Privacy protection authentication method for W3C

Abstract

The invention relates to the technical field of privacy protection, in particular to a W3C-oriented privacy protection authentication method. Constructing a privacy protection authentication system oriented to W3C, wherein the privacy protection authentication system comprises a voucher issuer, a voucher holder, a voucher verifier and a block chain; the voucher holder is a party initiating a message request; the voucher issuer serves as an authority and issues a verifiable voucher to the voucher holder; the voucher verifier verifies the verifiable voucher of the voucher holder; the W3C-oriented privacy protection authentication method comprises an initialization stage, a key generation stage, a verifiable certificate generation stage, a verifiable certificate conversion stage and a verifiable expression verification stage. According to the method, the interceptable signature is adopted, the problem that a voucher holder selectively discloses information is flexibly solved, and the problem that a dishonest voucher verifier abuses or leaks sensitive information to any unwanted third party is solved by adopting a specified verifier signature scheme.

Description

Technical Field

[0001] The present invention relates to the technical field of privacy protection, and in particular to a W3C-oriented privacy protection authentication method. Background Art

[0002] The World Wide Web Consortium (W3C) proposed the concept of decentralized identity (DID) based on blockchain. The current DID usage process is mainly for the credential holder to apply for a verifiable credential (VC) from the credential issuer. VC is a descriptive statement issued by a DID to endorse certain attributes of another DID, and is accompanied by its own digital signature to prove the authenticity of these attributes. It can be considered as a digital certificate. The credential holder presents the VC to the credential verifier on a specific occasion. However, in some cases, for the purpose of privacy protection, we do not need to present the complete VC content, but only want to selectively disclose certain attributes, or not disclose any attributes, and only need to present a verifiable presentation (VP). VP contains the content to be selectively disclosed and the signature of the credential holder. The credential verifier receives the VC or VP and verifies its correctness. The current DID usage process does not clearly provide a solution for selective disclosure, and in the process of presenting VC or VP to the credential verifier, there are dishonest credential verifiers who abuse or leak sensitive information to any unwanted third party. In order to solve the problems of selective disclosure of information in the DID usage process and the abuse or leakage of sensitive information to any unwanted third party by dishonest credential verifiers, a new solution is urgently needed to improve the privacy and security issues arising in the DID usage process. Summary of the invention

[0003] To solve the above problems, the present invention provides a privacy protection authentication method for W3C, and constructs a privacy protection authentication system for W3C, which includes a credential issuer, a credential holder, a credential verifier, and a blockchain; the credential holder is the party that initiates the message request; the credential issuer, as an authority, issues a verifiable credential to the credential holder; the credential verifier verifies the verifiable credential of the credential holder;

[0004] Based on the W3C-oriented privacy protection authentication system, the W3C-oriented privacy protection authentication method includes the following steps:

[0005] S1. Initialization phase: randomly select a large prime number p, generate two different multiplication cyclic groups G1 and G2, and the order of G1 and G2 are both p, g1 and g2 are the generators of G1 and G2 respectively; construct a bilinear map e:G1×G2→G T , then generate the hash function Finally, the public parameter cp=(p,G1,G2,G T ,g1,g2,H);

[0006] S2. Key generation phase: Select random numbers x1, x2, x3, and calculate Then construct the public key pk1=(cp,y1) and private key sk1=(cp,x1) of the certificate issuer, the public key pk2=(cp,y2) and private key sk2=(cp,x2) of the certificate holder, and the public key pk3=(cp,y3) and private key sk3=(cp,x3) of the certificate verifier; each public key is stored in a DID document, and the DID documents are uploaded to the blockchain;

[0007] S3. Verifiable credential generation phase: The credential issuer issues a verifiable credential to the credential holder who sends the request message through a message segmentation calculation method;

[0008] S4. Verifiable credential conversion phase: The credential holder sends a verifiable expression to the credential verifier based on the verifiable credential by specifying the verification signature method;

[0009] S5. Verifiable expression verification phase: The credential verifier verifies the verifiable expression.

