Distributed digital identity authentication method and system with privacy protection and access control

Abstract

The application provides a distributed digital identity authentication method and system with privacy protection and access control, comprising a distributed digital identity authentication mechanism based on ciphertext policy attribute-based encryption, wherein the verifiable statement is encrypted and saved on a block chain, and a user does not need to host the verifiable statement, thereby reducing the possibility of theft and loss of the verifiable statement; the verifiable statement is hierarchically encrypted, thereby providing fine-grained access control, and a verifier allowed by the user can obtain the verifiable statement with different selected disclosure levels, thereby effectively protecting the privacy of the user; the user can discard expired verifiable statements, and a flexible access control strategy is formulated; for the same data encryption sharing scene, compared with a traditional public key encryption algorithm, which must know the identity information of a verifier each time of encryption and must be encrypted multiple times when being sent to multiple verifiers, the ciphertext policy attribute-based encryption algorithm only needs to be encrypted once, thereby reducing the calculation overhead and storage overhead.

Description

TECHNICAL FIELD

[0001] The present application relates to a distributed digital identity authentication technical solution, belonging to the technical field of blockchain and digital identity management, and particularly relates to a distributed digital identity authentication method and system with privacy protection and access control. BACKGROUND

[0002] A distributed digital identity (Decentralized Identifier, DID) is a kind of digital identity, which is globally unique, highly available, resolvable and cryptographically verifiable, and is a completely decentralized identity owned and controlled by the user.

[0003] Digital identity can be divided into the following four categories according to the development history: centralized identity, alliance identity, user-centered identity and distributed digital identity. The centralized identity is centrally authenticated and managed by a single organization, which has the problems of single point failure, data dispersion, etc. The alliance identity is managed and controlled by multiple organizations or alliances, and the identity information is easy to be monopolized by oligarchs. The user-centered identity does not need an alliance, and the user shares identity information from one service to another service through authorization and permission, but there is a risk of identity leakage and deletion by the registered and authorized website, and the user does not have complete control over the identity. The distributed digital identity uses blockchain technology to give the user a globally unique identity registration that does not depend on any third-party platform. All service providers and message recipients can verify the legitimacy and correctness of the identity, and the user can apply for identity authentication information from the certificate issuing organization, and independently control and request services, thus truly realizing the absolute control of the user over his own identity.

[0004] The distributed digital identity uses the technical advantages of blockchain, and the management and maintenance of the identity system do not depend on any single operator, but through multi-node consensus to realize decentralization, transparency, traceability and tamper resistance. Through digital signature and encryption technology, the user can independently manage and control his own digital identity, and selectively present any identity proof information that can be verified by anyone according to the needs.

[0005] At present, the development of distributed digital identity is in its infancy, and there are some related projects and applications in progress, but there are many technical and implementation challenges. The relatively influential DID standards mainly include the DID standard proposed by W3C and the DID Auth of DIF (Decentralized Identity Foundation). The well-known DID projects include MicrosoftDID, Sovrin, uPort, Evernym, Civic, ShoCard, etc.

[0006] However, distributed digital identity involves the storage and transmission of personal sensitive information, and has strict requirements for the persistent storage of on-chain data and resource access control. The current solution does not take into account privacy protection and security, so its promotion and popularization rate is low, and an urgent need exists for a distributed digital identity authentication scheme with privacy protection and access control.

[0007] The current mainstream distributed digital identity scheme is the verifiable credential-based digital identity architecture proposed by the World Wide Web Consortium, which includes the DID identifier, DID document in the basic layer, and verifiable declaration (VC) in the application layer. The DID identifier is a globally unique string in a specific format, which represents the digital identity of an entity. Each DID identifier corresponds to a DID document in JSON format. The DID document contains public keys, asymmetric encryption authentication methods, authorization information, service endpoints, and document-related information. The verifiable declaration contains VC metadata, declaration content, and signature information, and is a descriptive declaration issued by a DID to endorse certain attributes of another DID, with its own digital signature to prove the authenticity of these attributes. It can be considered as a kind of digital certificate.

[0008] The workflow of the verifiable credential-based digital identity architecture mainly consists of three steps:

[0009] (1) The user applies for a digital identity to an identity provider;

[0010] (2) The identity provider (an entity that has user data and can issue verifiable declarations, such as banks, schools, and governments) issues a digital identity to the user in the form of a verifiable declaration after completing identity verification;

[0011] (3) The user submits the verifiable declaration as a credential to the service provider when requesting services, and can obtain the services after verification.

