Distributed digital identity authentication method and system with privacy protection and access control

Abstract

The invention provides a distributed digital identity authentication method and system with privacy protection and access control, and the method comprises a distributed digital identity authentication mechanism based on ciphertext policy attribute-based encryption, a verifiable statement is encrypted and then stored on a block chain, a user does not need to manage the verifiable statement, and the user experience is improved. The possibility that the verifiable declarations are stolen and lost is reduced; according to the method, the verifiable declaration is subjected to hierarchical encryption, fine-grained access control is provided, a verifier allowed by a user can obtain the verifiable declaration with different selection disclosure degrees, and user privacy can be effectively protected; a user is supported to cancel an expired verifiable statement, a flexible access control strategy is formulated, and for the same data encryption sharing scene, compared with a traditional public key encryption algorithm that identity information of a verifier must be known during encryption each time and encryption must be carried out for multiple times when the identity information is sent to multiple verifiers, the access control strategy is more flexible. And the ciphertext strategy attribute-based encryption algorithm only needs to perform encryption once, so that the calculation overhead and the storage overhead are reduced.

Description

Technical Field

[0001] The present invention relates to a distributed digital identity authentication technical solution, belongs to the technical field of blockchain and digital identity management, and particularly relates to a distributed digital identity authentication method and system with privacy protection and access control. Background Art

[0002] A distributed digital identity (DID) is a type of digital identity that is globally unique, highly available, resolvable, and cryptographically verifiable. It is a decentralized identity that is completely owned and controlled by the user.

[0003] Digital identity can be divided into the following four categories according to its development history: centralized identity, alliance identity, user-centric identity and distributed digital identity. Centralized identity is centrally authenticated and managed by a single institution, and there are problems such as single point failure and data dispersion. Alliance identity is managed and controlled by multiple institutions or alliances, and identity information is easily monopolized by oligopolies. User-centric identity does not require alliances. Users share identity information from one service to another through authorization and permission, but there are hidden dangers of identity leakage and deletion by registered and authorized websites, and users do not have full control over their identities. Distributed digital identity uses blockchain technology to give users a global identity unique identification registration that does not rely on any third-party platform. All service providers and message recipients can verify the legitimacy and correctness of the identity. Users can apply for identity authentication information from the certificate issuing organization, independently control and request services, and truly realize the user's absolute control over their own identity.

[0004] Distributed digital identity takes advantage of the technical advantages of blockchain. The management and maintenance of the identity system does not rely on any single operator, but achieves decentralization, transparency, traceability and tamper-proof through multi-node consensus. Through digital signature and encryption technology, autonomous control of digital identity is achieved, allowing users to independently manage and control their own digital identity and selectively present identity information that can be verified by anyone according to their needs.

[0005] At present, the development of distributed digital identity is in its early stages, and some related projects and applications are underway, but there are many technical and implementation challenges. The relatively influential DID standards mainly include the DID standard proposed by W3C and DIF (Decentralized Identity Foundation)'s DID Auth. The more well-known projects that use DID include: Microsoft DID, Sovrin, uPort, Evernym, Civic, ShoCard, etc.

[0006] However, distributed digital identity involves the storage and transmission of personal sensitive information, and has strict requirements for the persistent storage of on-chain data and resource access control. The current solutions do not take into account both privacy protection and security, so the promotion and popularity rates are low. It is urgent to propose a distributed digital identity authentication solution with privacy protection and access control.

[0007] The current mainstream distributed digital identity scheme is a digital identity architecture based on verifiable credentials proposed by the World Wide Web Consortium, including the DID identifier and DID document at the base layer, and the Verifiable Credential (VC) at the application layer. The DID identifier is a globally unique string in a specific format, used to represent the digital identity of an entity. Each DID identifier corresponds to a DID document in a JSON string. The DID document contains public keys, asymmetric encryption authentication methods, authorization information, service endpoints, and information related to the document itself. The verifiable statement contains VC metadata, statement content, and signature information. It is a descriptive statement issued by a DID to endorse certain attributes of another DID, and it is attached with its own digital signature to prove the authenticity of these attributes. It can be considered a digital certificate.

[0008] The workflow of a digital identity architecture based on verifiable credentials is mainly divided into three steps:

[0009] (1) The user applies for a digital identity from an identity provider;

[0010] (2) The identity provider (an entity that owns the user's data and can issue a verifiable claim, such as a bank, school, or government) issues the digital identity to the user in the form of a verifiable claim after completing the identity verification;

[0011] (3) When a user requests a service from a service provider, he or she submits the verifiable statement as a credential and can obtain the service after the verification is passed.

[0012] Verifiable statements and private keys are stored in a user-controlled storage area. For the protection of user privacy, they are usually stored off-chain, and the encrypted hash summary of the verifiable statement is stored on-chain, so that the identity data is always under the control of the end user, thus getting rid of the control of any centralized registration service, identity provider or certificate authority. When a verifiable statement is issued, it can maximize the protection of privacy information according to the verifier's needs for information and make selective disclosures. For example, it can only provide the recognition of the user's identity by a trusted institution, or a "yes" or "no" type of answer, without exposing the user's real information. On the one hand, the verifier verifies the user's DID on the blockchain, and on the other hand, verifies the identity information through the verifiable statement.

[0013] However, in this architecture, users need to save their own verifiable statements or rely on a third-party organization to host their own verifiable statements, which makes the user experience very unfriendly. In addition, the verifiable statement usually records the plain text information of the user's identity. Once lost or leaked, the user will face the risk of privacy leakage. Therefore, it is necessary to study a new distributed digital identity authentication solution that takes into account both privacy protection and security. Summary of the invention

[0014] The purpose of the present invention is to solve the problem that the existing distributed digital identity authentication schemes cannot simultaneously meet the user's needs for ease of use, privacy protection and security of identity authentication, and to propose a distributed digital identity authentication scheme with privacy protection and access control to meet the needs of distributed digital identity system design and implementation.

