Multi-authority hidden anonymous authentication method based on block chain

Abstract

The invention discloses a multi-authority hidden anonymous authentication method based on a block chain. The method comprises the following steps: initializing a system, generating public and private keys of a certificate distributor, generating public and private keys of a user, generating public and private keys of a certificate verifier, generating a verification strategy by the certificate verifier, generating a user certificate request, issuing a certificate by the certificate distributor, authenticating an anonymous certificate by the block chain, and accessing resources of the certificate verifier by the user. According to the method, the user anonymous certificate is generated, and the real identity information of the certificate issuer and the user and the real attribute information of the user are effectively hidden in the process that the user requests the intelligent contract to automatically execute verification. In the authentication process, a traditional centralized verification mechanism is cancelled, the verification process is written into the smart contract, the verification process is automatically executed by a committee of the block chain, a certificate verifier does not need to participate in verification online in real time, and the verification efficiency is effectively improved. The method has the advantages of being good in safety, high in efficiency, practical and the like, and can be applied to multi-authority center scenes such as smart cities and the like.

Description

Technical Field

[0001] The invention belongs to the technical field of anonymous identity authentication, and in particular relates to a structural protection signature on an equivalence class and a cross-set commitment method. Technical Background

[0002] In the digital age, identity authentication technology is the key to ensuring the security of online transactions, protecting user privacy, and providing personalized services. Traditional centralized anonymous authentication technology cannot completely prevent the tracking of user behavior. Attackers use network analysis, traffic analysis and other means to indirectly identify and track user identities. Furthermore, many traditional systems rely on centralized certification authorities to issue and manage credentials, resulting in single points of failure and security risks, such as attacks on certification authorities or abuse of power.

[0003] The core of the multi-authority hidden anonymous authentication technology background is that it abandons the traditional single-authority authentication model and adopts multiple authoritative agencies to jointly participate in the identity authentication process. This model improves the system's risk resistance. Even if an authoritative agency is attacked or fails, the entire authentication system can still operate normally. In addition, the multi-authority system also increases the flexibility and diversity of authentication, and can adapt to the needs of different users and scenarios.

[0004] With the rise of blockchain technology, blockchain-based identity authentication methods have gradually become a hot topic of research and application due to their decentralization, immutability and transparency. Blockchain technology provides a solid foundation for multi-authority hidden anonymous authentication. The distributed ledger characteristics of blockchain enable identity information and authentication records to be securely stored on multiple nodes, preventing the risk of single point failure and data tampering. At the same time, the application of smart contracts enables authentication rules and processes to be implemented in code on the blockchain, further improving the automation and transparency of the authentication process.

[0005] The realization of multi-authority hidden anonymous authentication based on blockchain also faces technical challenges. For example, how to ensure the validity and verifiability of authentication while ensuring anonymity; how to hide the certificate distributor in a multi-authority system; and how to meet the data protection requirements of laws and regulations while protecting user privacy are technical issues that need to be solved at present. Summary of the invention

[0006] The technical problem to be solved by the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a multi-authority hidden anonymous authentication method based on blockchain that is highly secure, strong against single-point attacks, and practical.

[0007] The technical solution adopted to solve the above technical problems consists of the following steps:

[0008] (1) System initialization

[0009] The certificate committee sets the security parameter λ for the system, and the value of λ is 1 256 , randomly select two large prime numbers p and q, and use the group generation method to generate q-order multiplicative cyclic groups G1 and G2, and the multiplicative cyclic group G T , the group of integers modulo q Determine the modulus N as follows:

[0010] N=p×q

[0011] Among them, p and q are two large prime numbers that meet security requirements, and q can divide p-1. Select two hash functions and H1:{0,1} * →G2.

[0012] Generate the global parameter pp according to formula (1):

[0013] pp=(q,p,G1,G2,G T ,e,g,g1,g2,η,α,H,H1) (1)

[0014] Among them, g and g1 are two generators of G1, g2 is a generator of G2, and e is G1×G2→G T A type III bilinear map, η and α are parameters, which are finite positive integers.

[0015] The Certificate Committee from the q-order integer group Randomly select integer μ and integer v from the definition of two pairs of message vectors

[0016]

[0017] and The equivalence relation as follows:

[0018]

[0019] Satisfies the following equation:

[0020]

[0021] Among them, M1, M2, M1′, M2′ are elements of the G1 group, and N1, N2, N1′, N2′ are elements of the G2 group.

[0022] The Certificate Committee from the q-order integer group Randomly select an integer ω from the , and define the equivalence relationship between the two issuer public keys ipk, ipk′

[0023]

[0024] The following equation is satisfied:

[0025] ipk′=ipk ω

[0026] Among them, ipk is a vector composed of 5 elements X, Y1, Y2, Z1, Z2 on the G2 group, and ipk′ is a vector composed of 5 elements X′, Y1′, Y2′, Z1′, Z2′ on the G2 group.

[0027] Define an equivalence relation between two user public keys upk, upk′

[0028]

[0029] The following equation is satisfied:

[0030] upk′=upk ω

[0031] Among them, upk is a vector composed of two elements T1 and T2 on the G1 group, and upk′ is a vector composed of two elements T1′ and T2′ on the G1 group.

[0032] (2) Generate the public and private keys of the certificate distributor

[0033] Each certificate issuer CI is derived from the q-order integer group Randomly select 5 numbers x, y1, y2, z1, z2 as the certificate issuer private key isk and keep it confidential:

[0034] isk=(x,y1,y2,z1,z2)

[0035] The certificate issuer generates the public key ipk as follows:

[0036] pik=(X,Y1,Y2,Z1,Z2)

[0037]

[0038]

[0039] in, They respectively represent hiding of the user's private key x, y1, y2, z1, z2.

[0040] The certificate issuer publishes the public key ipk as an identifier to the public ledger of the blockchain and publishes the corresponding non-interactive zero-knowledge proof π CI :

[0041] π CI =ZkPoK{(x,y1,y2,z1,z2):X∧Y1∧Y2∧Z1∧Z2}

[0042] Among them, ZkPoK is a zero-knowledge proof of knowledge, {(x,y1,y2,z1,z2):X∧Y1∧Y2∧Z1∧Z2}, which means that X∧Y1∧Y2∧Z1∧Z2 proves that the certificate issuer owns 5 secret values ​​(x,y1,y2,z1,z2).