[0012] The verifiable declaration and private key are stored in a user-controlled storage area, and are usually stored off-chain for the protection of user privacy. The encrypted hash digest of the verifiable declaration is stored on-chain, so that the identity data is always under the control of the end user, thus freeing them from the control of any centralized registration service, identity provider, or certificate authority. When issuing a verifiable declaration, the verifier can protect the privacy of the information by selectively disclosing it, such as providing only the trusted institution's recognition of the user's identity or "yes" or "no" type answers without exposing the user's real information. The verifier verifies the user's DID on the blockchain and verifies the identity information through the verifiable declaration.

[0013] But in this architecture, users need to save or entrust their verifiable claims to a third party, which makes the user experience not very friendly. And the verifiable claims usually record the plaintext information of the user's identity, once lost or leaked, the user will face the risk of privacy leakage. Therefore, new distributed digital identity authentication schemes need to be studied, taking into account privacy protection and security. SUMMARY

[0014] The purpose of the present application is to solve the problem that the existing distributed digital identity authentication scheme cannot meet the user's demand for identity authentication ease of use, privacy protection and security, and to propose a distributed digital identity authentication scheme with privacy protection and access control to meet the needs of distributed digital identity system design and implementation.

[0015] The present application also proposes a distributed digital identity authentication method with privacy protection and access control, which comprises:

[0016] Step 1, the user provides KYC proof information to the DID user agent, and the DID user agent verifies the KYC proof information, and generates a public key and a private key for the user using the signature algorithm of the identity chain;

[0017] Step 2, the DID user agent performs hash calculation on the public key to generate a DID identification field, and then performs legality verification, and after the legality verification is passed, generates a globally unique DID identification according to the chain ID of the identity chain and the DID identification field and returns it to the user; and records the authorization and DID to the identity chain;

[0018] Step 3, the certifier issues a verifiable claim and sends it to the user, and the DID user agent generates a system public key and a system master private key using an attribute-based encryption algorithm in the system initialization stage, and the DID user agent generates a private key based on the system public key, the master private key, the verified user attribute set and the random parameter, and distributes it to the user and the verifier;

[0019] Step 4, the user sets the access strategy, encrypts the verifiable claim in layers, and sends the obtained first-level ciphertext and second-level ciphertext to the blockchain; the first-level ciphertext is the entire information of the verifiable claim, and the second-level ciphertext is the selective disclosure of the verifiable claim;

[0020] Step 5, the user sends a request for service to the verifier, and the verifier sends a request to the identity chain to query the user's verifiable claim, decrypts the first-level ciphertext or the second-level ciphertext according to the access strategy and the verifier's private key, obtains the decryption information, and the verifier verifies the decryption information, and provides the service to the user after the verification is passed.

[0021] The distributed digital identity authentication method with privacy protection and access control, wherein the step 2 comprises:

[0022] The public key is converted into a 58-bit fixed-length string by the following hash calculation, which is a field in the DID identifier;

[0023]

[0024] Wherein, represents the public key, and are hash functions of different lengths.

[0025] The distributed digital identity authentication method with privacy protection and access control, wherein

[0026] The step 3 comprises:

[0027] The DID user agent initializes and generates public parameters, is a multiplicative cyclic group of prime order , the generator is , the bilinear mapping is defined as , the random selection parameter ; generate the master private key ;

[0028]

[0029] The DID user agent generates the private key K based on the public key, the master private key, the user attribute set and the random selection , and distributes it to the user and the verifier by the following formula;

[0030]

[0031] The step 4 comprises:

[0032] The user formulates an access policy and generates a linear key sharing LSSS access structure , wherein the function represents the position of a given attribute in the matrix M, (i) , represent different attributes, and M is a matrix, wherein represents the number of attributes involved in the access policy, and n represents the variable defined by the LSSS conversion method; generate the matrix M according to the access policy formulated by the user, the rows of M represent different attribute categories, and the columns are variables defined by attribute values; in the initial stage of encryption, the vector ; for each row in matrix M, compute a new parameter , randomly select , respectively compute two ciphertexts As follows:

[0033]

[0034]

[0035]

[0036]

[0037]

[0038]

[0039] The complete ciphertext is shown as follows:

[0040]

[0041] This step 5 includes:

[0042] Only the verifier who meets the access policy can view the secondary ciphertext and obtain the basic transaction information; the verifier sets its attribute set Match the access policy in the ciphertext, if the match fails, the decryption fails, the encrypted information is not disclosed, otherwise when the attribute set of the verifier Complies with the access policy, by setting And , use the Lagrange interpolation polynomial to find the coefficient set That satisfies the equation ;

[0043]

[0044]

[0045]

[0046]

[0047] The secondary encrypted message can be obtained by the following calculation:

[0048]

[0049] Decrypt the first-level ciphertext: use , and make the following calculation to obtain the plaintext.