[0015] The present invention also proposes a distributed digital identity authentication method with privacy protection and access control, which includes:

[0016] Step 1: The user provides the KYC certificate to the DID user agent. After the DID user agent verifies the KYC certificate information, it uses the signature algorithm of the identity chain to generate a public key and a private key for the user.

[0017] Step 2: The DID user agent performs hash calculation on the public key to generate a DID identification field, and then verifies the legitimacy of the DID. After the legitimacy verification is passed, a globally unique DID identification is generated based on the chain ID of the identity chain and the DID identification field and returned to the user; and the authorization record and DID are recorded in the identity chain;

[0018] Step 3: The issuer issues a verifiable statement and sends it to the user. The DID user agent generates a system public key and a system master private key using an attribute-based encryption algorithm during the system initialization phase. The DID user agent generates a private key based on the system public key, the master private key, the verified user attribute set, and random parameters, and distributes it to the user and the verifier.

[0019] Step 4: The user sets an access policy, encrypts the verifiable statement in layers, and sends the obtained first-level ciphertext and second-level ciphertext to the blockchain respectively; the first-level ciphertext is all the information of the verifiable statement, and the second-level ciphertext is the selective disclosure of the verifiable statement;

[0020] Step 5: The user sends a request for service to the verifier. The verifier sends a request to the identity chain to query the user's verifiable statement, decrypts the first-level ciphertext or the second-level ciphertext according to the access policy and the verifier's private key, and obtains decrypted information. The verifier verifies the decrypted information and provides the service to the user after the verification is passed.

[0021] The distributed digital identity authentication method with privacy protection and access control, wherein step 2 comprises:

[0022] The public key is converted into a 58-bit fixed-length string as a field in the DID by performing the following hash calculation on the public key;

[0023] ID=Base 58 (SHA 256 (pubKey)

[0024] Among them, pubKey represents the public key, SHA 256 and Base 58 They are hash functions of different lengths.

[0025] The distributed digital identity authentication method with privacy protection and access control, wherein

[0026] This step 3 includes:

[0027] The DID user agent initializes and generates public parameters. G0 is a multiplicative cyclic group of prime order p, with a generator of g, and defines a bilinear mapping e: G0×G0→G T , randomly select parameters α, a, b∈Z p , h1, ..., h u ∈G0; Generate the master private key MK = {a, α, b}:

[0028] PK = {g, e(g, g) α , e(g, g) b , g a , h1...h u}

[0029] The DID user agent generates a private key K based on the public key, the master private key, the user attribute set and the randomly selected α, and distributes it to the user and the verifier through the following formula;

[0030]

[0031] This step 4 includes:

[0032] The user formulates an access policy and generates a linear key sharing LSSS access structure (M, ρ), where the function ρ represents the position of a given attribute in the matrix M, ρ(i)∈(A1, A2, ..., A U ), A1, A2, ..., A URepresents different attributes, M is a ρ×n matrix, where ρ represents the number of attributes involved in the access policy, and n represents the variables defined by the LSSS conversion method; the matrix M is generated according to the access policy formulated by the user, the rows of M represent different attribute categories, and the columns are variables defined by attribute values; in the initial stage of encryption, the vector For each row in the matrix M, a new parameter λ is calculated i =M i v, randomly select s, c0, r1, r2, ..., r l ∈Z p , respectively calculate the two ciphertext as follows:

[0033]

[0034]

[0035] C′=g s

[0036]

[0037]

[0038]

[0039] The complete ciphertext is as follows:

[0040]

[0041] This step 5 includes:

[0042] Only the verifier who meets the access policy can view the secondary ciphertext and obtain basic transaction information; the verifier matches its attribute set S with the access policy in the ciphertext. If the match fails, the decryption fails and the encrypted information is not disclosed. Otherwise, when the verifier's attribute set S meets the access policy, by setting and I = {i:ρ(i)∈S}, use the Lagrange interpolation polynomial to find the equation ∑ i∈I ω i λ i =s coefficient set {ω i |i∈I};

[0043]

[0044] The secondary encrypted message can be obtained by the following calculation:

[0045]

[0046] Decrypt the first level ciphertext: Use And do the following calculation to get the plaintext.

[0047]

[0048] The distributed digital identity authentication method with privacy protection and access control, wherein when the verifiable statement becomes invalid or needs to be changed, the user formulates a new access policy, encrypts the new verifiable statement information, and sends a transaction to the identity chain.

[0049] The present invention also proposes a distributed digital identity authentication system with privacy protection and access control, which includes:

[0050] Module 1 is used to enable the user to provide KYC certification to the DID user agent. After the DID user agent verifies the KYC certification information, it uses the signature algorithm of the identity chain to generate a public key and a private key for the user;

[0051] Module 2 is used to enable the DID user agent to perform hash calculation on the public key to generate a DID identification field, and then verify the legitimacy of the DID. After the legitimacy verification is passed, a globally unique DID identification is generated based on the chain ID of the identity chain and the DID identification field and returned to the user; and the authorization record and DID are recorded in the identity chain;

[0052] Module 3, used to enable the issuer to issue a verifiable statement and send it to the user. The DID user agent uses the attribute-based encryption algorithm to generate a system public key and a system master private key during the system initialization phase. The DID user agent generates a private key based on the system public key, the master private key, the verified user attribute set and random parameters, and distributes it to the user and the verifier;

[0053] Module 4 is used to enable the user to set an access policy, encrypt the verifiable statement in layers, and send the obtained first-level ciphertext and second-level ciphertext to the blockchain respectively; the first-level ciphertext is all the information of the verifiable statement, and the second-level ciphertext is the selective disclosure of the verifiable statement;

[0054] Module 5 is used to enable the user to send a request for service to the verifier, and the verifier sends a request to the identity chain to query the user's verifiable statement, decrypt the first-level ciphertext or the second-level ciphertext according to the access policy and the verifier's private key to obtain decrypted information. The verifier verifies the decrypted information and provides the service to the user after the verification is passed.