[0043] (3) Generate user public and private keys

[0044] The user selects n certificate issuer public keys ipk, where n is a finite integer, and selects an attribute value a for each certificate issuer. ij , i represents the serial number of the attribute value, i∈{1,2,...,k}, k is a finite positive integer, j represents the serial number of the certificate issuer's public key, j∈{1,2,...,n}, given the attribute value set A j :

[0045] A j =(a 0j ,a 1j ,...,a kj )

[0046] The user is given an attribute key set S:

[0047] S={(A1,ipk1),(A2,ipk2),...,(A n ,ipk n )}

[0048] The user is from the q-order integer group Randomly select two numbers ρ1 and ρ2 as your private key usk:

[0049] usk=(ρ1,ρ2)

[0050] Among them, ρ1, ρ2 are finite integers.

[0051] Generate the public key upk as follows:

[0052] upk=(T1,T2)

[0053]

[0054] h=H(aux)

[0055]

[0056] Among them, T1 and T2 represent the two components of the user's public key upk, h is the hash value of the auxiliary information, and H is the mapping of any 0 / 1 string to The hash function of , aux represents auxiliary information, Represents attribute set Aj The hash value of ||·|| represents the cascade, H′ is the hash function modeled as a random oracle machine, A j is the set of attributes that need to be submitted, and r is a finite positive integer.

[0057] (4) Generate the public and private keys of the certificate verifier

[0058] Each certificate verifier CV is from an integer group of order q Randomly select K positive integers as your private key vsk:

[0059] vsk=(x1,x2,...,x K )

[0060] And generate the public key vpk:

[0061]

[0062] Where K represents the number of certificate distributors that each certificate verifier wants to receive, and K is a finite positive integer.

[0063] (5) Certificate verifier generates verification strategy

[0064] The certificate verifier CV specifies the K certificate issuer vectors that he is willing to accept

[0065]

[0066] The certificate verifier CV selects l attribute values ​​and gives the attribute value set R:

[0067] R={a1,a2,...,a l}

[0068] Among them, l represents the number of attribute values, l∈[1,K×k], K represents the number of certificate distributors, and k represents the number of attribute values ​​in the attributes distributed by each certificate distributor.

[0069] The certificate verifier CV is from the q-order integer group A random number φ is randomly selected from the set and K issuers are determined The signature of θ is:

[0070] θ=(Z,B1,B2)

[0071]

[0072] Among them, Z, B1, B2 are the intermediate values ​​of the signature.

[0073] The certificate verifier generates the authentication policy pol:

[0074]

[0075] And upload it to the distributed ledger on the blockchain for users to download, by providing the following non-interactive zero-knowledge proof π pol , proving that the authentication policy is correctly formed:

[0076] π pol =ZkPoK{(x1,x2,...,x K ,φ):vpk∧Z∧B1∧B2}

[0077] Among them, ZkPoK represents the zero-knowledge proof of knowledge, {(x1,x2,...,x K ,φ):vpk∧Z∧B1∧B2} means that vpk∧Z∧B1∧B2 proves that the certificate verifier has K+1 secret values ​​(x1,x2,...,x K ,φ).

[0078] (6) Generate a user certificate request

[0079] The user sends a request Req to the issuer to generate a user certificate:

[0080]

[0081] Among them, f A (α) indicates that the monotone polynomial about set A is calculated using trapdoor α, indicating that set A is a set of attributes selected by the user:

[0082] A={a1,…,a k}

[0083] Among them, a j is an element in the set A, j∈[1,k], k is a finite positive integer.

[0084] The user generates a non-interactive zero-knowledge proof of knowledge π CH :

[0085]

[0086] Among them, ZkPoK represents zero-knowledge proof of knowledge. Indicates that Prove that the user has k+2 secret values ​​(σ1,σ2,a1,a2,…,a k ).

[0087] (7) Certificate distributor issues certificate

[0088] After receiving the certificate request from the user, the certificate distributor instantiates π with zero-knowledge proof of knowledge CH, check whether the zero-knowledge proof is correct. If the zero-knowledge proof is invalid or the attributes do not match the user's background, the certificate distributor will return an error and stop issuing; otherwise, the distributor performs a signing operation and generates a certificate cred:

[0089]

[0090] Among them, the signature σ is a commitment to the attribute The signature of , b, s are intermediate variables of the signature σ.

[0091] The certificate distributor stores the certificate cred in its local database and returns the certificate cred to the user. The user parses the certificate cred to obtain the signature σ and checks whether the following equation holds:

[0092]

[0093]

[0094] If the above three equations are all true, the user stores the certificate cred in its local certificate database.

[0095] (8) Blockchain authentication anonymous certificate

[0096] (8.1) User generates anonymous authentication request

[0097] After finding the appropriate authentication smart contract and downloading the policy pol of the specific certificate verifier from the distributed ledger, the user generates an anonymous authentication request as follows:

[0098] The user is from the q-order integer group A random number r is randomly selected and the distributor's public key equivalence relation is used. The conversion parameter ω defined in the conversion strategy pol is as follows: And signature θ to get the converted certificate distributor public key vector And the corresponding signature θ′:

[0099]

[0100] The user aggregates the signatures in the K certificate generator certificates to obtain an aggregated issuer public key αvk and an aggregated attribute signature

[0101] αvk=(ipk1,ipk2,...,ipk K )

[0102]

[0103] Where h is the hash value of the auxiliary information, is an element of group G1, and is the aggregate attribute signature The intermediate variable.

[0104] And transform the aggregate attribute signature using the transformation parameter ω Get the converted issuer public key αvk′ and aggregate attribute signature

[0105] αvk′=αvk ω

[0106]

[0107] in, and is the transformed aggregate attribute signature The intermediate variable.

[0108] The user then uses the equivalence relation of the message vector The two transformation parameters μ and v defined in get the randomized K attribute commitments

[0109]

[0110] Among them, j represents the serial number of the attribute commitment, j∈[1,K], K is a finite positive integer, and K attribute commitments are stored in the vector set

[0111]

[0112] User-generated pseudonym N ym :

[0113] N ym =upk μ

[0114] The user gets the signature corresponding to the new attribute commitment

[0115]

[0116] in, and It is a signature The intermediate variable.

[0117] For satisfaction The attribute set T j , where j∈[1,K], the user determines K pieces of evidence W j :

[0118]

[0119] And all the evidence W j Aggregate into a cross-set evidence W:

[0120]

[0121] t j =H(j,A j ,T j )

[0122] Among them, t j It is an intermediate variable of the cross-set evidence W.