[0050]

[0051] The distributed digital identity authentication method with privacy protection and access control, wherein when the verifiable claim is invalid or needs to be changed, the user formulates a new access strategy, encrypts new verifiable claim information, and sends a transaction to the identity chain.

[0052] The application further provides a distributed digital identity authentication system with privacy protection and access control, comprising the following modules.

[0053] Module 1 is configured to enable a user to provide KYC proof information to a DID user agent, and the DID user agent generates a public key and a private key for the user by using a signature algorithm of an identity chain after verifying the KYC proof information.

[0054] Module 2 is configured to enable the DID user agent to perform hash calculation on the public key to generate a DID identification field, and then perform legality verification on the DID identification field, and generate a globally unique DID identification according to a chain ID of the identity chain and the DID identification field and return the globally unique DID identification to the user after the legality verification is passed, and record authorization records and DID records to the identity chain.

[0055] Module 3 is configured to enable an issuing party to issue a verifiable claim and send the verifiable claim to the user, and the DID user agent generates a system public key and a system master private key by using an attribute-based encryption algorithm in a system initialization stage, and generates a private key based on the system public key, the master private key, a verified user attribute set and a random parameter and distributes the private key to the user and a verifier.

[0056] Module 4 is configured to enable the user to set an access strategy, encrypt the verifiable claim in a hierarchical manner, and send a first-level ciphertext and a second-level ciphertext obtained to a blockchain, wherein the first-level ciphertext is all information of the verifiable claim, and the second-level ciphertext is selective disclosure of the verifiable claim.

[0057] Module 5 is configured to enable the user to send a request for applying for a service to the verifier, and the verifier sends a request to the identity chain to query the verifiable claim of the user, decrypts the first-level ciphertext or the second-level ciphertext according to the access strategy and a private key of the verifier to obtain decryption information, and provides the service for the user after the verifier verifies the decryption information.

[0058] The distributed digital identity authentication system with privacy protection and access control, wherein the module 2 comprises:

[0059] The public key is converted into a 58-bit fixed-length string by the following hash calculation, and the 58-bit fixed-length string is used as a field in the DID identification.

[0060]

[0061] In the application, the following are used: representative public key, and are hash functions of different lengths, respectively.

[0062] The distributed digital identity authentication system with privacy protection and access control, wherein

[0063] The module 3 comprises:

[0064] The DID user agent initializes and generates public parameters, is a multiplicative cyclic group of prime order , the generator is , the bilinear mapping is defined as , the parameter is randomly selected; the master private key is generated;

[0065]

[0066] The DID user agent generates a private key K based on the public key, the master private key, the set of user attributes, and the randomly selected , and distributes it to the user and the verifier through the following formula:

[0067]

[0068] The module 4 comprises:

[0069] The user formulates an access policy and generates a linear key sharing LSSS access structure , wherein the function represents the position of a given attribute in the matrix M, (i) , represent different attributes, and M is a matrix, wherein represents the number of attributes involved in the access policy, and n represents a variable defined by the LSSS conversion method; the matrix M is generated according to the access policy formulated by the user, the rows of M represent different attribute categories, and the columns are variables defined by attribute values; in the initial stage of encryption, a vector is randomly selected; for each row in the matrix M, a new parameter is calculated, is randomly selected, and two ciphertexts are respectively calculated as follows:

[0070]

[0071]

[0072]

[0073]

[0074]

[0075]

[0076] The complete ciphertext is as follows:

[0077]

[0078] The module 5 comprises:

[0079] Only the verifier satisfying the access policy can view the secondary ciphertext and obtain the basic transaction information; the verifier sets its attribute set Match the access policy in the ciphertext, if the match fails, the decryption fails, the encrypted information is not disclosed, otherwise when the attribute set of the verifier Complies with the access policy, by setting And , the Lagrange interpolation polynomial is used to find the coefficient set That satisfies the equation ;

[0080]

[0081]

[0082]

[0083]

[0084] The secondary encrypted message can be obtained by the following calculation:

[0085]

[0086] Decrypt the first-level ciphertext: use , and make the following calculation to obtain the plaintext.