[0055] The distributed digital identity authentication system with privacy protection and access control, wherein the module 2 comprises:

[0056] The public key is converted into a 58-bit fixed-length string as a field in the DID by performing the following hash calculation on the public key;

[0057] ID=Base 58 (SHA 256 (pubKey)

[0058] Among them, pubKey represents the public key, SHA 256 and Base 58 They are hash functions of different lengths.

[0059] The distributed digital identity authentication system with privacy protection and access control, wherein

[0060] This module 3 includes:

[0061] The DID user agent initializes and generates public parameters. G0 is a multiplicative cyclic group of prime order p, with a generator of g, and defines a bilinear mapping e: G0×G0→G T , randomly select parameters α, a, b∈Z p , h1, ..., h u ∈G0; Generate the master private key MK = {a, α, b}:

[0062] PK = {g, e(g, g) α , e(g, g) b , g a , h1...h u}

[0063] The DID user agent generates a private key K based on the public key, the master private key, the user attribute set and the randomly selected α, and distributes it to the user and the verifier through the following formula;

[0064]

[0065] This module 4 includes:

[0066] The user formulates an access policy and generates a linear key sharing LSSS access structure (M, ρ), where the function ρ represents the position of a given attribute in the matrix M, ρ(i)∈(A1, A2, ..., A U ), A1, A2, ..., A U Represents different attributes, M is a ρ×n matrix, where ρ represents the number of attributes involved in the access policy, and n represents the variables defined by the LSSS conversion method; the matrix M is generated according to the access policy formulated by the user, the rows of M represent different attribute categories, and the columns are variables defined by attribute values; in the initial stage of encryption, the vector For each row in the matrix M, a new parameter λ is calculated i =M i v, randomly select s, c0, r1, r2, ..., rl ∈Z p , respectively calculate the two ciphertext as follows:

[0067]

[0068]

[0069] C′=g s

[0070]

[0071]

[0072]

[0073] The complete ciphertext is as follows:

[0074]

[0075] This module 5 includes:

[0076] Only the verifier who meets the access policy can view the secondary ciphertext and obtain basic transaction information; the verifier matches its attribute set S with the access policy in the ciphertext. If the match fails, the decryption fails and the encrypted information is not disclosed. Otherwise, when the verifier's attribute set S meets the access policy, by setting and I = {i: ρ(i)∈S}, use the Lagrange interpolation polynomial to find the equation ∑ i∈I ω i λ i =s coefficient set {ω i |i∈I};

[0077]

[0078] The secondary encrypted message can be obtained by the following calculation:

[0079]

[0080] Decrypt the first level ciphertext: Use And do the following calculation to get the plaintext.

[0081]

[0082] In the distributed digital identity authentication system with privacy protection and access control, when the verifiable statement becomes invalid or needs to be changed, the user formulates a new access policy, encrypts the new verifiable statement information, and sends a transaction to the identity chain.

[0083] The present invention also proposes a storage medium for storing a program for executing any one of the distributed digital identity authentication methods with privacy protection and access control.

[0084] The present invention also proposes a client for use in any distributed digital identity authentication system with privacy protection and access control.

[0085] It can be seen from the above scheme that the advantages of the present invention are:

[0086] The distributed digital identity authentication mechanism based on ciphertext policy attribute-based encryption proposed in this invention combines distributed digital identity with ciphertext policy attribute-based encryption algorithm, starts with storage on the verifiable declaration chain, and sets the corresponding verifiable declaration access control structure based on user public and private keys and attributes to achieve fine-grained verifier access control. Compared with the existing verifiable declaration verification mechanism, this mechanism can significantly improve system security, protect user privacy and improve user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] Figure 1 This is a flow chart of the operation of the DID system of the present invention;

[0088] Figure 2 Diagram of the DID on-chain identity generation method of the present invention;

[0089] Figure 3 A flow chart for registering a distributed digital identity for a user of the present invention;

[0090] Figure 4 This is a flow chart of verifiable assertion access control for the present invention. DETAILED DESCRIPTION

[0091] When the inventor was conducting research on distributed digital identity authentication schemes, he found that existing authentication schemes could not simultaneously meet the user's needs for ease of use, privacy protection, and security in identity authentication. The inventor combined the identity authentication mechanism with the Ciphertext policy attribute based encryption (CP-ABE) algorithm and proposed a distributed digital identity authentication mechanism based on Ciphertext policy attribute based encryption, which satisfies the user's experience while achieving privacy protection and high security for identity authentication. Specifically:

[0092] This scheme proposes a distributed digital identity authentication mechanism based on ciphertext policy attribute-based encryption, which encrypts the verifiable statement and saves it on the blockchain. Users do not need to host the verifiable statement, which reduces the possibility of theft and loss of the verifiable statement and can resist various attacks; the verifiable statement is encrypted in layers, providing fine-grained access control. Verifiers allowed by users will be able to obtain verifiable statements with different levels of disclosure, which can effectively protect user privacy; users are supported to abolish expired verifiable statements and formulate flexible access control policies. For the same data encryption sharing scenario, compared with the traditional public key encryption algorithm, which must know the identity information of the verifier every time it encrypts and must encrypt multiple times when sending to multiple verifiers, the ciphertext policy attribute-based encryption algorithm only needs to perform encryption once, reducing computing and storage overheads, thereby meeting the requirements of distributed digital identity for operating overhead, performance and security.

