Continuous authentication protocol for keeping privacy of user

Abstract

The invention discloses a continuous authentication protocol for keeping user privacy, the protocol process comprises four stages of a system initialization stage, a certificate registration stage, a legality check stage and a consistency check stage, firstly, a system generates public parameters, and a certificate issuer generates a public and private key pair and an update key; the user and the voucher issuer generate a voucher by using the blind signature; then the user generates and submits a randomized voucher to a network service provider, and the network service provider verifies the legality of the user voucher according to a public key of a voucher issuer and a specific service access condition set of the voucher issuer; and finally, during continuous authentication, through consistency certification generation and consistency certification verification, realizing identity consistency check of the network service provider on the premise of user independence. The protocol of the invention pays more attention to privacy protection of user data at a network service provider.

Description

Technical Field

[0001] The present invention belongs to the technical field of privacy security protection, and specifically relates to a continuous authentication protocol for maintaining user privacy. Background Art

[0002] In recent years, with the rapid development of information technology and the widespread application of online services, continuous authentication (CA) has become increasingly important. Traditional one-time authentication can no longer meet modern security needs because cyber attacks and identity theft incidents occur frequently. Continuous authentication ensures the credibility of user identities throughout the session by monitoring user behavior and environment in real time, which can effectively avoid illegal fraud and unauthorized user access. With the development of Internet of Things and artificial intelligence technologies, the application scenarios of CA are also expanding, making security protection more intelligent and flexible. However, users need to provide a large amount of personal data during the verification process, but lack control over the use of the data, which may cause privacy leakage. In addition, data is easily eavesdropped or intercepted during transmission, further increasing privacy risks. At present, existing solutions for user privacy protection in continuous authentication (CA) mainly focus on designing a key exchange protocol between users and network service providers. A secure communication channel is established between users and network service providers through secure key exchange, thereby preventing user privacy data from being leaked during transmission. However, in existing solutions, user privacy data is always transparent to network service providers. These solutions do not consider that network service providers themselves may be untrustworthy or vulnerable. Untrustworthy network service providers may use the collected user data for privacy mining, or leak user privacy data to third parties without the user's permission; vulnerable network service providers may cause user data to be obtained by attackers due to management defects, and the ultimate losses will still be borne by the users.

[0003] In order to solve these problems, in recent years, the anonymous credential system (ACS) has been applied to identity authentication to protect user privacy, showing great potential. ACS enables users to achieve identity sovereignty and autonomy, allowing them to prove the legitimacy of their identity to network service providers without revealing their personal privacy data and real identity. This mechanism not only enhances the privacy protection of users, but also gives users the right to selectively disclose their own data. Users can decide when and how to share personal information according to specific needs. Compared with the traditional public key infrastructure certificate system, ACS pays more attention to protecting user privacy while maintaining the effectiveness of identity authentication. By using anonymous credentials, users can avoid exposing too much personal information when performing identity authentication, thereby reducing the risk of identity theft or abuse. At present, ACS has been widely used in blockchain identity management systems, which use the decentralized characteristics of blockchain to further enhance the security and transparency of identity management.

[0004] However, relying solely on these ACS is not enough to implement a continuous authentication protocol that maintains user privacy. This is because the goals of ACS and CA conflict: the goal of ACS is to protect user identity privacy, prevent unauthorized access or leakage of personal information, and require anonymity between requests; while CA aims to allow service providers to continuously verify user identities and ensure that the system can verify the legitimacy of user identities throughout the session. In other words, CA needs to check user consistency to establish linkability between user requests to ensure that the requests are from the same user. Therefore, there is a conflict between anonymity in ACS and linkability in CA, which makes it difficult to directly apply ACS to CA, limits the large-scale deployment of continuous authentication protocols that maintain user privacy, and seriously endangers user privacy. Summary of the invention

[0005] The present invention is aimed at the problem of user privacy leakage to the network service provider in the existing continuous authentication protocol, and constructs a continuous authentication protocol based on subset proof and anonymous consistency credentials to maintain user privacy. The protocol process includes four stages: system initialization stage, credential registration stage, legitimacy check stage and consistency check stage. First, the system generates public parameters, and the credential issuer generates public and private key pairs and update keys; the user and the credential issuer generate credentials using blind signatures; then the user generates and submits randomized credentials to the network service provider, and the network service provider verifies the legitimacy of the user credentials based on the public key of the credential issuer and its specific service access condition set; finally, when performing continuous authentication, through consistency proof generation and consistency proof verification, the network service provider based on user autonomy checks the user identity consistency. The protocol of the present invention allows users to disclose only the minimum necessary identity data through subset proof, thereby realizing selective disclosure and proving the legitimacy of the identity. In addition, in order to support fine-grained continuous identity authentication, the consistency proof of the present invention allows anonymous users to prove that different credentials are bound to the same user attribute set, and users have the right to decide whether to send the consistency proof, which pays more attention to the privacy protection of user data at the network service provider.