[0087]

[0088] The distributed digital identity authentication system with privacy protection and access control, wherein when the verifiable statement is invalid or needs to be changed, the user formulates a new access policy to encrypt new verifiable statement information, and sends a transaction to the identity chain.

[0089] The application further provides a storage medium for storing a program for executing any one of the distributed digital identity authentication methods with privacy protection and access control.

[0090] The application further provides a client for any one of the distributed digital identity authentication systems with privacy protection and access control.

[0091] From the above scheme, the application has the following advantages:

[0092] The distributed digital identity authentication mechanism based on ciphertext policy attribute based encryption provided by the application combines the distributed digital identity with the ciphertext policy attribute based encryption algorithm, stores from the verifiable claim chain, sets the corresponding verifiable claim access control structure based on the user public and private keys and attribute information, and realizes fine-grained verifier access control. Compared with the existing verifiable claim verification mechanism, the mechanism can significantly improve the system security, protect the user privacy and improve the user experience. BRIEF DESCRIPTION OF DRAWINGS

[0093] Figure 1 The application is a DID system operation flowchart;

[0094] Figure 2 The application is a DID chain identity generation method flowchart;

[0095] Figure 3 The application is a user registration distributed digital identity flowchart;

[0096] Figure 4 The application is a verifiable claim access control flowchart. DETAILED DESCRIPTION

[0097] When the inventor studied the distributed digital identity authentication scheme, it was found that the existing authentication scheme cannot meet the needs of users for identity authentication ease of use, privacy protection and security. The inventor combines the identity authentication mechanism with the ciphertext policy attribute based encryption (CP-ABE) algorithm, proposes a distributed digital identity authentication mechanism based on ciphertext policy attribute based encryption, realizes identity authentication privacy protection and high security, and meets the user experience. Specifically:

[0098] The scheme proposes a distributed digital identity authentication mechanism based on ciphertext policy attribute-based encryption, encrypts the verifiable statement and saves it to the blockchain, so that the user does not need to host the verifiable statement, reduces the possibility of theft and loss of the verifiable statement, and can resist various attacks; the verifiable statement is hierarchically encrypted, providing fine-grained access control, and the verifier allowed by the user will be able to obtain the verifiable statement with different selected disclosure levels, which can effectively protect the user's privacy; support for users to revoke expired verifiable statements, develop flexible access control policies, and for the same data encryption sharing scenario, compared with the traditional public key encryption algorithm, which must know the identity information of the verifier each time and must be encrypted multiple times when sent to multiple verifiers, the ciphertext policy attribute-based encryption algorithm only needs to be encrypted once, reducing the computing and storage overheads, thereby meeting the needs of distributed digital identity for running overhead, performance and security.

[0099] In order to make the above features and effects of the present application more clear and easy to understand, the following embodiments are described in detail below, and the accompanying drawings are described as follows.

[0100] This part will take the specific scene of single-user distributed digital identity registration and single-identity chain on-chain resource management and maintenance, and n attribute access control policy formulation as an example, and further detail the specific implementation of the present application in combination with the accompanying drawings.

[0101] This part will take the user user registers a distributed digital identity, applies for a verifiable statement, access control encryption of the verifiable statement, applies for a service, and the verifier queries the verifiable statement from the chain and decrypts the processing flow as an example, and further detail the present application in combination with the accompanying drawings and embodiments.

[0102] (1) Register a distributed digital identity

[0103] Figure 3 It is the flow chart of the user registering a distributed digital identity. The specific steps are as follows:

[0104] Step S1.1, the user provides the first KYC (Know Your Customer) proof, and authorizes the DID user agent to register the on-chain digital identity. The KYC authentication is a kind of authentication of the user's identity by the financial institution, the DID user agent queries the user information from the trusted source (such as the public security system, the citizen information system, etc.) through the user's identity and performs matching, and some institutions use biometric identification, face recognition for verification.

[0105] Step S1.2, after the DID user agent verifies the authentication information, it generates a public key pubKey and a private key privKey for the user using the signature algorithm of the identity chain, such as the elliptic curve digital signature algorithm (ECDSA). Here, the public and private keys are generated by the identity chain for the user, which are used for user login to the identity chain, generation of digital signatures, etc., and are not used in the subsequent encryption algorithm.