[0093] In order to make the above features and effects of the present invention more clearly understood, embodiments are given below and described in detail with reference to the accompanying drawings.

[0094] This section takes the specific scenarios of single-user distributed digital identity registration and on-chain resource management and maintenance of a single identity chain, as well as the formulation of n-attribute access control policies as examples, and further explains in detail the specific implementation methods of the present invention in conjunction with the accompanying drawings.

[0095] This section will take the processing flow of user user registering a distributed digital identity, applying for a verifiable statement, encrypting the verifiable statement for access control, applying for a service, and the verifier querying the verifiable statement from the chain and decrypting it as an example, and further explain the present invention in detail in combination with the accompanying drawings and embodiments.

[0096] (1) Registering a distributed digital identity

[0097] Figure 3 This is a flowchart of a user registering a distributed digital identity. The specific steps are as follows:

[0098] Step S1.1, the user provides the first KYC (Know Your Customer) certificate and authorizes the DID user agent to register the digital identity on the chain. KYC certification is a way for financial institutions to authenticate customer identities. The DID user agent uses the user identity to query user information from trusted sources (such as the public security system, citizen information system, etc.) and match it. Some institutions also use biometrics and facial recognition for verification.

[0099] Step S1.2: After the DID user agent verifies the authentication information, it uses the signature algorithm of the identity chain, such as the elliptic curve digital signature algorithm (ECDSA), to generate a public key pubKey and a private key privKey for the user. The public and private keys here are generated by the identity chain for the user, and are used for the user to log in to the identity chain, generate digital signatures, etc., and are not used for the subsequent encryption algorithm.

[0100] Step S1.3, the DID user agent performs hash calculation on the public key to generate the DID identification field, and then verifies its legitimacy, including address legitimacy and uniqueness verification. The address is the user's address on the identity chain generated using the public key. For example, the Ethereum address is a hexadecimal string (40 characters) generated by encrypting the public key with the SHA256 algorithm, taking the last 160 bits and adding the prefix "0x" (42 bits in total). So what is verified here is the user's identity chain address generated using the public key.

[0101] Step S1.4: After the legitimacy verification is passed, a globally unique DID identifier is generated based on the DID project name and chain ID of the identity chain and returned to the user. The DID project name can be represented by the name of the blockchain of the selected blockchain.

[0102] Step S1.5, record the authorization record and DID to the identity chain. The authorization record includes the user's address, the user's DID and a timestamp.

[0103] (2) Verifiable declarative access control

[0104] Figure 4 It is a flow chart of verifiable declarative access control.

[0105] Step S2.1, after the user receives the verifiable statement issued by the issuer, the DID user agent initializes the system and generates the system public key and system master private key using the attribute-based encryption algorithm. It should be noted that the system public key and system master private key are generated by the DID user agent using the attribute-based encryption algorithm, and the public and private keys in the above step 1.2 are generated by the identity chain;

[0106] In step S2.2, the DID user agent generates a private key based on the public key, the master key, the verified user attribute set and the random parameter and distributes it to the user and the verifier. The user attribute set is a matrix, which is a set of attributes defined by the user and is used to screen the corresponding verifier.

[0107] In step S2.3, the user sets the attribute structure, formulates the access policy, and generates an access structure to hierarchically encrypt the verifiable claims according to the ciphertext policy attribute-based encryption algorithm.

[0108] In step S2.4, the encrypted message is sent to the blockchain network in two independent levels, the first level is the full information of the verifiable statement, and the second level is the selective disclosure of the verifiable statement.

[0109] Step S2.5: The user sends a request to the verifier to apply for the service.

[0110] Step S2.6: The verifier that receives the user's request sends a request to the identity chain to query the user's verifiable statement. The verifier that meets the access policy can decrypt the verifiable statement of the corresponding level and obtain basic transaction information. If the verifier is given the second level of decryption, the verifier can only decrypt the second level. Therefore, it is the user who determines the decryption level of the verifier.

[0111] Step S2.7: The verifier verifies the decrypted verifiable statement and provides services to the user if the verification passes.

[0112] The core of the distributed digital identity authentication mechanism based on ciphertext policy attribute-based encryption proposed in the present invention is the authentication architecture and access control encryption algorithm. The design of this mechanism and the analysis of the access control encryption algorithm are the key points that the present invention intends to protect.

[0113] (1) Design of Distributed Digital Identity Authentication Architecture

[0114] The present invention complies with the W3C DID standard. The DID system mainly includes the DID identifier and DID document of the base layer and the verifiable declaration of the application layer.

[0115] The DID system consists of five entities: issuer, user, verifier, DID user agent and identity chain.

[0116] 1. Issuer

[0117] Entities that own user data and can issue verifiable claims, such as official institutions and organizations such as governments, banks, and universities, are identity providers.

[0118] 2. User

[0119] The owner of the original data is actually the individual or organization that owns the data. He is mainly responsible for setting access policies for verifiable claims, distributing keys, and transmitting ciphertext based on attribute encryption.

[0120] 3. Validator

[0121] Applications that need to verify user identities are called identity-relying parties. Verifiers are data requesters that have a partial set of attributes. Only when the attribute set complies with the access policy can they have access to verifiable claims.