[0010] Beneficial effects of the present invention:

[0011] The present invention adopts an interceptable signature to flexibly solve the problem of selective disclosure of information by the credential holder. When the credential issuer issues VC, the user attributes are divided into different small blocks, and a random value is added to each small block. Then, the hash value of the small block and the corresponding random value is calculated to generate a Merkle root, which is signed. Then, the user attributes and their corresponding salt values, the Merkle root and their signatures are used to generate a VC and sent to the credential holder. Therefore, the credential holder can selectively disclose the display information to generate a VP when presenting the information. Secondly, the present invention adopts a designated verifier signature scheme to solve the problem of dishonest credential verifiers abusing or leaking sensitive information to any unnecessary third party. When the credential holder presents VC or VP to the credential verifier, the signatures of the credential issuer and the credential holder are converted using the public key of the credential verifier, so that the credential verifier can only use its own private key information to verify the converted signature, and cannot present the converted signature to a third party for verification, thereby ensuring the non-transferability of the credential issuer's signature. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 This is a framework diagram of the privacy protection authentication system for W3C of the present invention;

[0013] Figure 2 A flow chart for generating verifiable credentials of the present invention;

[0014] Figure 3 This is a flow chart of the credential conversion verification of the present invention. DETAILED DESCRIPTION

[0015] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0016] The present invention provides a privacy protection authentication method for W3C, including building a privacy protection authentication system for W3C, which includes a credential issuer, a credential holder, a credential verifier and a blockchain, such as Figure 1 As shown; among which:

[0017] Blockchain is mainly used to store DID identifiers and DID documents. Each entity corresponds to a DID identifier, and the DID document corresponding to the entity can be queried through the DID identifier; the DID document is mainly used to store the public key of the corresponding entity, the DID identifier used to describe the DID document, the DID document creation time, and the DID document update time. In the present invention, the entity refers to the credential holder, credential issuer, and credential verifier.

[0018] The credential issuer is an authority that issues verifiable credentials. The authority can issue verifiable credentials to the credential holder based on the credential holder's application.

[0019] The credential holder is the party that initiates the message request and is also the holder of the verifiable credential; the credential holder can convert the verifiable credential into a verifiable expression by choosing to display some information.

[0020] The credential verifier verifies the verifiable credential sent by the credential holder.

[0021] Based on the W3C-oriented privacy protection authentication system, the W3C-oriented privacy protection authentication method includes the following steps:

[0022] S1. Initialization phase: randomly select a large prime number p, generate two different multiplication cyclic groups G1 and G2, and the order of G1 and G2 are both p, g1 and g2 are the generators of G1 and G2 respectively; construct a bilinear map e:G1×G2→G T , then generate the hash function Finally, the public parameter cp=(p,G1,G2,G T ,g1,g2,H).

[0023] S2. Key generation phase: Select random numbers x1, x2, x3, and calculate Then construct the public key pk1=(cp,y1) and private key sk1=(cp,x1) of the certificate issuer, the public key pk2=(cp,y2) and private key sk2=(cp,x2) of the certificate holder, and the public key pk3=(cp,y3) and private key sk3=(cp,x3) of the certificate verifier; each public key is stored in a DID document, and the DID documents are uploaded to the blockchain.

[0024] S3. Verifiable credential generation phase: The credential issuer issues a verifiable credential to the credential holder who sends the request message through a message splitting calculation method.

[0025] Specifically, Figure 2 As shown, the specific process of step S3 includes:

[0026] S31. The credential holder sends a request message m to the credential issuer.

[0027] S32. The credential issuer divides the request message m into n sub-messages, selects a salt value random number for each sub-message, and uses a cyclic hash value calculation method to obtain the Merkle root root. Specifically, the credential issuer divides the attributes that need to be disclosed and displayed, such as the device ID, device transmission data type, device name, and device manufacturer contained in the message m according to the rules, and n is an even number.

[0028] Specifically, the specific process of obtaining the Merkle root root by using the cyclic hash value calculation method in step S32 includes:

[0029] S321. For each sub-message, randomly select a salt value random number to calculate the hash value as the leaf value, expressed as:

[0030] hash i =H(m i ||Tag i ),i=1,2,...,n

[0031] hash i represents the i-th leaf value, m iIndicates the i-th sub-message, Tag i ∈{H i (seed)} represents the random number of the ith salt value, {H i (seed)} represents a hash chain; all leaf values ​​form the first set {hash1, hash2, ..., hash n};

[0032] S322. Calculate the non-leaf value based on the leaf value, expressed as:

[0033] hash ij =H(hash i ||hash j ),i=1,3,5,7,...,n-1 and j=i+1

[0034] hash ij Indicates that the leaf value is hashed i and leaf value hash j Calculated non-leaf values; all non-leaf values ​​form the second set {hash 12 , hash 34 , …, hash (n-1)n};

[0035] S323. Determine whether there is only one non-leaf value in the second set. If so, use the non-leaf value as the Merkle root; if not, regard all non-leaf values ​​in the second set as leaf values, and re-number them from left to right starting from 1 to form a new first set, and then return to step S322.