[0006] In order to achieve the above object, the technical solution adopted by the present invention is: a continuous authentication protocol for maintaining user privacy, the protocol process at least includes the following steps:

[0007] S1, system initialization phase: the system generates public parameters for subsequent protocols, and the certificate issuer generates public and private key pairs and update keys;

[0008] S2, credential registration phase: the user and the credential issuer generate credentials using blind signatures;

[0009] S3, legitimacy check phase: the user generates and submits the randomized credentials obtained in step S2 to the network service provider, and the network service provider verifies the legitimacy of the user credentials based on the public key of the credential issuer and its specific service access condition set;

[0010] S4, consistency check phase: During continuous authentication, the network service provider can check the consistency of the user identity based on user autonomy through consistency proof generation and consistency proof verification.

[0011] As an improvement of the present invention, the step S2 credential registration stage specifically includes the following steps:

[0012] S21, encrypted upload of user identity attribute set: the user encodes and encrypts the user identity attributes through polynomial encoding, polynomial commitment, and commitment encryption in sequence;

[0013] S22, blind signature generation: after receiving the ciphertext from the user in step S21, the credential issuer signs the encrypted data using the credential issuer's private key and returns the signature result to the user;

[0014] S23, user identity certificate generation: the user uses his own decryption key and the public key of the certificate issuer to decrypt the signature result, calculate and obtain the user identity certificate.

[0015] As an improvement of the present invention, after the step S21 is sequentially performed through polynomial encoding, polynomial commitment and commitment encryption, the encrypted ciphertext is:

[0016]

[0017] Among them, y is the encryption key randomly generated by the user, is the random number field, g1 is the agreed group generator, is the encrypted ciphertext;

[0018] In step S22, the blind signature is generated:

[0019]

[0020] in, is the generated blind signature, β is the private key of the certificate issuer;

[0021] The user identity credential obtained in step S23 is: cred = (C, W, σ);

[0022] Among them, C is the polynomial commitment of the set of identity attributes held by the user, W is the necessary evidence for the user to prove the legitimacy to the network service provider, and σ is the signature of the original polynomial commitment.

[0023] As another improvement of the present invention, the legality check phase of step S3 specifically includes the following steps:

[0024] S31, credential randomization: the user randomizes the credential using a locally generated random number and an update key provided by the credential issuer;

[0025] S32, credential legitimacy verification: The network service provider uses the credentials received from the user and the public key provided by the credential issuer to verify the validity of the user's identity; the network service provider uses the local service access requirement set and the credentials provided by the user to verify that they meet the requirements for accessing the target service through subset proof.

[0026] As another improvement of the present invention, in the randomized credential of step S31, the randomized polynomial commitment Randomized signature Evidence after randomization

[0027]

[0028] As another improvement of the present invention, in step S32, the network service provider uses the credentials received from the user to and the public key provided by the certificate issuer Verify the validity of the user identity:

[0029]

[0030] The network service provider uses the local service access requirement set T and the credentials provided by the user Verify that it meets the requirements for accessing the target service through subset proof:

[0031]

[0032] As another improvement of the present invention, the consistency check phase of step S4 specifically includes the following steps:

[0033] S41, consistency proof generation: The user uses public parameters, randomized credentials twice, and the random number generated locally by the user and the challenge from the network service provider to generate an anonymous consistency proof and send it to the network service provider;

[0034] S42, consistency proof verification: After receiving the anonymous consistency proof from the user, the network service provider uses the previous and subsequent credentials, the challenge generated by the network service provider, and the statement generated by the user to verify the validity of the proof.

