A W3C-oriented privacy protection authentication method

Abstract

The present application relates to the technical field of privacy protection, and particularly relates to a W3C-oriented privacy protection authentication method; a W3C-oriented privacy protection authentication system is constructed, which comprises a credential issuer, a credential holder, a credential verifier and a block chain; the credential holder is a party that initiates a message request; the credential issuer acts as an authority and issues a verifiable credential to the credential holder; the credential verifier verifies the verifiable credential of the credential holder; the W3C-oriented privacy protection authentication method comprises an initialization stage, a key generation stage, a verifiable credential generation stage, a verifiable credential conversion stage and a verifiable expression verification stage; the present application adopts an interceptable signature, flexibly solves the problem of selective disclosure of information of the credential holder, and further adopts a designated verifier signature scheme, solves the problem of abuse or leakage of sensitive information by an untrustworthy credential verifier to any unnecessary third party.

Description

Technical Field

[0001] The present invention relates to the field of privacy protection technology, and in particular to a W3C-oriented privacy protection authentication method. Background Art

[0002] The World Wide Web Consortium (W3C) has proposed the concept of blockchain-based Decentralized Identity (DID). The current DID usage process primarily involves a credential holder requesting a Verifiable Credential (VC) from a credential issuer. A VC is a descriptive statement issued by a DID endorsing certain attributes of another DID, accompanied by its own digital signature to verify the authenticity of these attributes. It can be considered a digital certificate. Credential holders present the VC to the credential verifier in specific circumstances. However, in some cases, for privacy reasons, it may not be necessary to present the entire VC. Instead, they may wish to selectively disclose certain attributes, or even none at all, presenting only a Verifiable Presentation (VP). The VP contains the selectively disclosed content and the credential holder's signature. Upon receiving the VC or VP, the credential verifier verifies its correctness. Current DID usage processes lack a clear solution for selective disclosure, and when presenting the VC or VP to the credential verifier, there is a risk that dishonest credential verifiers could misuse or leak sensitive information to unwanted third parties. In order to solve the problems of selective disclosure of information in the DID usage process and the abuse or leakage of sensitive information to any unwanted third party by dishonest credential verifiers, a new solution is urgently needed to improve the privacy and security issues arising in the DID usage process. Summary of the Invention

[0003] To solve the above problems, the present invention provides a W3C-oriented privacy-preserving authentication method and constructs a W3C-oriented privacy-preserving authentication system, which includes a credential issuer, a credential holder, a credential verifier, and a blockchain. The credential holder is the party that initiates the message request. The credential issuer, as an authoritative institution, issues a verifiable credential to the credential holder. The credential verifier verifies the credential holder's verifiable credential.

[0004] Based on the W3C-oriented privacy protection authentication system, the W3C-oriented privacy protection authentication method includes the following steps:

[0005] S1. Initialization phase: a large prime number p is randomly selected, two different multiplicative cyclic groups G1 and G2 are generated, and the orders of G1 and G2 are p, g1 and g2 are the generators of G1 and G2 respectively; a bilinear mapping e: G1 x G2→ G is constructed T Then a hash function H is generated Finally, the public parameter cp=(p, G1, G2, G T ,g1,g2,H) is formed;

[0006] S2. Key generation phase: random numbers x1, x2 and x3 are selected, and Then the public key pk1=(cp, y1) of the credential issuer and the private key sk1=(cp, x1) of the credential holder, the public key pk2=(cp, y2) of the credential holder and the private key sk2=(cp, x2) of the credential verifier, and the public key pk3=(cp, y3) of the credential verifier and the private key sk3=(cp, x3) are constructed;Each public key is stored in a DID document, and the DID document is uploaded to the blockchain;

[0007] S3. Verifiable credential generation phase: the credential issuer issues a verifiable credential to the credential holder sending a request message through a message splitting calculation method;

[0008] S4. Verifiable credential conversion phase: the credential holder sends a verifiable expression to the credential verifier according to the verifiable credential through a specified verification signature method;

[0009] S5. Verifiable expression verification phase: the credential verifier verifies the verifiable expression.