[0036] S33. The certificate issuer calculates the hash value h1=H(root) based on the Merkle root, and uses the private key to process the Merkle root to obtain the signature According to the sub-messages m1,…,m n 、Salt value random number Tag1,…,Tag n , Merkle root root, hash value h1 and signature σ1 generate verifiable certificate VC, calculate hash value h2 = (VC), and then use the private key to process the verifiable certificate VC to get the signature The credential issuer sends an authentication message to the credential holder, the authentication message including the signature σ2, the hash value h2 and the verifiable credential VC; i Indicates the i=1, 2, ..., nth sub-message, Tag i Represents the random number of salt value i=1,2,…,n;

[0037] S34. The credential holder receives the authentication message and verifies the signature of the credential issuer, that is, verifies whether e(g1,σ2)=e(y1,h2). If so, the credential holder obtains a verifiable credential. If not, it returns to step S31.

[0038] S4. Verifiable credential conversion phase: The credential holder sends a verifiable expression to the credential verifier based on the verifiable credential by specifying the verification signature method.

[0039] Specifically, Figure 3 As shown, the credential holder sends a verifiable expression to the credential verifier based on the verifiable credential by specifying the verification signature method, including:

[0040] S41. The credential holder uses the public key of the designated credential verifier to calculate the conversion signature δ1=e(y3,σ1) for the signature σ1;

[0041] S42. The credential holder uses the Merkle root root, hash value h1, and sub-message m to be disclosed. i 、Sub-message m i Corresponding salt value random number Tag i And the conversion signature δ1 generates a verifiable expression VP; except for the sub-messages that need to be disclosed, the hash values ​​of the remaining sub-messages calculated according to their corresponding salt value random numbers are directly put into the verifiable expression VP;

[0042] S43. The certificate holder calculates the hash value h3=H(VP) based on the verifiable expression VP and uses the private key to obtain the signature Then the conversion signature δ2=e(y3,σ3) is calculated; the credential holder sends verifiable information to the credential verifier, wherein the verifiable information includes the conversion signature δ2 and the verifiable expression VP.

[0043] S5. Verifiable expression verification phase: The credential verifier verifies the verifiable expression.

[0044] Specifically, the credential verifier verifies the verifiable expression including:

[0045] S51. The credential verifier receives the verifiable information and determines whether it satisfies If yes, then step S52 is executed, otherwise the verification fails and the credential holder is rejected;

[0046] S52. Calculate and restore the Merkle root root2 according to the verifiable expression VP, and calculate the hash value h4=H(root2);

[0047] Similar to step S32, step S52 uses a cyclic hash value calculation method to restore the Merkle root root2, including:

[0048] S521. For the sub-message m contained in the verifiable expression VP that needs to be disclosed i 、Sub-message m i Corresponding salt value random number Tag i Calculate the leaf value hash i , expressed as:

[0049] hash i =H(m i ||Tag i ),i=1,2,...,n

[0050] The hash values ​​corresponding to the remaining sub-messages are regarded as leaf values, and all leaf values ​​form the first set {hash1, hash2, ..., hash n};

[0051] S522. Calculate the non-leaf value based on the leaf value, expressed as:

[0052] hash ij =H(hash i ||hash j ),i=1,3,5,7,...,n-1 and j=i+1

[0053] hash ij Indicates that the leaf value is hashed i and leaf value hash j Calculated non-leaf values; all non-leaf values ​​form the second set {hash 12 , hash 34 , …, hash (n-1)n};

[0054] S523. Determine whether there is only one non-leaf value in the second set. If so, use the non-leaf value as the restored Merkle root root2; if not, regard all non-leaf values ​​in the second set as leaf values, and re-number them from left to right starting from 1 to form a new first set, and then return to step S522.

[0055] S53. Verification Is it true? If so, the verification succeeds; if not, the verification fails.

[0056] In the present invention, unless otherwise clearly stipulated and limited, the terms such as "installation", "setting", "connection", "fixation" and "rotation" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral one; it can be a mechanical connection or an electrical connection; it can be directly connected or indirectly connected through an intermediate medium; it can be the internal connection of two elements or the interaction relationship between two elements. Unless otherwise clearly defined, ordinary technicians in this field can understand the specific meanings of the above terms in the present invention according to the specific circumstances.