[0123] The user randomizes the cross-set evidence W into a new cross-set evidence W′ using transformation parameters μ and v:

[0124] W′=W μ×v

[0125] The user needs to determine K additional evidences Γ that satisfy the strategy pol j :

[0126]

[0127] Among them, a i ∈R / T j , a i Represents the attribute value, i∈[1,l], l is a finite positive integer.

[0128] The user is from the q-order integer group A random positive integer δ is randomly selected in , and the off-chain short-term authentication token Δ is calculated:

[0129] Δ=g δ

[0130] The user gets his anonymous authentication request A uth :

[0131]

[0132] (8.2) Blockchain-authenticated anonymous certificates

[0133] The user randomly selects a 128-bit 0 / 1 string as his authentication identifier aid and sends the authentication identifier aid to the authentication request A. uth Sent to the blockchain, the blockchain committee members verify whether the user has the certificate and attribute set required by the certificate verifier according to the following 5 formulas:

[0134]

[0135] After successful verification, the blockchain committee stores the short-term off-chain access token Δ in the blockchain and returns an authentication success indicator to the user.

[0136] (9) User access to certificate verifier resources

[0137] By sending a message containing the authentication identifier aid, the current timestamp ts, the short-term off-chain access token Δ, and the non-interactive zero-knowledge proof π Δ After successful authentication, the user can access the corresponding resources:

[0138] π Δ =ZkPoK{(δ):Δ}

[0139] Among them, ZkPoK represents zero-knowledge proof of knowledge, and {(δ):Δ} means proving that the user owns the secret value δ through a short-term off-chain access token Δ.

[0140] The verifier receives the request (sid,Δ,π Δ ), check in the blockchain whether the authentication corresponding to the authentication identifier aid is successful, whether the short-term off-chain access token Δ has been stored in the blockchain, and the non-interactive zero-knowledge proof π Δ If all verifications are successful, the off-chain verification request is accepted, and the verifier negotiates the session symmetric key with the user, allowing the user to access resources according to the permissions specified in the verification contract.

[0141] The verifier also needs to send transactions (aid, ts, des) to the blockchain to record the comprehensive information des of off-chain verification and access resources, where des can be a text description.

[0142] In the step (1) of system initialization of the present invention, the certificate committee sets a security parameter λ for the system, and the security parameter λ takes a value of 1. 256 ; The p and q are two large prime numbers that meet the security requirements, and q can divide p-1; the value of the large prime number p is 2 521 +887, the value of the large prime number q is 2 521 +2001; In formula (1), η and α are parameters, and the value range of η is [2 5 ,2 10 ], the value range of α is [2 1 ,2 8 ]; the value range of the integer μ is [2 8 ,2 128 ], the integer ν ranges from [2 8 ,2 128 ], the value range of integer ω is [2 8 ,2 128 ].

[0143] In step (3) of the present invention, in generating the user public and private keys, the user selects n certificate issuer public keys ipk, where the value range of n is [2 0 ,2 4 ] and select attribute value a for each certificate issuer ij , i represents the serial number of the attribute value, i∈[1,k], and the value range of k is [2 1 ,2 4 ], j represents the serial number of the public key of the certificate issuer, j∈[1,n].

[0144] In step (4) of the present invention, in generating the certificate verifier public and private keys, each certificate verifier CV is selected from the q-order integer group Randomly select K integers as your private key vsk:

[0145] vsk=(x1,x2,...,x K )

[0146] And generate the public key vpk:

[0147]

[0148] Where K represents the number of certificate distributors that each certificate verifier wants to receive, and the value range of K is [2 0 ,2 4 ].

[0149] In step (5) of the present invention, the certificate verifier generates a verification strategy, and the certificate verifier CV specifies the K certificate issuer vectors that he is willing to accept.

[0150]

[0151] The certificate verifier CV selects l attribute values ​​and gives the attribute value set R:

[0152] R = {a1, a2, ..., a l}

[0153] Where, l represents the number of attribute values, l∈[1,K×k], K represents the number of certificate distributors, and k represents the number of attribute values ​​in the attributes distributed by each certificate distributor; the value range of l is l∈[2 0 ,2 8 ].

[0154] Since the present invention generates anonymous authentication requests autonomously by users, before interacting with the blockchain, users use technologies such as equivalence class signatures and their variants through predefined equivalence relations to achieve issuer hiding, attribute hiding and pseudonym generation, ensuring that the authentication information on the user chain is correct and privacy-protected; users use a cross-set commitment aggregation method to aggregate evidence of attribute subsets corresponding to various certificates required in the verifier strategy, and prove that the user attributes meet the verifier strategy without disclosing the complete content of the attribute set; in the process of blockchain authentication anonymous requests, the verifier entrusts most of its authentication capabilities to the blockchain, and the process of on-chain authentication is open and transparent, and does not require real-time participation by the verifier, and the off-chain authentication is lightweight. The present invention realizes the issuer hiding function in the existing multi-authority scheme, effectively utilizes the transparency of blockchain technology and the automatic execution characteristics of smart contracts, and balances the transparency and privacy protection characteristics in the user anonymous authentication process. Compared with the prior art, the present invention has the advantages of good security, low off-chain communication and computational complexity, and controllable on-chain authentication costs, and can be promoted and applied in the field of Internet technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0155] Figure 1 It is a flow chart of embodiment 1 of the present invention. DETAILED DESCRIPTION

[0156] The present invention will be further described in detail below in conjunction with the accompanying drawings and examples, but the present invention is not limited to the following embodiments.

[0157] Example 1

[0158] The multi-authority hidden anonymous authentication method based on blockchain in this embodiment consists of the following steps (see Figure 1 ):

[0159] (1) System initialization

[0160] The certificate committee sets the security parameter λ for the system, and the value of λ is 1 256 , randomly select two large prime numbers p and q, and q can divide p-1; the value of the large prime number p in this embodiment is 2 521 +887, the value of the large prime number q is 2 521 +2001. Generate q-order multiplicative cyclic groups G1 and G2 using group generation methods, and multiplicative cyclic group G T , the group of integers modulo q Determine the modulus N as follows:

[0161] N=p×q

[0162] Among them, p and q are two large prime numbers that meet security requirements, and q can divide p-1. Select two hash functions and H1:{0,1} * →G2.

[0163] Generate the global parameter pp according to formula (1):

[0164] pp=(q,p,G1,G2,G T ,e,g,g1,g2,η,α,H,H1) (1)

[0165] Among them, g and g1 are two generators of G1, g2 is a generator of G2, and e is G1×G2→G T is a type III bilinear map, η and α are parameters, and the value range of η is [2 5 ,2 10 ], the value of n in this embodiment is 2 8 , the value range of α is [2 1 ,2 8 ], the value of α in this embodiment is 2 4 .