[0106] Step S1.3, the DID user agent performs a hash calculation on the public key to generate a DID identification field, and then performs a legality verification, including address legality and uniqueness verification. The address is the address of the user generated using the public key on the identity chain, such as the Ethereum address, which is a 16-bit hexadecimal string (40 characters) generated by encrypting the public key using the SHA256 algorithm and taking the last 160 bits, plus the prefix "0x" (a total of 42 bits). Therefore, the verification here is the identity chain address of the user generated using the public key.

[0107] Step S1.4, after the legality verification passes, a globally unique DID identifier is generated according to the DID project name and chain ID of the identity chain and returned to the user. The DID project name can be selected as the name of the blockchain.

[0108] Step S1.5, the authorization record and the DID record are recorded to the identity chain. The authorization record includes the user's address, the user's DID, and the timestamp.

[0109] (2) Verifiable claim access control

[0110] Figure 4 is a verifiable claim access control flowchart.

[0111] Step S2.1, after the user receives the verifiable claim issued by the certifier, the DID user agent performs system initialization and generates a system public key and a system master private key using the attribute-based encryption algorithm. It should be noted that the system public key and the system master private key are generated by the DID user agent using the attribute-based encryption algorithm, and the public and private keys in step 1.2 above are generated by the identity chain;

[0112] Step S2.2, the DID user agent generates a private key based on the public key, the master key, the verified user attribute set, and a random parameter, and distributes it to the user and the verifier. The user attribute set is a matrix, which is a set of attributes defined by the user, used to filter the corresponding verifier.

[0113] Step S2.3, the user sets the attribute structure, formulates the access policy, and generates an access structure, and encrypts the verifiable claim according to the ciphertext policy attribute-based encryption algorithm.

[0114] Step S2.4, the encrypted message is sent to the blockchain network in two independent levels, the first level is the full information of the verifiable claim, and the second level is the selective disclosure of the verifiable claim.

[0115] Step S2.5, the user sends a request to the verifier to apply for a service.

[0116] Step S2.6, the verifier receiving the request of the user sends a request to the identity chain to query the verifiable claim of the user. The verifier meeting the access strategy can decrypt the verifiable claim of the corresponding level and obtain the basic transaction information. When the user sends a request to the verifier to apply for a service, if no second level is decrypted by the verifier. Therefore, the decryption level of the verifier is determined by the user.

[0117] Step S2.7, the verifier verifies the decrypted verifiable claim, and provides the service to the user if the verification is passed.

[0118] The core of the distributed digital identity authentication mechanism based on the ciphertext policy attribute-based encryption proposed in the application is the authentication architecture and the access control encryption algorithm, and the design and access control encryption algorithm analysis of the mechanism are the key points to be protected in the application.

[0119] (1) Design of distributed digital identity authentication architecture

[0120] The application follows the DID standard of W3C, and the DID system mainly includes the DID identifier of the basic layer, the DID document, and the verifiable claim of the application layer.

[0121] The DID system includes five entities: an issuing party, a user, a verifier, a DID user agent and an identity chain.

[0122] 1. Issuing party

[0123] An entity that has user data and can issue a verifiable claim, such as official institutions and organizations such as government, bank, university, etc., that is, an identity provider.

[0124] 2. User

[0125] The owner of the original data, which is actually a person or an institution that owns the data, is mainly responsible for setting the access policy of the verifiable claim, distributing the key and transmitting the ciphertext based on attribute encryption.

[0126] 3. Verifier

[0127] An application that needs to verify the identity of the user, that is, an identity dependent party. The verifier is a data requester who has a part of attribute set, and only when the attribute set meets the access policy can the verifier have the permission to access the verifiable claim.

[0128] 4. DID user agent

[0129] A trusted third-party entity responsible for generating public parameters and user DID, generating system public key, system master key and user attribute private key for the system.

[0130] 5. Identity chain

[0131] A database that maintains DID, mainly responsible for storing DID authorization records, encrypted verifiable claims and user digital signatures on the chain. Since the blockchain is public, all users can browse and access it, effectively preventing illegal modification of data and ensuring data security.

[0132] Figure 1 The specific process of obtaining and using identity for DID system. The user sends the register DID instruction, and the DID user agent generates the public key and private key for the user using the identity chain elliptic curve digital signature algorithm (ECDSA). The generated private key is securely stored by the node, and the public key is used as the basis for generating the node's distributed digital identity DID. Since the public key is too long, directly using it as an address will waste unnecessary storage space. Therefore, the public key is subjected to the following hash calculation.

