hash value of each identity attribute of the user's personal identity information and the hash value of the salt value corresponding to each identity attribute as each leaf node, and the leaf node corresponding to each identity attribute and its corresponding salt value is a brother node;

[0094] H A =H(A),H SaltA =H(SaltA)

[0095] H B =H(B),H SaltB =H(SaltB)

[0096] H C =H(C),H SaltC =H(SaltC)

[0097] H D =H(D),H SaltD =H(SaltD)

[0098] 2.2.2. Recursively calculate the hash value of the parent node: Starting from the leaf node, traverse the nodes of this layer and calculate the parent nodes of the upper layer in turn; the parent node is created by concatenating the hash values ​​of its child nodes:

[0099] H AS =H(H A ||H SaltA )

[0100] H BS =H(H B ||H SaltB )

[0101] H CS =H(H C ||H SaltC )

[0102] H DS =H(H D ||H SaltD )

[0103] H AB =H(H AS ||H BS ),H CD =H(H CS ||H DS )

[0104] 2.2.3. Until there is only one node at the top of the Merkle tree, which is the root node, calculate the hash value of the root node to get the MerkleRoot:

[0105] Merkle Root=H(H AB ||H CD )

[0106] (2.3) At this point, the trusted third party Andy calculates the MerkleRoot from the user Alice's identity attributes and the corresponding salt values, and then uses his own private key Pri andy Sign the MerkleRoot to generate the signature value S(Pri andy ,MerkleRoot). MerkleRoot and its signature value S(Pri andy ,MerkleRoot) is sent to the user Alice.

[0107] The specific process of step three is:

[0108] (3.1) User Alice derives the salt value from the rootNonce, that is, salt = SGA (rootNonce, message).

[0109] (3.2) User Alice calculates the Merkle path. The process is as follows:

[0110] (3.2.1) Select the identity attribute to be disclosed and calculate its hash value;

[0111] (3.2.2) Add the sibling nodes of the leaf node corresponding to the identity attribute to be disclosed to the Merkle path;

[0112] (3.2.3) Calculate the hash value of the parent node of the leaf node corresponding to the identity attribute to be disclosed, and based on this, find the sibling node of the parent node of the leaf node corresponding to the identity attribute to be disclosed and add it to the Merkle path;

[0113] (3.2.4) Recursively execute step (3.2.3), calculate the hash value of the corresponding parent node layer by layer and add the sibling nodes of the corresponding parent node to the Merkle path until the root node of the Merkle tree is calculated.

[0114] like Figure 3 shown. Figure 3 In the above example, A is the identity attribute selected for disclosure, and H is SaltA , H BS , H CD is the hash value of the node on the Merkle path, such as Figure 3 The dark nodes in the

[0115] (3.3) The data block A that Alice is about to disclose and the hash value H of the node on the Merkle path SaltA , H BS , HCD And the signature value S(Pri) of the Merkle root obtained from the trusted third party Andy andy ,MerkleRoot) is sent to the verifier Bob.

[0116] The specific process of step 4 is as follows:

[0117] (4.1) The verifier Bob recalculates the Merkle root:

[0118] The verifier Bob determines the identity attribute A that the user Alice wants to disclose and the node hash value H on the Merkle path. SaltA , H BS , H CD Recalculate the MerkleRoot′, such as Figure 4 shown. Figure 4 In the figure, the darker nodes are the nodes on the Merkle path corresponding to the data block A disclosed by the user Alice, and the lighter colored nodes are the hash nodes to be calculated. The specific calculation process is as follows:

[0119] 4.1.1. Calculate the hash value of the identity attribute to be disclosed:

[0120] H A =H(A)

[0121] 4.1.2. Recursively calculate the hash value of the corresponding parent node:

[0122] H AS =H(H A ||H SaltA ), H AB =H(H AS ||H BS )

[0123] 4.1.3. Derive the hash value of the root node and get the Merkle root:

[0124] MerkleRoot′=H(H AB ||H CD )

[0125] (4.2) Bob, the verifier, verifies the Merkle root

[0126] The verifier Bob uses the public key Pub Andy and MerkleRoot′ to verify the signature S(Pri Andy , MerkleRoot). If the signature verification is successful, the identity attributes disclosed by the user Alice are credible. At this point, the verifier Bob has successfully verified the identity attributes disclosed by the user Alice.

[0127] The method of this embodiment can be applied in scenarios such as bank account opening, corporate recruitment, and government service.

[0128] In the bank account opening scenario, the user Alice is a bank user, the trusted third party Andy is the ID card authority, and the verifier Bob is the bank. After the bank user obtains certification from the ID card authority, he or she voluntarily discloses personal identity information, and the bank verifies the identity information before opening the account.

[0129] In the corporate recruitment scenario, the user Alice is a job seeker, the trusted third party Andy is the relevant department of the Ministry of Education, and the verifier Bob is the recruiting company. After the job seeker obtains certification from the relevant department of the Ministry of Education, he or she will voluntarily disclose his or her academic information, and the recruiting company will complete the verification of the academic information.

[0130] In the government service scenario, the user Alice is a resident, the trusted third party Andy is the residence permit management department, and the verifier Bob is a government service-related party. After the resident obtains certification from the residence permit management department, he or she voluntarily discloses the residence permit information, and the government service-related party verifies the residence permit information and then handles the related services.