[0010] The beneficial effects of the present application are:

[0011] The present application adopts an interceptable signature, and flexibly solves the problem of selective disclosure of information by the credential holder, divides the user attributes into different small blocks when the credential issuer issues the VC, adds a random value to each small block, then calculates the hash value of the small block and the corresponding random value, generates a Merkle root, and signs it, then generates the VC by sending the user attributes and the corresponding salt value, the Merkle root and its signature to the credential holder. Thus, the credential holder can selectively disclose the display information to generate the VP when presenting the information. Secondly, the present application adopts a specified verifier signature scheme, solves the problem of abuse or leakage of sensitive information by dishonest credential verifiers to any unnecessary third party, and converts the signature of the credential issuer and the credential holder using the public key of the credential verifier when the credential holder presents the VC or VP to the credential verifier. Thus, the credential verifier can only verify the converted signature using its own private key information, and cannot present the converted signature to a third party for verification, thereby ensuring the non-transferability of the signature of the credential issuer. BRIEF DESCRIPTION OF DRAWINGS

[0012] Figure 1 A W3C-oriented privacy protection authentication system framework diagram for the present application;

[0013] Figure 2 A verifiable credential generation flowchart for the present application;

[0014] Figure 3 A credential conversion verification flowchart for the present application. DETAILED DESCRIPTION

[0015] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0016] The present application provides a W3C-oriented privacy protection authentication method, comprising constructing a W3C-oriented privacy protection authentication system, which includes a credential issuer, a credential holder, a credential verifier and a blockchain, as shown in Figure 1 .

[0017] The blockchain is mainly used for storing DID identifiers and DID documents. Each entity corresponds to a DID identifier, and the DID document corresponding to the entity can be queried through the DID identifier. The DID document is mainly used for storing the public key of the corresponding entity, the DID identifier for describing the DID document, the DID document creation time and the DID document update time. In the present application, the entity refers to the credential holder, the credential issuer and the credential verifier.

[0018] The credential issuer is an authority that issues verifiable credentials. The authority can issue verifiable credentials for the credential holder according to the application.

[0019] The credential holder is the party that initiates the message request and also the holder of the verifiable credential. The credential holder can convert the verifiable credential into a verifiable expression by selecting to display part of the information.

[0020] The credential verifier verifies the verifiable credential sent by the credential holder.

[0021] Based on the W3C-oriented privacy protection authentication system, the W3C-oriented privacy protection authentication method comprises the following steps:

[0022] S1. Initialization phase: a large prime number p is randomly selected to generate two different multiplicative cyclic groups G1 and G2, and the orders of G1 and G2 are both p, g1 and g2 are the generators of G1 and G2 respectively; a bilinear mapping e: G1 x G2→ G is constructed T , and then a hash function H is generated Finally, the public parameter cp = (p, G1, G2, G T , g1, g2, H) is formed.

[0023] S2. Key generation phase: random numbers x1, x2, x3 are selected, and Then the public key pk1 = (cp, y1) and the private key sk1 = (cp, x1) of the credential issuer, the public key pk2 = (cp, y2) and the private key sk2 = (cp, x2) of the credential holder, and the public key pk3 = (cp, y3) and the private key sk3 = (cp, x3) of the credential verifier are constructed; each public key is stored in a DID document, and the DID document is uploaded to the blockchain.

[0024] S3. Verifiable credential generation phase: the credential issuer issues a verifiable credential to the credential holder sending a request message through a message segmentation calculation method.

[0025] Specifically, as Figure 2 shown, the specific process of step S3 includes:

[0026] S31. The credential holder sends a request message m to the credential issuer.

[0027] S32. The credential issuer divides the request message m into n sub-messages, selects a salt random number for each sub-message, and obtains the Merkle root using a cyclic hash value calculation method. Specifically, the credential issuer divides the device id, device transmission data type, device name, device manufacturer and other attributes contained in the message m according to the rules, and n is an even number.

[0028] Specifically, the specific process of step S32 for obtaining the Merkle root using the cyclic hash value calculation method includes:

[0029] S321. For each sub-message, a salt random number is randomly selected to calculate a hash value as a leaf value, denoted as:

[0030] hash i = H(m i || Tag i ), i = 1, 2,..., n

[0031] hash i denotes the i-th leaf value, m idenotes the i-th sub-message, Tag i ∈{H i (seed)} denotes the i-th salted random number, {H i (seed)} denotes a hash chain; all leaf values form a first set {hash1, hash2, …, hash n} ;

[0032] S322. Calculate non-leaf values based on leaf values, denoted as:

[0033] hash ij = H(hash i ||hash j ), i = 1, 3, 5, 7, …, n-1 and j = i+1

[0034] hash ij denotes a non-leaf value calculated from leaf value hash i and leaf value hash j ; all non-leaf values form a second set {hash 12 , hash 34 , …, hash (n-1)n} ;

[0035] S323. Determine whether there is only one non-leaf value in the second set, if so, take the non-leaf value as the Merkle root; if not, take all non-leaf values in the second set as leaf values, and from left to right, re-label them from 1 to form a new first set, and then return to step S322.