[0133]

[0134] wherein, represents the public key, and are two hash functions of different lengths. Through two hash operations, is converted into a 58-bit fixed-length string as the last field of the DID identifier.

[0135] As shown in Figure 2 , the DID agency verifies the legality of the identity registration request sent by the user, including address legality and uniqueness verification. If the legality verification fails, return the registration failure result, if it passes, generate a globally unique DID identifier according to the DID project name and chain ID of the identity chain and return it to the user.

[0136] After the user obtains the DID, the user applies for a verifiable claim to the issuing party, and the issuing party issues a verifiable claim and sends it to the user. Then, the user uses an access control encryption algorithm to encrypt the verifiable claim in layers of attributes, and stores the encrypted verifiable claim and digital signature on the identity chain, while only saving the private key. Finally, the user applies for services to the verifier, the verifier decrypts the verifiable claim and verifies it, and provides services to the user after verification.

[0137] (2) Access control encryption algorithm

[0138] The attribute-based encryption algorithm mechanism of the traditional existing double-layer ciphertext structure is relatively complex, supports transaction arbitration and ciphertext update of multiple arbitration nodes when user transaction generates divergence, and is not applicable to distributed digital identity authentication scene. The application provides a lightweight attribute-based encryption algorithm with double-layer ciphertext structure, reduces parameters for supporting ciphertext update and transaction arbitration, and reduces calculation amount. The application provides that a user formulates an access strategy and generates a linear secret-sharing (Linear Secret-Sharring Schemes, LSSS) access structure, and encrypts first-layer plaintext and second-layer plaintext. The first-layer plaintext is verifiable declaration information. The second-layer plaintext is selective disclosure. Only a verifier meeting an access strategy can view the second-layer plaintext. Only the user itself or a data access person specially authorized by the user can obtain the first-layer plaintext. The algorithm can be divided into five stages of system initialization, key generation, DID registration, encryption and decryption.

[0139] 1. System initialization

[0140] The DID user agent initializes the algorithm and generates a series of public parameters. Let be a multiplicative cyclic group of prime order , the generator is , the bilinear mapping is defined as , and the parameter is randomly selected. The generated master key (private key) will be kept secret. The public key is as follows:

[0141]

[0142] 2. Key generation

[0143] The DID user agent generates a private key based on the public key, the master key, the verified user attribute set and the randomly selected , and distributes the private key to the corresponding user node after the following calculation.

[0144]

[0145] 3. Encryption

[0146] The user formulates an access strategy and performs layered encryption on the verifiable declaration, the first layer is the whole information of the verifiable declaration, and only the user itself can view it, and the second layer is selective disclosure of the verifiable declaration and is used for verifier verification. The user formulates an access strategy and generates an LSSS access structure, such as , wherein the function represents the position of a given attribute in the matrix M, (i) . M is a matrix, wherein denotes the number of attributes involved in the access policy, n denotes the variable defined in the LSSS transformation method. Thus, the matrix M is generated according to the access policy set by the user. The rows of M represent different attribute classes, and the columns are variables defined by attribute values. In the initial stage of encryption, a random vector is selected. For each row in the matrix, a new parameter is calculated , the first layer of plaintext M1 and the second layer of plaintext M2 are calculated respectively according to the corresponding ciphertext as follows:

[0147]

[0148]

[0149]

[0150]

[0151]

[0152]

[0153] The complete ciphertext is as follows:

[0154]

[0155] where are the components of the ciphertext. For the convenience of formula writing, they do not have specific names.

[0156] 4. Decryption

[0157] The user sends the encrypted message to the blockchain network in two independent levels. Only the verifier who meets the access policy can view the second-level ciphertext and obtain the basic transaction information. The transaction information is the transaction information in the block, including the transaction sender, receiver, transaction hash, block number and other information, and the second-level ciphertext is contained in the transaction information.

[0158] Decrypt the second-level ciphertext: First, the verifier matches its attribute set with the access policy in the ciphertext. If the matching fails, the decryption fails and the encrypted information is not disclosed. When the attribute set S of the verifier meets the access policy, the decryption operation will be successful. We set and , and then use the Lagrange interpolation polynomial to find the coefficient set that satisfies the equation .

[0159]

[0160]

[0161]

[0162]

[0163] The second-level encrypted message can be obtained by the following calculation:

[0164]

[0165] Decrypt the first-level ciphertext: use and make the following calculation to obtain the plaintext.