[0166] The Certificate Committee from the q-order integer group Randomly select integer μ and integer ν from the equation, and the value range of μ is [2 8 ,2 128 ], the value of μ in this embodiment is 2 60 , the value range of v is [2 8 ,2 128 ], the value of v in this embodiment is 2 60 , define two pairs of message vectors

[0167]

[0168] and The equivalence relation as follows:

[0169]

[0170] Satisfies the following equation:

[0171]

[0172] Among them, M1, M2, M1′, M2′ are elements of the G1 group, and N1, N2, N1′, N2′ are elements of the G2 group.

[0173] The Certificate Committee from the q-order integer group Randomly select an integer ω from the range [2 8 ,2 128 ], the value of ω in this embodiment is 2 60 , define the equivalence relationship between the two issuer public keys ipk, ipk′

[0174]

[0175] The following equation is satisfied:

[0176] ipk′=ipk ω

[0177] Among them, ipk is a vector composed of 5 elements X, Y1, Y2, Z1, Z2 on the G2 group, and ipk′ is a vector composed of 5 elements X′, Y1′, Y2′, Z1′, Z2′ on the G2 group.

[0178] Define an equivalence relation on two user public keys upk, upk′

[0179]

[0180] Satisfies the following equation

[0181] upk′=upk ω

[0182] Among them, upk is a vector composed of two elements T1 and T2 on the G1 group, and upk′ is a vector composed of two elements T1′ and T2′ on the G1 group.

[0183] (2) Generate the public and private keys of the certificate distributor

[0184] Each certificate issuer CI is derived from the q-order integer group Randomly select 5 numbers x, y1, y2, z1, z2 as the certificate issuer private key isk and keep it confidential:

[0185] isk=(x,y1,y2,z1,z2)

[0186] The certificate issuer generates the public key ipk as follows:

[0187] ipk=(X,Y1,Y2,Z1,Z2)

[0188]

[0189] in, They respectively represent hiding of the user's private key x, y1, y2, z1, z2.

[0190] The certificate issuer publishes the public key ipk as an identifier to the public ledger of the blockchain and publishes the corresponding non-interactive zero-knowledge proof π CI :

[0191] π CI=ZkPoK{(x,y1,y2,z1,z2):X∧Y1∧Y2∧Z1∧Z2}

[0192] Among them, ZkPoK is a zero-knowledge proof of knowledge, {(x,y1,y2,z1,z2):X∧Y1∧Y2∧Z1∧Z2}, which means that X∧Y1∧Y2∧Z1∧Z2 proves that the certificate issuer owns 5 secret values ​​(x,y1,y2,z1,z2).

[0193] (3) Generate user public and private keys

[0194] The user selects n certificate issuer public keys ipk, where n is in the range [2 0 ,2 4 ], the value of n in this embodiment is 2 2 , and select attribute value a for each certificate issuer ij , i represents the serial number of the attribute value, i∈{1,2,...,k}, and the value range of k is [2 1 ,2 4 ], the value of k in this embodiment is 2 3 , j represents the serial number of the public key of the certificate issuer, j∈{1,2,...,n}, and the value of n in this embodiment is 2 2 , given a set of attribute values ​​A j :

[0195] A j =(a 0j ,a 1j ,...,a kj )

[0196] The user is given an attribute key set S:

[0197] S={(A1,ipk1),(A2,ipk2),...,(A n ,ipk n )}

[0198] The user is from the q-order integer group Randomly select two numbers ρ1 and ρ2 as your private key usk:

[0199] usk=(ρ1,ρ2)

[0200] Among them, ρ1, ρ2 are finite integers.

[0201] Generate the public key upk as follows:

[0202] upk=(T1,T2)

[0203]

[0204] h=H(aux)

[0205]

[0206] Among them, T1 and T2 represent the two components of the user's public key upk, h is the hash value of the auxiliary information, and H is the mapping of any 0 / 1 string to The hash function of , aux represents auxiliary information, Represents attribute set A j The hash value of ||·|| represents the cascade, H′ is the hash function modeled as a random oracle machine, A j is the set of attributes that need to be submitted, and r is a finite positive integer.

[0207] (4) Generate the public and private keys of the certificate verifier

[0208] Each certificate verifier CV is from an integer group of order q Randomly select K positive integers as your private key vsk:

[0209] vsk=(x1,x2,...,x K )

[0210] And generate the public key vpk:

[0211]

[0212] Where K represents the number of certificate distributors that each certificate verifier wants to receive, and the value range of K is [2 0 ,2 4 ], in this embodiment, K is set to 2 2 .

[0213] (5) Certificate verifier generates verification strategy

[0214] The certificate verifier CV specifies the K certificate issuer vectors that he is willing to accept

[0215]

[0216] The certificate verifier CV selects l attribute values ​​and gives the attribute value set R:

[0217] R={a1,a2,...,a l}

[0218] Where, l represents the number of attribute values, l∈[1,K×k], and the value of k in this embodiment is 2 3 , K is 2 2 , that is, the value range of l is l∈[1,2 5 ], the value of l in this embodiment is 2 2; K represents the number of certificate distributors, and k represents the number of attribute values ​​in the attributes distributed by each certificate distributor.

[0219] The certificate verifier CV is from the q-order integer group A random number φ is randomly selected from the set and K issuers are determined The signature of θ is:

[0220] θ=(Z,B1,B2)

[0221]

[0222] Among them, Z, B1, B2 are the intermediate values ​​of the signature

[0223] The certificate verifier generates the authentication policy pol:

[0224]

[0225] And upload it to the distributed ledger on the blockchain for users to download, by providing the following non-interactive zero-knowledge proof π pol , proving that the authentication policy is correctly formed:

[0226] π pol =ZkPoK{(x1,x2,...,x K ,φ):vpk∧Z∧B1∧B2}

[0227] Among them, ZkPoK represents the zero-knowledge proof of knowledge, {(x1,x2,...,x K ,φ):vpk∧Z∧B1∧B2} means that vpk∧Z∧B1∧B2 proves that the certificate verifier has K+1 secret values ​​(x1,x2,...,x K ,φ).