[0122] 4. DID User Agent

[0123] A trusted third-party entity is responsible for generating public parameters and user DIDs, and generating system public keys, system master keys, and user attribute private keys for the system.

[0124] 5. Identity Chain

[0125] Maintaining the DID database is mainly responsible for storing DID authorization records, encrypted verifiable statements and users' digital signatures on the chain. Since the blockchain is public, all users can browse and access it, effectively preventing data from being illegally modified and ensuring data security.

[0126] Figure 1 The specific process of obtaining and using identities for the DID system. The user sends a DID registration instruction, and the DID user agent uses the identity chain elliptic curve digital signature algorithm (ECDSA) to generate a public key and a private key for the user. The generated private key is securely stored by the node, and the public key is used as the basis for generating the node's distributed digital identity DID. Since the public key is too long, using it directly as an address will result in unnecessary waste of storage space. Therefore, the following hash calculation is performed on the public key.

[0127] ID=Base 58 (SHA 256 (pubKey))#(1)

[0128] Among them, pubKey represents the public key, SHA 256 and Base 58 There are two hash functions of different lengths. Through two hash operations, the pubKey is converted into a 58-bit fixed-length string as the last field of the DID identifier.

[0129] like Figure 2 As shown in the figure, the DID agency verifies the legitimacy of the identity registration request passed in by the user, including address legitimacy and uniqueness verification. If the legitimacy verification fails, the registration failure result is returned. If it passes, a globally unique DID identifier is generated based on the DID project name and chain ID of the identity chain and returned to the user.

[0130] After the user obtains the DID, he applies for a verifiable statement from the issuer, and the issuer issues a verifiable statement and sends it to the user. Subsequently, the user uses the access control encryption algorithm to perform hierarchical attribute encryption on the verifiable statement, and stores the encrypted verifiable statement and digital signature on the identity chain, saving only the private key. Finally, the user applies for services from the verifier, who decrypts the verifiable statement and verifies it, and provides services to the user after the verification is passed.

[0131] (2) Access Control Encryption Algorithm

[0132] The traditional existing attribute-based encryption algorithm mechanism of the double-layer ciphertext structure is relatively complex. It supports transaction arbitration and ciphertext updates of multiple arbitration nodes when user transactions disagree, and is not suitable for distributed digital identity authentication scenarios. The present invention proposes a lightweight attribute-based encryption algorithm with a double-layer ciphertext structure, which reduces the parameters used to support ciphertext updates and transaction arbitration, and reduces the amount of calculation. The present invention proposes that the user formulates an access policy and generates an access structure of Linear Secret-Sharing Schemes (LSSS) to encrypt the first layer of plaintext and the second layer of plaintext. The first layer of plaintext is verifiable declaration information. The second layer of plaintext is selective disclosure. Only the verifier who meets the access policy can view the second layer of plaintext. Only the user himself or the data accessor specially authorized by the user can obtain the first layer of plaintext. The algorithm can be divided into five stages: system initialization, key generation, DID registration, encryption and decryption.

[0133] 1. System initialization

[0134] The DID user agent initializes the algorithm and generates a series of public parameters. Let G0 be a multiplicative cyclic group of prime order p, with a generator of g, and define a bilinear map e: G0×G0→G T , randomly select parameters α, a, b∈Z p , h1, ..., h u ∈G0. The generated master key (private key) MK = {a, α, b} will be kept secret. The public key is as follows:

[0135] PK = {g, e(g, g) α , e(g, g) b , g a , h1...h u}#(2)

[0136] 2. Key Generation

[0137] The DID user agent performs the following calculation based on the public key, master key, verified user attribute set, and randomly selected α to generate the private key and distribute it to the corresponding user node.

[0138]

[0139] 3. Encryption

[0140] The user formulates an access policy and encrypts the verifiable statement in layers. The first layer is all the information of the verifiable statement, which can only be seen by the user. The second layer is the selective disclosure of the verifiable statement for verification by the verifier. The user formulates an access policy and generates an LSSS access structure, such as (M, ρ), where the function ρ represents the position of a given attribute in the matrix M, ρ(i)∈(A1, A2, ..., A U ). M is a ρ×n matrix, where ρ represents the number of attributes involved in the access policy and n represents the variables defined by the LSSS transformation method. Therefore, the matrix M is generated according to the access policy formulated by the user. The rows of M represent different attribute categories and the columns are variables defined by the attribute values. At the initial stage of encryption, a vector For each row in the matrix, a new parameter λ is calculated i =M i v, randomly select s, c0, r1, r2, ..., r l ∈Z p , the first layer plaintext M1 and the second layer plaintext M2 are calculated according to the following formula to obtain the corresponding ciphertext:

[0141]

[0142]

[0143] C′=g s #(6)

[0144]

[0145]

[0146]

[0147] The complete ciphertext is as follows:

[0148]

[0149] Where C′, C i , D i They are all components of ciphertext and do not have specific names for the convenience of formula writing.

[0150] 4. Decryption

[0151] The user sends the encrypted message to the blockchain network at two independent levels. Only validators who meet the access policy can view the secondary ciphertext and obtain basic transaction information. Transaction information is the transaction information in the block, including the transaction sender, receiver, transaction hash, block number and other information. The transaction information contains the secondary ciphertext.

[0152] Decryption of the secondary ciphertext: First, the verifier matches its attribute set with the access policy in the ciphertext. If the match fails, decryption fails and the encrypted information is not disclosed. The decryption operation will succeed when the verifier's attribute set S meets the access policy. We set and I = {i: ρ(i)∈S}, and then use the Lagrange interpolation polynomial to find the equation ∑ i∈I ω i λ i =s coefficient set {ω i |i∈I}.