[0035] As a further improvement of the present invention, the step S41 of generating the consistency proof specifically includes the following steps:

[0036] S411: User generates a random number r e ,r z ,r t ;

[0037] S412: Generate a statement (θ1, θ2) and send the statement to the network service provider:

[0038]

[0039] S413: After receiving the statement (θ1, θ2) from the user, the network service provider generates a random challenge c and sends the challenge c to the user;

[0040] S414: The user receives the challenge c from step S413 and the random number r generated in step S411. e ,rz ,r t , generate a consistency proof (s e ,s z ,s t ) and sent to the network service provider, where:

[0041] s z =r z -cz,s t =r t -ct

[0042] Among them, f i Polynomial encoding f for the user identity attribute set S s The coefficients of (X), ρ is the random number selected by the user when generating the polynomial commitment C;

[0043] f s (X) = ∏ s∈S (Xs) = ∑ i∈[n] f i X i

[0044]

[0045] As a further improvement of the present invention, the consistency proof verification in step S42 is specifically as follows:

[0046]

[0047] Compared with the prior art, the technical advantages and effects of the present invention are as follows: the present invention provides a continuous authentication protocol that maintains user privacy. Compared with the existing methods, the present invention uses subset proof to allow users to reveal only the minimum necessary identity data to prove the legitimacy of their identity, thereby achieving selective disclosure of identity authentication; at the same time, in order to support fine-grained continuous identity authentication, the present invention constructs a new consistency proof that allows anonymous users to prove that different credentials are bound to the same user attribute set, where the user has the right to decide whether to send the consistency proof. Compared with the existing methods that only emphasize the confidentiality protection when transmitting user data in the channel, the present invention places more emphasis on the privacy of user data to the network service provider. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 The present invention is a protocol flow chart of a continuous authentication protocol for maintaining user privacy. DETAILED DESCRIPTION

[0049] The present invention will be further explained below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0050] Example 1

[0051] The present invention discloses a continuous authentication protocol for maintaining user privacy, which involves the following three entities: a credential issuer, a user, and a network service provider. The communication process between the entities is divided into four stages: a system initialization stage, a credential registration stage, a legitimacy check stage, and a consistency check stage. In the initialization stage, the system needs to generate public parameters and a key used by the credential issuer to facilitate the execution of subsequent processes; in the credential registration stage, the user and the credential issuer generate a user identity credential according to a set of user identity attributes held by the user through blind signatures; in the legitimacy check stage, the user and the network service provider implement legitimacy checks on user identities by the network service provider under the premise of maintaining user privacy and anonymity through credential randomization and credential legitimacy verification; in the consistency check stage, the network service provider implements consistency checks on user identities on the premise of user autonomy through consistency proof generation and consistency proof verification.

[0052] A continuous authentication protocol that preserves user privacy, such as Figure 1 As shown, the protocol process specifically includes the following steps:

[0053] Step S1, system initialization stage;

[0054] During the system initialization phase, it is necessary to generate the system's public parameters, including the bilinear mapping group and the reference point system on the group; it is also necessary to generate the credential issuer's public and private key pairs for subsequent signature generation and verification, as well as the credential issuer's update key for user credential randomization.

[0055] Assume that the length of the user's identity attribute set is n. First, we need to choose a bilinear group Reference point system on the group where α is a random number, and in a is a random number. In addition, the public and private key pair of the certificate issuer needs to be generated Used for subsequent signature generation and verification, as well as the certificate issuer's update key upk=h β , used for user credential randomization.

[0056] Step S2, credential registration phase: the user and the credential issuer use blind signatures to generate credentials without exposing the user's identity attribute set.

[0057] S21: Encrypted upload of user identity attribute set. The user needs to encode the identity attribute held into a polynomial commitment. In order to avoid the potential risk of user privacy leakage and identity theft caused by the transparency of the user identity attribute set to the credential issuer, the user needs to use the user's private encryption key to encrypt the polynomial commitment when registering the identity credential. And upload the ciphertext to the credential issuer.

[0058] Assuming that the user's identity attribute set is S, the encoded polynomial and polynomial commitment are:

[0059] f s (X) = ∏ s∈S (Xs) = ∑ i∈[n] f i X i

[0060]

[0061] Where s is each element in the attribute set, and ρ is a random number.

[0062] In order to avoid the potential risk of user privacy leakage and identity theft caused by the transparency of the user's identity attribute set to the credential issuer, the user needs to use the user's private encryption key to encrypt the polynomial commitment when registering the identity credential. The encrypted ciphertext is as follows:

[0063]

[0064] Where y is the encryption key randomly generated by the user. Afterwards, the user uploads the ciphertext to the certificate issuer.

[0065] S22: Blind signature generation. After receiving the ciphertext from the user, the credential issuer signs the encrypted data using the credential issuer's private key and returns the signature result to the user.

[0066] The credential issuer receives the ciphertext from the user After that, the beta encrypted data is signed using the private key of the certificate issuer, and the signature result is returned to the user. The signature is generated as follows:

[0067]

[0068] S23: User identity certificate generation: the user uses his own decryption key and the public key of the certificate issuer to decrypt the signature result, calculate and obtain the user identity certificate.