[0131] For those skilled in the art, various corresponding changes and modifications can be made according to the above technical solutions and concepts, and all of these changes and modifications should be included in the protection scope of the claims of the present invention.

Claims

1. A privacy-enhanced digital identity attribute selective disclosure and verification method, characterized in that: The steps include: Step 1: Initialization: (1.1) The user sends personal identity information to a trusted third party. The personal identity information contains multiple identity attributes; (1.2) A trusted third party generates a public-private key pair, with the public key being Pub andy , the private key is pri andy ; (1.3) A trusted third party generates a random number seed rootNonce to generate a salt value corresponding to each identity attribute of the user's personal identity information; (1.4) A trusted third party defines a salt generation algorithm SGA; (1.5) The user obtains rootNonce and SGA from a trusted third party; (1.6) The verifier obtains Pub from a trusted third party andy ; Step 2: The trusted third party builds the Merkle tree, generates the Merkle root and sends it down: (2.1) A trusted third party calculates the salt value: Each identity attribute of the user's personal identity information corresponds to a salt value, and the salt value Salt is derived from the rootNonce and the user's identity attribute under the SGA algorithm; (2.2) The trusted third party constructs a Merkle tree based on each identity attribute of the user's personal identity information and the corresponding salt value: 2.2.

1. Calculate the hash value of the leaf node: Calculate the hash value of each identity attribute of the user's personal identity information and the hash value of the salt value corresponding to each identity attribute as each leaf node, and the leaf node corresponding to each identity attribute and its corresponding salt value is a brother node; 2.2.

2. Recursively calculate the hash value of the parent node: starting from the leaf node, traverse the nodes of this layer and calculate the parent nodes of the upper layer in turn; the parent node is created by concatenating the hash values ​​of its child nodes; 2.2.

3. Until there is only one node at the top of the Merkle tree, which is the root node, calculate the hash value of the root node to get the MerkleRoot; (2.3) The trusted third party uses its own private key Pri andy Sign the MerkleRoot to generate the signature value S(Pri andy ,MerkleRoot), and then MerkleRoot MerkleRoot and its signature value S(Pri andy ,MerkleRoot) is sent to the user; Step 3: The user selects the identity attributes to be disclosed, calculates the Merkle path and sends it to the verifier: (3.1) The user derives the salt value of the identity attribute from the rootNonce; (3.2) The user selects the identity attributes to be disclosed and calculates the corresponding Merkle path accordingly; (3.3) The identity attributes to be disclosed by the user, the hash values ​​of each node on the Merkle path, and the signature value S (Pri) of the Merkle root obtained from the trusted third party andy ,MerkleRoot) is sent to the verifier; Step 4: The verifier verifies the Merkle root: (4.1) The verifier recalculates the MerkleRoot based on the identity attributes to be disclosed by the user and the hash values ​​of each node on the Merkle path ′ : 4.1.

1. Calculate the hash value of the identity attribute to be disclosed; 4.1.

2. Starting from the leaf node corresponding to the identity attribute to be disclosed, combine the hash values ​​of each node on the Merkle path and recursively calculate the hash value of the parent node upwards; 4.1.

3. Derive the hash value of the root node and obtain the MerkleRoot′; (4.2) The verifier verifies the Merkle root: The verifier uses the public key Pub Andy and MerkleRoot′, verify S(Pri Andy ,MerkleRoot), if the signature verification is successful, the identity attributes disclosed by the user are credible, and the verifier has successfully verified the identity attributes disclosed by the user.

2. The method according to claim 1, characterized in that The specific process of step (3.2) is: (3.2.1) Select the identity attribute to be disclosed and calculate its hash value; (3.2.2) Add the sibling nodes of the leaf node corresponding to the identity attribute to be disclosed to the Merkle path; (3.2.3) Calculate the hash value of the parent node of the leaf node corresponding to the identity attribute to be disclosed, and based on this, find the sibling node of the parent node of the leaf node corresponding to the identity attribute to be disclosed and add it to the Merkle path; (3.2.4) Recursively execute step (3.2.3), calculate the hash value of the corresponding parent node layer by layer and add the sibling nodes of the corresponding parent node to the Merkle path until the root node of the Merkle tree is calculated.

3. A trusted third-party computer-readable storage medium, characterized in that a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, step 2 of the method described in any one of claims 1-2 is implemented.

4. A trusted third-party computer device, comprising a processor and a memory, wherein the memory is used to store a computer program; when the processor is used to execute the computer program, step 2 of the method described in any one of claims 1-2 is implemented.

5. A user-side computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, step three of the method according to any one of claims 1 to 2 is implemented.

6. A user-side computer device, characterized in that: It comprises a processor and a memory, wherein the memory is used to store a computer program; when the processor is used to execute the computer program, step three of the method described in any one of claims 1-2 is implemented.

7. A computer-readable storage medium of a verifier, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, step 4 of the method according to any one of claims 1 to 2 is implemented.

8. A computer device of a verification party, characterized in that: It comprises a processor and a memory, wherein the memory is used to store a computer program; when the processor is used to execute the computer program, step 4 of the method according to any one of claims 1 to 2 is implemented.

Images