[0153]

[0154]

[0155] The secondary encrypted message can be obtained by the following calculation:

[0156]

[0157] Decrypt the first level ciphertext: Use And do the following calculation to get the plaintext.

[0158]

[0159] 5. Revocation

[0160] When a verifiable claim becomes invalid or needs to be changed, the user formulates a new access policy or uses the previous access structure to encrypt the new verifiable claim information and send a transaction to the identity chain. Each time the verifier queries the verifiable claim, it obtains the latest verifiable claim record.

[0161] 6. Algorithm Analysis

[0162] The following analyzes the ciphertext policy attribute-based encryption algorithm adopted by the present invention from the perspectives of data security, algorithm security, privacy protection and operating overhead, and explains its superiority.

[0163] Data security

[0164] The transaction environment in the distributed digital identity requires higher data security, and at the same time, it is relatively difficult to ensure data security. The present invention uses a distributed blockchain in the transaction framework to resist single-point attacks. In addition, the blockchain uses encryption primitives such as ciphertext policy attribute-based encryption, hash calculation, and digital signature to conduct transactions in an anonymous manner, which can ensure the integrity and availability of transaction data. The blockchain not only ensures the security of the data, but also realizes the traceability of the data. Even if the data is wrong, it can be detected and corrected in time. Therefore, the blockchain provides a guarantee for the security of transaction data.

[0165] Algorithm security

[0166] The security of the algorithm of the present invention is the premise of system security. Once the algorithm is attacked by the enemy, the entire system will be in danger. In terms of algorithm security, the cipher policy attribute-based encryption scheme based on the present invention has been proven to be safe from plaintext attacks (Chosen Plaintext Attack, CPA). Therefore, the present invention reduces the possibility of theft and loss of verifiable claims, and can resist multiple attacks, effectively ensuring the security of the system.

[0167] Privacy protection

[0168] The present invention realizes the protection of user privacy throughout the transaction process. The present invention adopts a fine-grained access control scheme based on ciphertext policy attribute-based encryption, which effectively protects privacy information during the transaction process. The two-level ciphertext design ensures that only participants who meet the access policy can view the corresponding verifiable declaration information. In the verifiable declaration verification stage, the user encrypts the second-level verifiable declaration information according to the determined access structure, and the verifier who meets the access structure can view the selectively disclosed verifiable declaration. Only the user himself or the data accessor specially authorized by the user can obtain the first-level, i.e., detailed verifiable declaration information.

[0169] Operational overhead

[0170] The operation overhead of the present invention is mainly reflected in two aspects: one is the computational overhead caused by encryption and decryption, and the other is the communication overhead between the user and other roles in the system.

[0171] In terms of computational overhead, the computational cost of the ciphertext strategy attribute-based encryption algorithm adopted in this scheme increases linearly with the increase in the number of attributes. The specific time overhead of the algorithm includes: the time for exponential calculation and hash calculation in group G0, the time for T Therefore, the decryption algorithm complexity and delay of the verifier in this scheme are higher than the hash comparison method of the original scheme.

[0172] In terms of communication overhead, the operation of this solution only adds the process of DID agent distributing keys, which has little impact.

[0173] In terms of storage overhead, users originally needed to store both private keys and verifiable statements off-chain, and only store the hash value of the verifiable statement on-chain. In this solution, users need to store private keys off-chain and store double-encrypted verifiable statements on-chain.

[0174] In summary, the operating overhead of the present invention is acceptable while ensuring the privacy and security of the system.

[0175] The following is a system embodiment corresponding to the above method embodiment. This embodiment can be implemented in conjunction with the above embodiment. The relevant technical details mentioned in the above embodiment are still valid in this embodiment. In order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the above embodiment.

[0176] The present invention also proposes a distributed digital identity authentication system with privacy protection and access control, which includes:

[0177] Module 1 is used to enable the user to provide KYC certification to the DID user agent. After the DID user agent verifies the KYC certification information, it uses the signature algorithm of the identity chain to generate a public key and a private key for the user;

[0178] Module 2 is used to enable the DID user agent to perform hash calculation on the public key to generate a DID identification field, and then verify the legitimacy of the DID. After the legitimacy verification is passed, a globally unique DID identification is generated based on the chain ID of the identity chain and the DID identification field and returned to the user; and the authorization record and DID are recorded in the identity chain;

[0179] Module 3, used to enable the issuer to issue a verifiable statement and send it to the user. The DID user agent uses the attribute-based encryption algorithm to generate a system public key and a system master private key during the system initialization phase. The DID user agent generates a private key based on the system public key, the master private key, the verified user attribute set and random parameters, and distributes it to the user and the verifier;

[0180] Module 4 is used to enable the user to set an access policy, encrypt the verifiable statement in layers, and send the obtained first-level ciphertext and second-level ciphertext to the blockchain respectively; the first-level ciphertext is all the information of the verifiable statement, and the second-level ciphertext is the selective disclosure of the verifiable statement;

[0181] Module 5 is used to enable the user to send a request for service to the verifier, and the verifier sends a request to the identity chain to query the user's verifiable statement, decrypt the first-level ciphertext or the second-level ciphertext according to the access policy and the verifier's private key to obtain decrypted information. The verifier verifies the decrypted information and provides the service to the user after the verification is passed.

[0182] The distributed digital identity authentication system with privacy protection and access control, wherein the module 2 comprises:

[0183] The public key is converted into a 58-bit fixed-length string as a field in the DID by performing the following hash calculation on the public key;

[0184] ID=Base 58 (SHA 256 (pubKey)

[0185] Among them, pubKey represents the public key, SHA 256 and Base 58 They are hash functions of different lengths.