[0069] The user uses his own decryption key y and the public key of the certificate issuer Decrypt the signature result, calculate and obtain the signature of the original polynomial commitment:

[0070]

[0071] Assume that the set of specific service access conditions for a service on the network service provider is T. Users can generate specific identity credentials for the service to prove That is, the user meets all the access conditions. First, perform polynomial encoding on the elements in S except T and generate evidence W:

[0072]

[0073] Then, get the user credentials:

[0074] cred=(C,W,σ)

[0075] Step S3, legitimacy check phase: the user generates and submits a randomized credential to the network service provider, and the network service provider verifies the legitimacy of the user credential based on the credential issuer's public key and its specific service access condition set.

[0076] S31: Credentials Randomization

[0077] In order to avoid the leakage of user identity due to repeated use of the same identity credential during multiple identity authentications, the user needs to randomize the credential before each legitimacy verification. The user uses the update key upk=h provided by the credential issuer β The credential is randomized with the user's locally generated random number z and public parameter h. The randomized credential includes the randomized polynomial commitment Randomized signature Evidence after randomization

[0078]

[0079] The randomized credentials are then sent to the network service provider.

[0080] S32: Credentials legitimacy verification

[0081] Before providing network services to users, network service providers need to check the validity of user identities and whether they meet specific service access conditions. Network service providers use the credentials received from users and the public key provided by the credential issuer to verify the validity of user identities; in addition, network service providers also need to use the local service access requirement set and the credentials provided by users to verify that they meet the requirements for accessing the target service through subset proof. Only when the credentials provided by users meet both of the above points can they pass the legitimacy verification.

[0082] The network service provider uses the credentials received from the user and the public key provided by the certificate issuer Verify the validity of the user identity:

[0083]

[0084] In addition, the network service provider also needs to use the local service access requirement set T and the credentials provided by the user Verify that it meets the requirements for accessing the target service through subset proof:

[0085]

[0086] Only when the credentials provided by the user meet both of the above points can the legitimacy verification be passed.

[0087] Step S4, consistency check phase: During continuous authentication, the network service provider performs a consistency check on the user identity based on user autonomy through consistency proof generation and consistency proof verification.

[0088] S41: Consistency Proof Generation

[0089] In the continuous authentication protocol, the network service provider needs to verify the identity consistency of the user in real time. Therefore, the user needs to prove that the two randomized credentials are from the same source. Assume that the user's two credentials are cred1 and cred2. Among them, the polynomial commitment contained in cred1 is: The polynomial commitments contained in cred2 are: z, t are the different random numbers used in the two randomizations. The user needs to prove that cred1 and cred2 are generated from the same C without exposing C, z, t.

[0090] First, the user needs to generate a random number r e ,r z ,r t ;

[0091] Then, a statement (θ1, θ2) is generated and sent to the network service provider. The statement is as follows:

[0092]

[0093] Next, after receiving the statement (θ1, θ2) from the user, the network service provider generates a random challenge c and sends the challenge c to the user;

[0094] Finally, the user receives the challenge c and the random number r generated previously. e ,r z ,r t , generate a consistency proof (s e,s z ,s t ) and sent to the network service provider, where:

[0095] s z =r z -c z ,s t =r t -ct

[0096] S42: Consistency Proof Verification

[0097] The network service provider receives an anonymous consistency certificate from the user (s e ,s z ,s t ), the network service provider generates a challenge c and the statement (θ1, θ2) generated by the user to verify the validity of the proof. The verification method is as follows:

[0098]

[0099] If the verification is successful, it means that the two credentials are from the same user.

[0100] In summary, the protocol of the present invention utilizes subset proof to make users reveal only the minimum necessary identity data to prove the legitimacy of their identity, thereby maintaining the privacy of user data from the network service provider and the anonymity of user identity from the network service provider; in view of the problem that the continuous identity authentication protocol needs to check the consistency of user identity and cannot be directly combined with the anonymous credential system, a consistency proof is provided, which allows anonymous users to prove that different credentials are bound to the same user attribute set, thereby achieving consistency check of user identity by the network service provider under the premise of maintaining user privacy.

[0101] It should be noted that the above content only illustrates the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications all fall within the protection scope of the claims of the present invention.