[0228] (6) Generate a user certificate request

[0229] The user sends a request Req to the issuer to generate a user certificate:

[0230]

[0231] Among them, f A (α) indicates that the monotone polynomial about set A is calculated using trapdoor α, indicating that set A is a set of attributes selected by the user:

[0232] A={a1,…,a k}

[0233] Among them, a j is an element in the set A, j∈[1,k], k is a finite positive integer.

[0234] The user generates a non-interactive zero-knowledge proof of knowledge π CH :

[0235]

[0236] Among them, ZkPoK represents zero-knowledge proof of knowledge. Indicates that Prove that the user has k+2 secret values ​​(ρ1,ρ2,a1,a2,…,a k ).

[0237] (7) Certificate distributor issues certificate

[0238] After receiving the certificate request from the user, the certificate distributor instantiates π with zero-knowledge proof of knowledge CH , check whether the zero-knowledge proof is correct. If the zero-knowledge proof is invalid or the attributes do not match the user's background, the certificate distributor will return an error and stop issuing; otherwise, the distributor performs a signing operation and generates a certificate cred:

[0239]

[0240]

[0241] Among them, the signature σ is a commitment to the attribute The signature of , b, s are intermediate variables of the signature σ.

[0242] The certificate distributor stores the certificate cred in its local database and returns the certificate cred to the user. The user parses the certificate cred to obtain the signature σ and checks whether the following equation holds:

[0243]

[0244] If the above three equations are all true, the user stores the certificate cred in its local certificate database.

[0245] (8) Blockchain authentication anonymous certificate

[0246] (8.1) User generates anonymous authentication request

[0247] After finding the appropriate authentication smart contract and downloading the policy pol of the specific certificate verifier from the distributed ledger, the user generates an anonymous authentication request as follows:

[0248] The user is from the q-order integer group A random number r is randomly selected and the distributor's public key equivalence relation is used. The conversion parameter ω defined in the conversion strategy pol is as follows: and signature θ to obtain the converted certificate distributor public key vector And the corresponding signature θ′:

[0249]

[0250] The user aggregates the signatures in the K certificate generator certificates to obtain an aggregated issuer public key αvk and an aggregated attribute signature

[0251] αvk=(ipk1,ipk2,...,ipk K )

[0252]

[0253] Where h is the hash value of the auxiliary information, is an element of group G1, and is the aggregate attribute signature The intermediate variable.

[0254] And transform the aggregate attribute signature using the transformation parameter ω Get the converted issuer public key avk′ and aggregate attribute signature

[0255] avk′=avk ω

[0256]

[0257] in, and is the transformed aggregate attribute signature The intermediate variable.

[0258] The user then uses the equivalence relation of the message vector The two transformation parameters μ and v defined in get the randomized K attribute commitments

[0259]

[0260] Among them, j represents the serial number of the attribute commitment, j∈[1,K], and K attribute commitments are stored in the vector set

[0261] User-generated pseudonym N ym :

[0262] N ym =upkμ

[0263] The user gets the signature corresponding to the new attribute commitment

[0264]

[0265]

[0266] in, and It is a signature The intermediate variable.

[0267] For satisfaction The attribute set T j , where j∈[1,K], the user determines K pieces of evidence W j :

[0268]

[0269] And all the evidence W j Aggregate into a cross-set evidence W:

[0270]

[0271] Among them, t j It is an intermediate variable of the cross-set evidence W.

[0272] The user randomizes the cross-set evidence W into a new cross-set evidence W′ using transformation parameters μ and v:

[0273] W′=W μ×v

[0274] The user needs to determine K additional evidences Γ that satisfy the strategy pol j :

[0275]

[0276] Among them, a i ∈R / T j , a i Represents the attribute value, i∈[1,l].

[0277] The user is from the q-order integer group A random positive integer δ is randomly selected in , and the off-chain short-term authentication token Δ is calculated:

[0278] Δ=g δ

[0279] The user gets his anonymous authentication request A uth :

[0280]

[0281] (8.2) Blockchain-authenticated anonymous certificates

[0282] The user randomly selects a 128-bit 0 / 1 string as his authentication identifier aid and sends the authentication identifier aid to the authentication request A. uth Sent to the blockchain, the blockchain committee members verify whether the user has the certificate and attribute set required by the certificate verifier according to the following 5 formulas:

[0283]

[0284] e(B′1,g2)=e(g1,B′2)

[0285]

[0286] After successful verification, the blockchain committee stores the short-term off-chain access token Δ in the blockchain and returns an authentication success indicator to the user.

[0287] (9) User access to certificate verifier resources

[0288] By sending a message containing the authentication identifier aid, the current timestamp ts, the short-term off-chain access token Δ, and the non-interactive zero-knowledge proof π Δ After successful authentication, the user can access the corresponding resources:

[0289] π Δ =ZkPoK{(δ):Δ}

[0290] Among them, ZkPoK represents zero-knowledge proof of knowledge, and {(δ):Δ} means proving that the user owns the secret value δ through a short-term off-chain access token Δ.

[0291] The verifier receives the request (aid,Δ,π Δ ), check in the blockchain whether the authentication corresponding to the authentication identifier aid is successful, whether the short-term off-chain access token Δ has been stored in the blockchain, and the non-interactive zero-knowledge proof π Δ If all verifications are successful, the off-chain verification request is accepted, and the verifier negotiates the session symmetric key with the user, allowing the user to access resources according to the permissions specified in the verification contract.

[0292] The verifier also needs to send transactions (aid, ts, des) to the blockchain to record the comprehensive information des of off-chain verification and access resources, where des can be a text description.

[0293] Complete the multi-authority hidden anonymous authentication method based on blockchain.

[0294] Example 2

[0295] The multi-authority hidden anonymous authentication method based on blockchain in this embodiment consists of the following steps:

[0296] (1) System initialization

[0297] The certificate committee sets the security parameter λ for the system, and the value of λ is 1 256 , randomly select two large prime numbers p and q, and q can divide p-1; the value of the large prime number p in this embodiment is 2 521 +887, the value of the large prime number q is 2 521 +2001. Generate q-order multiplicative cyclic groups G1, X2, and multiplicative cyclic group G using group generation method T , the group of integers modulo q Determine the modulus N as follows:

[0298] N=p×q

[0299] Among them, p and q are two large prime numbers that meet security requirements, and q can divide p-1. Select two hash functions and H1:{0,1} * →g2.

[0300] Generate the global parameter pp according to formula (1):

[0301] pp=(q,p,G1,G2,G T ,e,g,g1,g2,η,α,H,H1) (1)

[0302] Among them, η and α are parameters, and the value range of η is [2 5 ,2 10 ], the value of n in this embodiment is 2 5 , the value range of α is [2 1 ,2 8 ], the value of α in this embodiment is 2 1 The meanings and value ranges of other parameters are the same as those in Example 1.