[0036] S33. The credential issuer calculates a hash value h1 = H(root) based on the Merkle root root, and obtains a signature from the Merkle root root using a private key, generates a verifiable credential VC from the sub-messages m1, …, m n , salted random numbers Tag1, …, Tag n , Merkle root root, hash value h1 and signature σ1, calculates a hash value h2 = (VC), and then obtains a signature from the verifiable credential VC using a private key, and sends an authentication message to the credential holder, wherein the authentication message includes the signature σ2, the hash value h2 and the verifiable credential VC; and m i denotes the i = 1, 2, …, n sub-messages, Tag i denotes the i = 1, 2, …, n salted random numbers;

[0037] S34. The credential holder receives the authentication message and verifies the signature of the credential issuer, that is, verifies whether e(g1,σ2)=e(y1,h2). If so, the credential holder obtains a verifiable credential. If not, it returns to step S31.

[0038] S4. Verifiable credential conversion phase: The credential holder sends a verifiable expression to the credential verifier based on the verifiable credential by specifying the verification signature method.

[0039] Specifically, if Figure 3 As shown, the credential holder sends a verifiable expression to the credential verifier based on the verifiable credential by specifying the verification signature method, including:

[0040] S41. The credential holder uses the public key of the designated credential verifier to calculate the transformed signature δ1 = e(y3,σ1) for the signature σ1;

[0041] S42. The credential holder uses the Merkle root root, hash value h1, and sub-message m to be disclosed. i , sub-message m i Corresponding salt value random number Tag i The verifiable expression VP is generated by combining the converted signature δ1. Except for the sub-messages that need to be disclosed, the hash values ​​of the remaining sub-messages calculated based on their corresponding salt values ​​and random numbers are directly put into the verifiable expression VP.

[0042] S43. The certificate holder calculates the hash value h3=H(VP) based on the verifiable expression VP and uses the private key to obtain the signature Then the conversion signature δ2=e(y3,σ3) is calculated; the credential holder sends verifiable information to the credential verifier, where the verifiable information includes the conversion signature δ2 and the verifiable expression VP.

[0043] S5. Verifiable expression verification phase: The credential verifier verifies the verifiable expression.

[0044] Specifically, the credential verifier verifies the verifiable expression including:

[0045] S51. The credential verifier receives the verifiable information and determines whether it satisfies If so, step S52 is executed, otherwise the verification fails and the credential holder is rejected;

[0046] S52. Restore the Merkle root root2 based on the verifiable expression VP and calculate the hash value h4=H(root2);

[0047] Similar to step S32, step S52 uses a cyclic hash value calculation method to restore the Merkle root root2, including:

[0048] S521. For the sub-messages m contained in the verifiable expression VP that need to be disclosed i , the sub-message m i corresponding salt value random number Tag i Calculate the leaf value hash i , denoted as:

[0049] hash i = H (m i ||Tag i ), i = 1, 2,..., n

[0050] Take the hash values corresponding to the remaining sub-messages as leaf values, and all leaf values form a first set {hash1, hash2,..., hash n};

[0051] S522. Calculate the non-leaf value based on the leaf value, denoted as:

[0052] hash ij = H (hash i ||hash j ), i = 1, 3, 5, 7,..., n-1 and j = i+1

[0053] hash ij denotes the non-leaf value calculated according to the leaf value hash i and the leaf value hash j ; all non-leaf values form a second set {hash 12 , hash 34 ,..., hash (n-1)n};

[0054] S523. Determine whether there is only one non-leaf value in the second set, if so, take the non-leaf value as the restored Merkle root root2; if not, take all non-leaf values in the second set as leaf values, and form a new first set from left to right and start from 1 again, then return to step S522.

[0055] S53. Verify , if yes, the verification is successful, if not, the verification fails.

[0056] In the present application, unless otherwise explicitly specified and limited, the terms "mounting", "setting", "connecting", "fixing", "rotating" and other terms should be understood in a broad sense, for example, can be fixedly connected, or can be detachably connected, or can be integrated; can be mechanically connected, or can be electrically connected; can be directly connected, or can be indirectly connected through an intermediate medium, can be the internal communication of two elements or the interaction relationship between two elements, unless otherwise explicitly limited, the above-mentioned terms in the present application can be understood according to the specific meaning of the above-mentioned terms in the present application by the person skilled in the art.