Claims

1. A continuous authentication protocol for maintaining user privacy, characterized in that: The protocol process includes at least the following steps: S1, system initialization phase: the system generates public parameters for subsequent protocols, and the certificate issuer generates public and private key pairs and update keys; S2, credential registration phase: the user and the credential issuer generate credentials using blind signatures; S3, legitimacy check phase: the user generates and submits the randomized credentials obtained in step S2 to the network service provider, and the network service provider verifies the legitimacy of the user credentials based on the public key of the credential issuer and its specific service access condition set; S4, consistency check phase: During continuous authentication, the network service provider can check the consistency of the user identity based on user autonomy through consistency proof generation and consistency proof verification.

2. A continuous authentication protocol for maintaining user privacy as claimed in claim 1, characterized in that: The step S2 credential registration phase specifically includes the following steps: S21, encrypted upload of user identity attribute set: the user encodes and encrypts the user identity attributes through polynomial encoding, polynomial commitment, and commitment encryption in sequence; S22, blind signature generation: after receiving the ciphertext from the user in step S21, the credential issuer signs the encrypted data using the credential issuer's private key and returns the signature result to the user; S23, user identity certificate generation: the user uses his own decryption key and the public key of the certificate issuer to decrypt the signature result, calculate and obtain the user identity certificate.

3. A continuous authentication protocol for maintaining user privacy as claimed in claim 2, characterized in that: After the polynomial encoding, polynomial commitment and commitment encryption are performed in step S21, the encrypted ciphertext is: Among them, y is the encryption key randomly generated by the user, is the random number field, g1 is the agreed group generator, is the encrypted ciphertext; In step S22, the blind signature is generated: in, is the generated blind signature, β is the private key of the certificate issuer; The user identity credential obtained in step S23 is: cred = (C, W, σ); Among them, C is the polynomial commitment of the set of identity attributes held by the user, W is the necessary evidence for the user to prove the legitimacy to the network service provider, and σ is the signature of the original polynomial commitment.

4. A continuous authentication protocol for maintaining user privacy as claimed in claim 1, characterized in that: The legality check phase of step S3 specifically includes the following steps: S31, credential randomization: the user randomizes the credential using a locally generated random number and an update key provided by the credential issuer; S32, credential legitimacy verification: The network service provider uses the credentials received from the user and the public key provided by the credential issuer to verify the validity of the user's identity; the network service provider uses the local service access requirement set and the credentials provided by the user to verify that they meet the requirements for accessing the target service through subset proof.

5. A continuous authentication protocol for maintaining user privacy as claimed in claim 4, characterized in that: In the randomized credential of step S31, the randomized polynomial commitment Randomized signature Evidence after randomization Where z is a random number generated by the user.

6. A continuous authentication protocol for maintaining user privacy as claimed in claim 5, characterized in that: In step S32, the network service provider uses the credentials received from the user to and the public key provided by the certificate issuer Verify the validity of the user identity: Among them, e is the agreed bilinear mapping; The network service provider uses the local service access requirement set T and the credentials provided by the user Verify that it meets the requirements for accessing the target service through subset proof:

7. A continuous authentication protocol for maintaining user privacy according to claim 1, characterized in that: The consistency check phase of step S4 specifically includes the following steps: S41, consistency proof generation: The user uses public parameters, randomized credentials twice, and the random number generated locally by the user and the challenge from the network service provider to generate an anonymous consistency proof and send it to the network service provider; S42, consistency proof verification: After receiving the anonymous consistency proof from the user, the network service provider uses the previous and subsequent credentials, the challenge generated by the network service provider, and the statement generated by the user to verify the validity of the proof.

8. A continuous authentication protocol for maintaining user privacy according to claim 7, characterized in that: The step S41 of generating the consistency proof specifically includes the following steps: S411: User generates a random number r e ,r z ,r t ; S412: Generate a statement (θ1, θ2) and send the statement to the network service provider: in and h are the system common parameters generated in the initialization phase; S413: After receiving the statement (θ1, θ2) from the user, the network service provider generates a random challenge c and sends the challenge c to the user; S414: The user receives the challenge c from step S413 and the random number r generated in step S411. e ,r z ,r t , generate a consistency proof (s e ,s z ,s t ) and sent to the network service provider, where: Among them, f i Polynomial encoding f for the user identity attribute set S s The coefficients of (X), ρ is the random number selected by the user when generating the polynomial commitment C; f s (X)=∏ s∈S (X-s)=∑ i∈[n] f i X i 9. A continuous authentication protocol for maintaining user privacy according to claim 8, characterized in that: The step S42 consistency proof verification is specifically as follows:

Images