[0166]

[0167] 5. Revocation

[0168] When the verifiable claim is invalid or needs to be changed, the user formulates a new access policy or encrypts the new verifiable claim information with the previous access structure, and sends a transaction to the identity chain. The verifier obtains the latest verifiable claim record each time the verifiable claim is queried.

[0169] 6. Algorithm analysis

[0170] The following analyzes the ciphertext policy attribute-based encryption algorithm used in the present application from the perspectives of data security, algorithm security, privacy protection, and running overhead, and expounds its superiority.

[0171] Data security

[0172] The transaction environment in the distributed digital identity requires higher data security, and at the same time, it is relatively difficult to ensure data security. The present application uses a distributed blockchain in the transaction framework, which can resist single-point attacks. In addition, the blockchain uses encryption primitives such as ciphertext policy attribute-based encryption, hash calculation, and digital signature to conduct transactions in an anonymous manner, which can ensure the integrity and availability of transaction data. The blockchain not only ensures the security of data, but also realizes the traceability of data. Even if the data is wrong, it can be detected and corrected in time. Therefore, the blockchain provides a guarantee for the security of transaction data.

[0173] Algorithm security

[0174] The security of the algorithm of the present application is the premise of system security. Once the algorithm is attacked by the enemy, the entire system will be in danger. In terms of algorithm security, the ciphertext policy attribute-based encryption scheme on which the present application is based has been proven to be plaintext attack (Chosen Plaintext Attack, CPA) secure. Therefore, the present application reduces the possibility of theft and loss of verifiable claims, and can resist various attacks, effectively ensuring the security of the system.

[0175] Privacy protection

[0176] The present application realizes the protection of user privacy in the whole transaction process. The present application adopts a fine-grained access control scheme based on ciphertext policy attribute-based encryption, which effectively protects the privacy information in the transaction process. The design of two-level ciphertext ensures that only participants who meet the access strategy can view the corresponding verifiable statement information. In the verifiable statement verification stage, the user encrypts the second-level verifiable statement information according to the determined access structure, and the verifier who meets the access structure can view the selectively disclosed verifiable statement. Only the user himself or the data accesser specially authorized by the user can obtain the first-level detailed verifiable statement information.

[0177] Running overhead

[0178] The running overhead of the present application mainly reflects two aspects, one is the calculation overhead caused by encryption and decryption, and the other is the communication overhead between the user and other roles in the system.

[0179] In terms of calculation overhead, the ciphertext policy attribute-based encryption algorithm adopted by the present scheme has a linear increase in calculation cost with the increase of the number of attributes. The specific time overhead of the algorithm includes: the time of performing exponential operation and hash operation in the group , the time of performing exponential operation in the group , and the time of pairing operation. Therefore, the decryption algorithm complexity and time delay of the verifier in the present scheme are higher than those of the original scheme in the hash comparison mode.

[0180] In terms of communication overhead, the present scheme only increases the process of distributing the key by the DID agent, and the influence is small.

[0181] In terms of storage overhead, the user originally needs to store the private key and the verifiable statement off-chain, and only store the hash value of the verifiable statement on-chain. In the present scheme, the user needs to store the private key off-chain and store the double-encrypted verifiable statement on-chain.

[0182] In summary, the running overhead of the present application is acceptable under the condition of ensuring the privacy and security of the system.

[0183] The following is a system embodiment corresponding to the above method embodiment. The present embodiment can be implemented in cooperation with the above embodiments. The related technical details mentioned in the above embodiments are still valid in the present embodiment. In order to reduce repetition, they will not be repeated here. Correspondingly, the related technical details mentioned in the present embodiment can also be applied in the above embodiments.

[0184] The present application also proposes a distributed digital identity authentication system with privacy protection and access control, which comprises:

[0185] Module 1, for enabling a user to provide KYC proof information to a DID user agent, and after the DID user agent verifies the KYC proof information, generating a public key and a private key for the user using a signature algorithm of an identity chain;

[0186] Module 2, for enabling the DID user agent to perform a hash calculation on the public key, generate a DID identification field, and then perform a legality verification thereon, and after the legality verification passes, generating a globally unique DID identification according to the chain ID of the identity chain and the DID identification field and returning the globally unique DID identification to the user; and recording an authorization record and a DID record to the identity chain;