[0057] Although the embodiments of the present application have been shown and described, it can be understood by those skilled in the art that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and spirits of the present application, the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A W3C-oriented privacy protection authentication method, characterized by, A W3C-oriented privacy protection authentication system is constructed, which comprises a credential issuer, a credential holder, a credential verifier and a blockchain; the credential holder is a party initiating a message request; the credential issuer acts as an authority and issues a verifiable credential to the credential holder; the credential verifier verifies the verifiable credential of the credential holder; Based on the W3C-oriented privacy protection authentication system, the W3C-oriented privacy protection authentication method comprises the following steps: S1. Initialization phase: randomly select a large prime number p, generate two different multiplication cyclic groups G1 and G2, and the order of G1 and G2 are both p, g1 and g2 are the generators of G1 and G2 respectively; construct a bilinear map e:G1×G2→G T , then generate the hash function H, and finally form the public parameter cp=(p,G1,G2,G T ,g1,g2,H); S2. Key generation phase: select random numbers x1, x2, x3, calculate Then construct the public key pk1 = (cp, y1) and the private key sk1 = (cp, x1) of the credential issuer, the public key pk2 = (cp, y2) and the private key sk2 = (cp, x2) of the credential holder, and the public key pk3 = (cp, y3) and the private key sk3 = (cp, x3) of the credential verifier; each public key is stored in a DID document, and the DID document is uploaded to the blockchain; S3. A verifiable credential generation phase: the credential issuer issues a verifiable credential to the credential holder sending a request message through a message segmentation calculation method; The specific process of step S3 comprises: S31. The credential holder sends a request message m to the credential issuer; S32. The credential issuer divides the request message m into n sub-messages, selects a salt random number for each sub-message, and obtains a Merkle root by using a cyclic hash value calculation method; S33. The credential issuer calculates a hash value h1=H(root) according to the Merkle root root, and processes the Merkle root root with a private key to obtain a signature According to the sub-messages m1,…,m n , salt value random numbers Tag1,…,Tag n , the Merkle root root, the hash value h1, and the signature σ1, a verifiable credential VC is generated, a hash value h2=H(VC) is calculated, and then the verifiable credential VC is processed with a private key to obtain a signature The credential issuer sends an authentication message to the credential holder, and the authentication message includes the signature σ2, the hash value h2, and the verifiable credential VC; wherein m i represents the i-th=1, 2,…, n sub-message, Tag i represents the i-th=1, 2,…, n salt value random number; S34. The credential holder receives an authentication message and verifies whether e(g1,σ2)=e(y1,h2) is satisfied, if yes, the credential holder obtains a verifiable credential, if not, returns to step S31; S4. A verifiable credential conversion phase: the credential holder sends a verifiable expression to the credential verifier according to the verifiable credential through a specified verification signature method; step S4 specifically comprises: S41. The credential holder calculates a conversion signature δ1=e(y3,σ1) on the signature σ1 by using the public key of the specified credential verifier; S42. The credential holder uses the Merkle root root, hash value h1, and sub-message m to be disclosed. i , sub-message m i Corresponding salt value random number Tag i and transform signature δ1 to generate a verifiable expression VP; S43. The credential holder computes a hash value h3=H(VP) according to the verifiable expression VP, and processes with the private key to obtain a signature A conversion signature δ2 = e(y3, σ3) is then computed; the credential holder sends verifiable information to the credential verifier, the verifiable information including the conversion signature δ2 and the verifiable expression VP; S5. A verifiable expression verification phase: the credential verifier verifies the verifiable expression; Step S5 specifically comprises: S51. The credential verifier receives the verifiable information and determines whether the verifiable information satisfies If so, step S52 is performed, otherwise the verification fails and the credential holder is rejected; S52. Calculate a restored Merkle root root2 according to the verifiable expression VP, and calculate a hash value h4=H(root2); S53. Verify whether the condition is true, and if so, the verification is successful, and if not, the verification fails.

2. The W3C-oriented privacy protection authentication method according to claim 1, characterized in that, The specific process of step S32 for obtaining a Merkle root root by using a cyclic hash value calculation method comprises: S321. For each sub-message, a salt random number is randomly selected to calculate a leaf value, denoted as: hash i = H(m i || Tag i ), i = 1, 2,..., n hash i represents the i-th leaf value, m i represents the i-th child message, Tag i represents the i-th salt value random number; all leaf values form a first set {hash1, hash2,..., hash n} S322. Calculate a non-leaf value based on the leaf value, denoted as: hash ij = H(hash i || hash j ), i = 1, 3, 5, 7,..., n - 1 and j = i + 1 hash ij represents a leaf value hash i and a leaf value hash j non-leaf values are calculated; all non-leaf values form a second set {hash 12 , hash 34 ,..., hash (n-1)n} S323. Determine whether there is only one non-leaf value in the second set, if yes, take the non-leaf value as the Merkle root; if not, take all non-leaf values in the second set as leaf values, and form a new first set from left to right and start from 1 in turn, and then return to step S322.

Images