[0186] The distributed digital identity authentication system with privacy protection and access control, wherein

[0187] This module 3 includes:

[0188] The DID user agent initializes and generates public parameters. G0 is a multiplicative cyclic group of prime order p, with a generator of g, and defines a bilinear mapping e: G0×G0→G T , randomly select parameters α, a, b∈Z p , h1, ..., h u ∈G0; Generate the master private key MK = {a, α, b}:

[0189] PK = {g, e(g, g) α , e(g, g) b , g a , h1...h u}

[0190] The DID user agent generates a private key K based on the public key, the master private key, the user attribute set and the randomly selected α, and distributes it to the user and the verifier through the following formula;

[0191]

[0192] This module 4 includes:

[0193] The user formulates an access policy and generates a linear key sharing LSSS access structure (M, ρ), where the function ρ represents the position of a given attribute in the matrix M, ρ(i)∈(A1, A2, ..., A U ), A1, A2, ..., A U Represents different attributes, M is a ρ×n matrix, where ρ represents the number of attributes involved in the access policy, and n represents the variables defined by the LSSS conversion method; the matrix M is generated according to the access policy formulated by the user, the rows of M represent different attribute categories, and the columns are variables defined by attribute values; in the initial stage of encryption, the vector For each row in the matrix M, a new parameter λ is calculated i =M i v, randomly select s, c0, r1, r2, ..., r l ∈Z p , respectively calculate the two ciphertext as follows:

[0194]

[0195]

[0196] C′=g s

[0197]

[0198]

[0199]

[0200] The complete ciphertext is as follows:

[0201]

[0202] This module 5 includes:

[0203] Only the verifier who meets the access policy can view the secondary ciphertext and obtain basic transaction information; the verifier matches its attribute set S with the access policy in the ciphertext. If the match fails, the decryption fails and the encrypted information is not disclosed. Otherwise, when the verifier's attribute set S meets the access policy, by setting and I = {i: ρ(i)∈S}, and then use the Lagrange interpolation polynomial to find the equation ∑ i∈I ω i λ i =s coefficient set {ω i |i∈I};

[0204]

[0205]

[0206] The secondary encrypted message can be obtained by the following calculation:

[0207]

[0208] Decrypt the first level ciphertext: Use And do the following calculation to get the plaintext.

[0209]

[0210] In the distributed digital identity authentication system with privacy protection and access control, when the verifiable statement becomes invalid or needs to be changed, the user formulates a new access policy, encrypts the new verifiable statement information, and sends a transaction to the identity chain.

[0211] The present invention also proposes a storage medium for storing a program for executing any one of the distributed digital identity authentication methods with privacy protection and access control.

[0212] The present invention also proposes a client, which is used in any distributed digital identity authentication system with privacy protection and access control.

Claims

1. A distributed digital identity authentication method with privacy protection and access control, characterized in that: include: Step 1: The user provides the KYC certificate to the DID user agent. After the DID user agent verifies the KYC certificate information, it uses the signature algorithm of the identity chain to generate a public key and a private key for the user. Step 2: The DID user agent performs hash calculation on the public key to generate a DID identification field, and then verifies the legitimacy of the DID. After the legitimacy verification is passed, a globally unique DID identification is generated based on the chain ID of the identity chain and the DID identification field and returned to the user; and the authorization record and DID are recorded in the identity chain; Step 3: The issuer issues a verifiable statement and sends it to the user. The DID user agent generates a system public key and a system master private key using an attribute-based encryption algorithm during the system initialization phase. The DID user agent generates a private key based on the system public key, the master private key, the verified user attribute set, and random parameters, and distributes it to the user and the verifier. Step 4: The user sets an access policy, encrypts the verifiable statement in layers, and sends the obtained first-level ciphertext and second-level ciphertext to the blockchain respectively; the first-level ciphertext is all the information of the verifiable statement, and the second-level ciphertext is the selective disclosure of the verifiable statement; Step 5: The user sends a request for service to the verifier. The verifier sends a request to the identity chain to query the user's verifiable statement, decrypts the first-level ciphertext or the second-level ciphertext according to the access policy and the verifier's private key, and obtains decrypted information. The verifier verifies the decrypted information and provides the service to the user after the verification is passed.

2. The distributed digital identity authentication method with privacy protection and access control as claimed in claim 1, characterized in that: This step 2 includes: The public key is converted into a 58-bit fixed-length string as a field in the DID by performing the following hash calculation on the public key; ID=Base 58 (SHA 256 (pubKey)) Among them, pubKey represents the public key, SHA 256 and Base 58 They are hash functions of different lengths.

3. The distributed digital identity authentication method with privacy protection and access control as claimed in claim 1, characterized in that: This step 3 includes: The DID user agent initializes and generates public parameters. G0 is a multiplicative cyclic group of prime order p, with a generator of g, and defines a bilinear mapping e: G0×G0→G T , randomly select parameters α, a, b∈Z p , h1, ..., h u ∈G0; Generate the master private key MK = {a, α, b}: PK={g,e(g,g) α ,e(g,g) b ,g a ,h1...h u } The DID user agent generates a private key K based on the public key, the master private key, the user attribute set and the randomly selected α, and distributes it to the user and the verifier through the following formula; This step 4 includes: The user formulates an access policy and generates a linear key sharing LSSS access structure (M, ρ), where the function ρ represents the position of a given attribute in the matrix M, ρ(i)∈(A1, A2, ..., A U ), A1, A2, ..., A U Represents different attributes, M is a ρ×n matrix, where ρ represents the number of attributes involved in the access policy, and n represents the variables defined by the LSSS conversion method; the matrix M is generated according to the access policy formulated by the user, the rows of M represent different attribute categories, and the columns are variables defined by attribute values; in the initial stage of encryption, the vector For each row in the matrix M, a new parameter λ is calculated i =M i v, randomly select s, c0, r1, r2, ..., r l ∈Z p , respectively calculate the two ciphertext as follows: C′=g s The complete ciphertext is as follows: This step 5 includes: Only the verifier who meets the access policy can view the secondary ciphertext and obtain basic transaction information; the verifier matches its attribute set S with the access policy in the ciphertext. If the match fails, the decryption fails and the encrypted information is not disclosed. Otherwise, when the verifier's attribute set S meets the access policy, by setting and I = {i: ρ(i)∈S}, use the Lagrange interpolation polynomial to find the equation ∑ i∈I ω i λ i =s coefficient set {ω i |i∈I}; The secondary encrypted message can be obtained by the following calculation: Decrypt the first level ciphertext: Use And do the following calculation to get the plaintext.