[0303] The Certificate Committee from the q-order integer group Randomly select integer μ and integer ν from the equation, and the value range of μ is [2 8 ,2 128 ], the value of μ in this embodiment is 2 8 , the value range of ν is [2 8 ,2 128 ], the value of ν in this embodiment is 2 8 , define two pairs of message vectors Same as Example 1.

[0304] The Certificate Committee from the q-order integer group Randomly select an integer ω from the range [2 8 ,2 128 ], the value of ω in this embodiment is 2 8 , define the equivalence relationship between the two issuer public keys ipk, ipk′ Same as Example 1.

[0305] (2) Generate the public and private keys of the certificate distributor

[0306] This step is the same as in Example 1.

[0307] (3) Generate user public and private keys

[0308] The user selects n certificate issuer public keys ipk, where n is in the range [2 0 ,2 4 ], the value of n in this embodiment is 2 0 , and select attribute value a for each certificate issuer ij , i represents the serial number of the attribute value, i∈{1,2,...,k}, and the value range of k is [2 1 ,2 4 ], the value of k in this embodiment is 2 1 , j represents the serial number of the public key of the certificate issuer, j∈{1,2,...,n}, and the value of n in this embodiment is 2 0 The other steps of this step are the same as those in Example 1.

[0309] (4) Generate the public and private keys of the certificate verifier

[0310] Each certificate verifier CV is from an integer group of order q Randomly select K positive integers as your private key vsk:

[0311] vsk=(x1,x2,...,x K )

[0312] And generate the public key vpk:

[0313]

[0314] Where K represents the number of certificate distributors that each certificate verifier wants to receive, and K is a finite positive integer, and the value range of K is [2 0 ,2 4 ], in this embodiment, K is set to 2 0 .

[0315] (5) Certificate verifier generates verification strategy

[0316] The certificate verifier CV specifies the K certificate issuer vectors that he is willing to accept

[0317]

[0318] The certificate verifier CV selects l attribute values ​​and gives the attribute value set R:

[0319] R = {a1, a2, ..., a l}

[0320] Where l represents the number of attribute values, l∈[1,K×k], and the value range of l is l∈[1,2 1 ], the value of l in this embodiment is 1; K represents the number of certificate distributors, and k represents the number of attribute values ​​in the attributes distributed by each certificate distributor.

[0321] The other steps of this step are the same as those in Example 1.

[0322] The other steps are the same as those in Example 1. The multi-authority hidden anonymous authentication method based on blockchain is completed.

[0323] Example 3

[0324] The multi-authority hidden anonymous authentication method based on blockchain in this embodiment consists of the following steps:

[0325] (1) System initialization

[0326] The certificate committee sets the security parameter λ for the system, and the value of λ is 1 256 , randomly select two large prime numbers p and q, and q can divide p-1; the value of the large prime number p in this embodiment is 2 521 +887, the value of the large prime number q is 2 521 +2001. Generate q-order multiplicative cyclic groups G1 and G2 using group generation methods, and multiplicative cyclic group G T , the group of integers modulo q Determine the modulus N as follows:

[0327] N=p×q

[0328] Among them, p and q are two large prime numbers that meet security requirements, and q can divide p-1. Select two hash functions and H1:{0,1} * →g2.

[0329] Generate the global parameter pp according to formula (1):

[0330] pp=(q,p,G1,G2,G T ,e,g,g1,g2,η,α,H,H1) (1)

[0331] Among them, η and α are parameters, and the value range of η is [25 ,2 10 ], the value of n in this embodiment is 2 10 , the value range of α is [2 1 ,2 8 ], the value of α in this embodiment is 2 8 The meanings and value ranges of other parameters are the same as those in Example 1.

[0332] The Certificate Committee from the q-order integer group Randomly select integer μ and integer ν from the equation, and the value range of μ is [2 8 ,2 128 ], the value of μ in this embodiment is 2 128 , the value range of ν is [2 8 ,2 128 ], the value of ν in this embodiment is 2 128 , define two pairs of message vectors Same as Example 1.

[0333] The Certificate Committee from the q-order integer group Randomly select an integer ω from the range [2 8 ,2 128 ], the value of ω in this embodiment is 2 128 , define the equivalence relationship between the two issuer public keys ipk, ipk′ Same as Example 1.

[0334] (2) Generate the public and private keys of the certificate distributor

[0335] This step is the same as in Example 1.

[0336] (3) Generate user public and private keys

[0337] The user selects n certificate issuer public keys ipk, where n is in the range [2 0 ,2 4 ], the value of n in this embodiment is 2 4 , and select attribute value a for each certificate issuer ij , i represents the serial number of the attribute value, i∈{1,2,...,k}, and the value range of k is [2 1 ,2 4 ], the value of k in this embodiment is 2 4 , j represents the serial number of the public key of the certificate issuer, j∈{1,2,...,n}, and the value of n in this embodiment is 2 4 The other steps of this step are the same as those in Example 1.

[0338] (4) Generate the public and private keys of the certificate verifier

[0339] Each certificate verifier CV is from an integer group of order q Randomly select K positive integers as your private key vsk:

[0340] vsk=(x1,x2,...,x K )

[0341] And generate the public key vpk:

[0342]

[0343] Where K represents the number of certificate distributors that each certificate verifier wants to receive, and K is a finite positive integer, and the value range of K is [2 0 ,2 4 ], in this embodiment, K is set to 2 4 .

[0344] (5) Certificate verifier generates verification strategy

[0345] The certificate verifier CV specifies the K certificate issuer vectors that he is willing to accept

[0346]

[0347] The certificate verifier CV selects l attribute values ​​and gives the attribute value set R:

[0348] R={a1,a2,...,a l}

[0349] Where l represents the number of attribute values, l∈[1,K×k], and the value range of l is l∈[1,2 8 ], the value of l in this embodiment is 2 8 ; K represents the number of certificate distributors, and k represents the number of attribute values ​​in the attributes distributed by each certificate distributor.

[0350] The other steps of this step are the same as those in Example 1.

[0351] The other steps are the same as those in Example 1. The multi-authority hidden anonymous authentication method based on blockchain is completed.