[0057] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A privacy protection authentication method for W3C, characterized in that: Construct a privacy protection authentication system for W3C, which includes a credential issuer, a credential holder, a credential verifier, and a blockchain; the credential holder is the party that initiates the message request; the credential issuer, as an authority, issues a verifiable credential to the credential holder; the credential verifier verifies the verifiable credential of the credential holder; Based on the W3C-oriented privacy protection authentication system, the W3C-oriented privacy protection authentication method includes the following steps: S1. Initialization phase: randomly select a large prime number p, generate two different multiplication cyclic groups G1 and G2, and the order of G1 and G2 are both p, g1 and g2 are the generators of G1 and G2 respectively; construct a bilinear map e:G1×G2→G T , then generate the hash function Finally, the public parameter cp=(p,G1,G2,G T ,g1,g2,H); S2. Key generation phase: Select random numbers x1, x2, x3, and calculate Then construct the public key pk1=(cp,y1) and private key sk1=(cp,x1) of the certificate issuer, the public key pk2=(cp,y2) and private key sk2=(cp,x2) of the certificate holder, and the public key pk3=(cp,y3) and private key sk3=(cp,x3) of the certificate verifier; each public key is stored in a DID document, and the DID documents are uploaded to the blockchain; S3. Verifiable credential generation phase: The credential issuer issues a verifiable credential to the credential holder who sends the request message through a message segmentation calculation method; S4. Verifiable credential conversion phase: The credential holder sends a verifiable expression to the credential verifier based on the verifiable credential by specifying the verification signature method; S5. Verifiable expression verification phase: The credential verifier verifies the verifiable expression.

2. According to claim 1, a privacy protection authentication method for W3C, characterized in that: Step S3: The specific process of the credential issuer issuing a verifiable credential to the credential holder who sent the request message through the message segmentation calculation method includes: S31. The credential holder sends a request message m to the credential issuer; S32. The credential issuer divides the request message m into n sub-messages, selects a salt value random number for each sub-message, and uses a cyclic hash value calculation method to obtain the Merkle root root; S33. The certificate issuer calculates the hash value h1=H(root) based on the Merkle root, and uses the private key to process the Merkle root to obtain the signature According to the sub-messages m1,…,m n 、Salt value random number Tag1,…,Tag n ,, Merkle root root, hash value h1 and signature σ1 generate verifiable certificate VC, calculate hash value h2 = (VC), and then use the private key to process the verifiable certificate VC to get the signature The credential issuer sends an authentication message to the credential holder, the authentication message including the signature σ2, the hash value h2 and the verifiable credential VC; i Indicates the i=1, 2, ..., nth sub-message, Tag i Represents the random number of salt value i=1,2,…,n; S34. The credential holder receives the authentication message and verifies whether e(g1,σ2)=e(y1,h2) is satisfied. If so, the credential holder obtains a verifiable credential. If not, it returns to step S31.

3. A W3C-oriented privacy protection authentication method according to claim 2, characterized in that: The specific process of obtaining the Merkle root root by using the cyclic hash value calculation method in step S32 includes: S321. For each sub-message, randomly select a salt value random number to calculate the leaf value, expressed as: hash i =H(m i ||Tag i ),i=1,2,...,n hash i represents the i-th leaf value, m i Indicates the i-th sub-message, Tag i represents the random number of the ith salt value; all leaf values ​​form the first set {hash1, hash2, ..., hash n }; S322. Calculate the non-leaf value based on the leaf value, expressed as: hash ij = H(hash i || hash j ), i = 1, 3, 5, 7, ..., n - 1 and j = i + 1 hash ij Indicates that the leaf value is hashed i and leaf value hash j Calculated non-leaf values; all non-leaf values ​​form the second set {hash 12 , hash 34 , …, hash (n-1)n }; S323. Determine whether there is only one non-leaf value in the second set. If so, use the non-leaf value as the Merkle root; if not, regard all non-leaf values ​​in the second set as leaf values, and re-number them from left to right starting from 1 to form a new first set, and then return to step S322.

4. A W3C-oriented privacy protection authentication method according to claim 2, characterized in that: The credential holder sends a verifiable expression to the credential verifier based on the verifiable credential by specifying the verification signature method, including: S41. The credential holder uses the public key of the designated credential verifier to calculate the conversion signature δ1 = e(y3,σ1) for the signature σ1; S42. The credential holder uses the Merkle root root, hash value h1, and sub-message m to be disclosed. i 、Sub-message m i Corresponding salt value random number Tag i And the conversion signature δ1 generates a verifiable expression VP; S43. The certificate holder calculates the hash value h3=H(VP) based on the verifiable expression VP and uses the private key to obtain the signature Then the conversion signature δ2=e(y3,σ3) is calculated; the credential holder sends verifiable information to the credential verifier, wherein the verifiable information includes the conversion signature δ2 and the verifiable expression VP.

5. A W3C-oriented privacy protection authentication method according to claim 4, characterized in that: The credential verifier verifies the verifiable expression by: S51. The credential verifier receives the verifiable information and determines whether it satisfies If yes, then step S52 is executed, otherwise the verification fails and the credential holder is rejected; S52. Calculate and restore the Merkle root root2 according to the verifiable expression VP, and calculate the hash value h4=H(root2); S53. Verification Is it true? If so, the verification succeeds; if not, the verification fails.

Images