4. The distributed digital identity authentication method with privacy protection and access control as claimed in claim 1, characterized in that: When the verifiable claim becomes invalid or needs to be changed, the user formulates a new access policy, encrypts the new verifiable claim information, and sends a transaction to the identity chain.

5. A distributed digital identity authentication system with privacy protection and access control, characterized in that: include: Module 1 is used to enable the user to provide KYC certification to the DID user agent. After the DID user agent verifies the KYC certification information, it uses the signature algorithm of the identity chain to generate a public key and a private key for the user; Module 2 is used to enable the DID user agent to perform hash calculation on the public key to generate a DID identification field, and then verify the legitimacy of the DID. After the legitimacy verification is passed, a globally unique DID identification is generated based on the chain ID of the identity chain and the DID identification field and returned to the user; and the authorization record and DID are recorded in the identity chain; Module 3, used to enable the issuer to issue a verifiable statement and send it to the user. The DID user agent uses the attribute-based encryption algorithm to generate a system public key and a system master private key during the system initialization phase. The DID user agent generates a private key based on the system public key, the master private key, the verified user attribute set and random parameters, and distributes it to the user and the verifier; Module 4 is used to enable the user to set an access policy, encrypt the verifiable statement in layers, and send the obtained first-level ciphertext and second-level ciphertext to the blockchain respectively; the first-level ciphertext is all the information of the verifiable statement, and the second-level ciphertext is the selective disclosure of the verifiable statement; Module 5 is used to enable the user to send a request for service to the verifier, and the verifier sends a request to the identity chain to query the user's verifiable statement, decrypt the first-level ciphertext or the second-level ciphertext according to the access policy and the verifier's private key to obtain decrypted information. The verifier verifies the decrypted information and provides the service to the user after the verification is passed.

6. The distributed digital identity authentication system with privacy protection and access control as claimed in claim 5, characterized in that: This module 2 includes: The public key is converted into a 58-bit fixed-length string as a field in the DID by performing the following hash calculation on the public key; ID=Base 58 (SHA 256 (pubKey)) Among them, pubKey represents the public key, SHA 256 and Base 58 They are hash functions of different lengths.

7. The distributed digital identity authentication system with privacy protection and access control as claimed in claim 5, characterized in that: This module 3 includes: The DID user agent initializes and generates public parameters. G0 is a multiplicative cyclic group of prime order p, with a generator of g, and defines a bilinear mapping e: G0×G0→G T , randomly select parameters α, a, b∈Z p , h1, ..., h u ∈G0; Generate the master private key MK = {a, α, b}: PK={g,e(g,g) α ,e(g,g) b ,g a ,h1...h u } The DID user agent generates a private key K based on the public key, the master private key, the user attribute set and the randomly selected α, and distributes it to the user and the verifier through the following formula; This module 4 includes: The user formulates an access policy and generates a linear key sharing LSSS access structure (M, ρ), where the function ρ represents the position of a given attribute in the matrix M, ρ(i)∈(A1, A2, ..., A U ), A1, A2, ..., A U Represents different attributes, M is a ρ×n matrix, where ρ represents the number of attributes involved in the access policy, and n represents the variables defined by the LSSS conversion method; the matrix M is generated according to the access policy formulated by the user, the rows of M represent different attribute categories, and the columns are variables defined by attribute values; in the initial stage of encryption, the vector For each row in the matrix M, a new parameter λ is calculated i =M i v, randomly select s, c0, r1, r2, ..., r l ∈Z p , respectively calculate the two ciphertext as follows: C’=g s The complete ciphertext is as follows: This module 5 includes: Only the verifier who meets the access policy can view the secondary ciphertext and obtain basic transaction information; the verifier matches its attribute set S with the access policy in the ciphertext. If the match fails, the decryption fails and the encrypted information is not disclosed. Otherwise, when the verifier's attribute set S meets the access policy, by setting and I = {i: ρ(i)∈S}, use the Lagrange interpolation polynomial to find the equation ∑ i∈I ω i λ i =s coefficient set {ω i |i∈I}; The secondary encrypted message can be obtained by the following calculation: Decrypt the first level ciphertext: Use And do the following calculation to get the plaintext.

8. The distributed digital identity authentication system with privacy protection and access control as claimed in claim 6, characterized in that: When the verifiable claim becomes invalid or needs to be changed, the user formulates a new access policy, encrypts the new verifiable claim information, and sends a transaction to the identity chain.

9. A storage medium for storing a program for executing any one of the distributed digital identity authentication methods with privacy protection and access control as claimed in claims 1 to 4.

10. A client, used in any one of the distributed digital identity authentication systems with privacy protection and access control as claimed in claims 5 to 8.

Images