Claims

1. A multi-authority hidden anonymous authentication method based on blockchain, characterized in that It consists of the following steps: (1) System initialization The certificate committee sets the security parameter λ for the system, and the value of λ is 1 256 , randomly select two large prime numbers p and q, and use the group generation method to generate q-order multiplicative cyclic groups G1 and G2, and the multiplicative cyclic group G T , the group of integers modulo q Determine the modulus N as follows: N=p×q Among them, p and q are two large prime numbers that meet security requirements, and q can divide p-1. Select two hash functions and H1:{0,1} * →G2; Generate the global parameter pp according to formula (1): pp=(q,p,G1,G2,G T ,e,g,g1,g2,h,a,H,H1) (1) Among them, g and g1 are two generators of G1, g2 is a generator of G2, and e is G1×G2→G T A type III bilinear map, η and α are parameters, which are finite positive integers; The Certificate Committee from the integer group of order q Randomly select integer μ and integer ν from the , and define two pairs of message vectors and The equivalence relation as follows: Satisfies the following equation: Among them, M1, M2, M′1, M′2 are elements of the G1 group, and N1, N2, N′1, N′2 are elements of the G2 group; The Certificate Committee from the integer group of order q Randomly select an integer ω from the , and define the equivalence relationship between the two issuer public keys ipk, ipk′ The following equation is satisfied: ipk′=ipk ω Among them, ipk is a vector composed of 5 elements X, Y1, Y2, Z1, Z2 on the G2 group, and ipk′ is a vector composed of 5 elements X′, Y1′, Y2′, Z1′, Z2′ on the G2 group; Define an equivalence relation between two user public keys upk, upk′ The following equation is satisfied: upk'=upk ω Among them, upk is a vector composed of two elements T1 and T2 on the G1 group, and upk′ is a vector composed of two elements T1′ and T2′ on the G1 group; (2) Generate the public and private keys of the certificate distributor Each certificate issuer CI is derived from the q-order integer group Randomly select 5 numbers x, y1, y2, z1, z2 as the certificate issuer private key isk and keep it confidential: isk=(x,y1,y2,z1,z2) The certificate issuer generates the public key ipk as follows: ipk=(X,Y1,Y2,Z1,Z2) in, They represent hiding of the user's private key x, y1, y2, z1, z2 respectively; The certificate issuer publishes the public key ipk as an identifier to the public ledger of the blockchain and publishes the corresponding non-interactive zero-knowledge proof π CI : p CI =ZkPoK{(x,y1,y2,z1,z2);X∧Y1∧Y2∧Z1∧Z2} Among them, ZkPoK is a zero-knowledge proof of knowledge, {(x, y1, y2, z1, z2): X∧Y1∧Y2∧Z1∧Z2}, which means that the certificate issuer has 5 secret values ​​(x, y1, y2, z1, z2) through X∧Y1∧Y2∧Z1∧Z2; (3) Generate user public and private keys The user selects n certificate issuer public keys ipk, where n is a finite integer, and selects an attribute value a for each certificate issuer. ij , j represents the serial number of the attribute value, i∈{1,2,...,k}, k is a finite positive integer, j represents the serial number of the public key of the certificate issuer, j∈{1,2,...,n}, given the attribute value set A j : A j =(a 0j ,a 1j ,...,a kj ) The user is given an attribute key set S: <h2 style=";text-align:left;direction:ltr">S={(A1,ipk1),(A2,ipk2),...,(A<h2 style=";text-align:left;direction:ltr"> n <h2 style=";text-align:left;direction:ltr"> ipk<h2 style=";text-align:left;direction:ltr"> n <h2 style=";text-align:left;direction:ltr"> )} The user is from the q-order integer group Randomly select two numbers ρ1 and ρ2 as your private key usk: usk=(ρ1,ρ2) Among them, ρ1, ρ2 are finite integers; Generate the public key upk as follows: upk=(T1,T2) h=H(aux) Among them, T1 and T2 represent the two components of the user's public key upk, h is the hash value of the auxiliary information, and H is the mapping of any 0 / 1 string to The hash function of , aux represents auxiliary information, Represents attribute set A j The hash value of ||·|| represents the cascade, H′ is the hash function modeled as a random oracle machine, A j is the set of attributes that need to be submitted, and r is a finite positive integer; (4) Generate the public and private keys of the certificate verifier Each certificate verifier CV is from an integer group of order q Randomly select K positive integers as your private key vsk: vsk=(x1,x2,...,x K ) And generate the public key vpk: Where K represents the number of certificate distributors that each certificate verifier wants to receive, and K is a finite positive integer; (5) Certificate verifier generates verification strategy The certificate verifier CV specifies the K certificate issuer vectors that he is willing to accept The certificate verifier CV selects l attribute values ​​and gives the attribute value set R: <h2 style=";text-align:left;direction:ltr">R={a1, a2,..., a<h2 style=";text-align:left;direction:ltr"> l <h2 style=";text-align:left;direction:ltr">} Where l represents the number of attribute values, l∈[1,K×k], K represents the number of certificate distributors, and k represents the number of attribute values ​​in the attributes distributed by each certificate distributor; The certificate verifier CV is from the q-order integer group A random number φ is randomly selected from the set and K issuers are determined The signature of θ is: θ=(Z,B1,B2) Among them, Z, B1, B2 are the intermediate values ​​of the signature; The certificate verifier generates the authentication policy pol: And upload it to the distributed ledger on the blockchain for users to download, by providing the following non-interactive zero-knowledge proof π pol , proving that the authentication policy is correctly formed: π pol [ZkPoK{(x1,x2,...,x K ,φ)vpk∧Z∧B1∧B2} Among them, ZkPoK represents the zero-knowledge proof of knowledge, {(x1,x2,...,x K , φ): vpk∧Z∧B1∧B2} means that vpk∧Z∧B1∧B2 proves that the certificate verifier has K+1 secret values ​​(x1, x2, .., x K , φ); (6) Generate a user certificate request The user sends a request Req to the issuer to generate a user certificate: Among them, f A (α) indicates that the monotone polynomial about set A is calculated using trapdoor α, indicating that set A is a set of attributes selected by the user: A={a1,...,a k } Among them, a j is an element in the set A, j∈[1,k], k is a finite positive integer; The user generates a non-interactive zero-knowledge proof of knowledge π CH : Among them, ZkPoK represents zero-knowledge proof of knowledge. Indicates that Prove that the user has k+2 secret values ​​(ρ1,ρ2,a1,a2,…,a k ); (7) Certificate distributor issues certificate After receiving the certificate request from the user, the certificate distributor instantiates π with zero-knowledge proof of knowledge CH , check whether the zero-knowledge proof is correct. If the zero-knowledge proof is invalid or the attributes do not match the user's background, the certificate distributor will return an error and stop issuing; otherwise, the distributor performs a signing operation and generates a certificate cred: Among them, the signature σ is a commitment to the attribute The signature of , b, s are the intermediate variables of the signature σ; The certificate distributor stores the certificate cred in its local database and returns the certificate cred to the user. The user parses the certificate cred to obtain the signature σ and checks whether the following equation holds: If all three equations above are true, the user stores the certificate cred in its local certificate database; (8) Blockchain authentication anonymous certificate (8.1) User generates anonymous authentication request After finding the appropriate authentication smart contract and downloading the policy pol of the specific certificate verifier from the distributed ledger, the user generates an anonymous authentication request as follows: The user is from the q-order integer group A random number r is randomly selected and the distributor's public key equivalence relation is used. The conversion parameter ω defined in the conversion strategy pol is as follows: and signature θ to obtain the converted certificate distributor public key vector And the corresponding signature θ′: The user aggregates the signatures in the K certificate generator certificates to obtain an aggregated issuer public key αvk and an aggregated attribute signature αvk=(ipk1,ipk2,...,ipk K ) Where h is the hash value of the auxiliary information, is an element of group G1, and is the aggregate attribute signature The intermediate variable of And transform the aggregate attribute signature using the transformation parameter ω Get the converted issuer public key αvk′ and aggregate attribute signature αvk′=αvk ω in, and is the transformed aggregate attribute signature The intermediate variable of The user then uses the equivalence relation of the message vector The two transformation parameters μ and v defined in get the randomized K attribute commitments Among them, j represents the serial number of the attribute commitment, j∈[1,K], K is a finite positive integer, and K attribute commitments are stored in the vector set User-generated pseudonym N ym : N ym =upk μ The user gets the signature corresponding to the new attribute commitment in, and It is a signature The intermediate variable of For satisfaction The attribute set T j , where j∈[1,K], the user determines K pieces of evidence W j : And all the evidence W j Aggregate into a cross-set evidence W: t j =H(j,A j ,T j ) Among them, t j is an intermediate variable of the cross-set evidence W; The user randomizes the cross-set evidence W into a new cross-set evidence W′ using transformation parameters μ and v: W′=W μ×v The user needs to determine K additional evidences Γ that satisfy the strategy pol j : Among them, a i ∈R / T j , a i Represents the attribute value, i∈[1,l], l is a finite positive integer; The user is from the q-order integer group A random positive integer δ is randomly selected in , and the off-chain short-term authentication token Δ is calculated: Δ=g δ The user gets his anonymous authentication request A uth : (8.2) Blockchain-authenticated anonymous certificates The user randomly selects a 128-bit 0 / 1 string as his authentication identifier aid and sends the authentication identifier aid to the authentication request A. uth Sent to the blockchain, the blockchain committee members verify whether the user has the certificate and attribute set required by the certificate verifier according to the following 5 formulas: e(B′1g2)=e(g1,B′2) After successful verification, the blockchain committee stores the short-term off-chain access token Δ in the blockchain and returns a successful authentication indicator to the user; (9) User access to certificate verifier resources By sending a message containing the authentication identifier aid, the current timestamp ts, the short-term off-chain access token Δ, and the non-interactive zero-knowledge proof π Δ After successful authentication, the user can access the corresponding resources: p Δ =ZkPoK{(δ):Δ} Among them, ZkPoK represents zero-knowledge proof of knowledge, and {(δ):Δ} represents the proof that the user owns the secret value δ through a short-term off-chain access token Δ; The verifier receives the request (aid,Δ,π Δ ), check in the blockchain whether the authentication corresponding to the authentication identifier aid is successful, whether the short-term off-chain access token Δ has been stored in the blockchain, and the non-interactive zero-knowledge proof π Δ If all verifications are successful, the off-chain verification request is accepted, and the verifier negotiates the session symmetric key with the user, allowing the user to access resources according to the permissions specified in the verification contract; The verifier also needs to send transactions (aid, ts, des) to the blockchain to record the comprehensive information des of off-chain verification and access resources, where des can be a text description.

2. The multi-authority hidden anonymous authentication method based on blockchain according to claim 1 is characterized in that: In step (1) of system initialization, the certificate committee sets a security parameter λ for the system, and the security parameter λ takes a value of 1. 256 ; The p and q are two large prime numbers that meet the security requirements, and q can divide p-1; the value of the large prime number p is 2 521 +887, the value of the large prime number q is 2 521 +2001; In formula (1), η and α are parameters, and the value range of η is [2 5 ,2 10 ], the value range of α is [2 1 ,2 8 ]; the value range of the integer μ is [2 8 ,2 128 ], the value range of integer v is [2 8 ,2 128 ], the value range of integer ω is [2 8 ,2 128 ].

3. The multi-authority hidden anonymous authentication method based on blockchain according to claim 1 is characterized in that: In step (3) of generating the user's public and private keys, the user selects n certificate issuer public keys ipk, where n is in the range of [2 0 ,2 4 ] and select attribute value a for each certificate issuer ij , i represents the serial number of the attribute value, i∈{1,2,...,k}, and the value range of k is [2 1 ,2 4 ], j represents the serial number of the public key of the certificate issuer, j∈{1,2,...,n}.

4. The multi-authority hidden anonymous authentication method based on blockchain according to claim 1 is characterized in that: In step (4) of generating the certificate verifier public and private keys, each certificate verifier CV is derived from the q-order integer group Randomly select K integers as your private key vsk: vsk=(x1,x2,...,x K ) And generate the public key vpk: Where K represents the number of certificate distributors that each certificate verifier wants to receive, and the value range of K is [2 0 , 2 4 ].

5. The multi-authority hidden anonymous authentication method based on blockchain according to claim 1 is characterized in that: In step (5), the certificate verifier generates a verification strategy. The certificate verifier CV specifies the K certificate issuer vectors that he is willing to accept. The certificate verifier CV selects l attribute values ​​and gives the attribute value set R: <h2 style=";text-align:left;direction:ltr">R={a1, a2,..., a<h2 style=";text-align:left;direction:ltr"> l <h2 style=";text-align:left;direction:ltr">} Where l represents the number of attribute values, l∈[1,K×k], K represents the number of certificate distributors, and k represents the number of attribute values ​​in the attributes distributed by each certificate distributor; the value range of l is l∈[2 0 ,2 8 ].

Images