[0187] Module 3, for enabling an issuing party to issue a verifiable claim and send it to the user, and the DID user agent to generate a system public key and a system master private key using an attribute-based encryption algorithm in a system initialization stage, and the DID user agent to generate a private key based on the system public key, the master private key, a verified user attribute set, and a random parameter and distribute the private key to the user and a verifier;

[0188] Module 4, for enabling the user to set an access policy, hierarchically encrypt the verifiable claim, and send a first-level ciphertext and a second-level ciphertext obtained to a blockchain; the first-level ciphertext is all information of the verifiable claim, and the second-level ciphertext is selective disclosure of the verifiable claim;

[0189] Module 5, for enabling the user to send a request for a service to the verifier, and the verifier to send a request to the identity chain to query the verifiable claim of the user, and to decrypt the first-level ciphertext or the second-level ciphertext according to the access policy and a private key of the verifier to obtain decryption information, and the verifier to verify the decryption information, and to provide the service to the user after the verification passes.

[0190] The distributed digital identity authentication system with privacy protection and access control, wherein the module 2 comprises:

[0191] The public key is converted into a 58-bit fixed-length string by the following hash calculation, and is used as a field in the DID identification;

[0192]

[0193] wherein, represents the public key, and are hash functions of different lengths, respectively.

[0194] The distributed digital identity authentication system with privacy protection and access control, wherein

[0195] The module 3 comprises:

[0196] The DID user agent initializes and generates public parameters, is a multiplicative cyclic group of prime order , the generator is , define a bilinear map , randomly select parameters ; generate the master private key ;

[0197]

[0198] The DID user agent generates a private key K based on the public key, the master private key, the user attribute set and the randomly selected , and distributes it to the user and the verifier through the following formula;

[0199]

[0200] The module 4 includes:

[0201] The user formulates an access policy and generates a linear key sharing LSSS access structure , where the function represents the position of a given attribute in the matrix M, (i) , represent different attributes, and M is a matrix, where represents the number of attributes involved in the access policy, and n represents the variable defined by the LSSS conversion method; generate the matrix M according to the access policy formulated by the user, the rows of M represent different attribute categories, and the columns are variables defined by attribute values; in the initial stage of encryption, randomly select a vector ; for each row in the matrix M, calculate a new parameter , randomly select , and calculate two ciphertexts respectively as follows:

[0202]

[0203]

[0204]

[0205]

[0206]

[0207]

[0208] The complete ciphertext is as follows:

[0209]

[0210] The module 5 includes:

[0211] Only the verifier who meets the access policy can view the secondary ciphertext and obtain the basic transaction information; the verifier sets its attribute set to match the access policy in the ciphertext, if the matching fails, the decryption fails, the encrypted information is not disclosed, otherwise when the attribute set of the verifier matches the access policy, the value of the attribute set is set to and , and then the Lagrange interpolation polynomial is used to find the coefficient set that meets the equation ;

[0212]

[0213]

[0214]

[0215]

[0216] The secondary encrypted message can be obtained by the following calculation:

[0217]

[0218] Decrypt the first-level ciphertext: use , and perform the following calculation to obtain the plaintext.

[0219]

[0220] The distributed digital identity authentication system with privacy protection and access control, wherein when the verifiable statement is invalid or needs to be changed, the user formulates a new access policy to encrypt new verifiable statement information, and sends a transaction to the identity chain.

[0221] The application further provides a storage medium for storing a program for executing any one of the distributed digital identity authentication methods with privacy protection and access control.

[0222] The application further provides a client for any one of the distributed digital identity authentication systems with privacy protection and access control.

Claims

1. A method for distributed digital identity authentication with privacy protection and access control, characterized in that, Comprise: Step 1, the user provides KYC proof information to the distributed digital identity DID user agent, and the DID user agent generates a first public key and a first private key for the user using the signature algorithm of the identity chain after verifying that the KYC proof information is passed; Step 2, the DID user agent hashes the first public key to generate a DID identification field, and performs legality verification thereon, and generates a globally unique DID identification according to the chain ID of the identity chain and the DID identification field and returns it to the user after the legality verification is passed; and record the authorization and DID to the identity chain; Step 3, the certifier issues a verifiable statement and sends it to the user, and the DID user agent generates a system public key and a system master private key using an attribute-based encryption algorithm in the system initialization stage, and the DID user agent generates a second private key based on the system public key, the system master private key, the verified user attribute set and the random parameter, and distributes it to the user and the verifier; Step 4, the user sets an access policy, encrypts the verifiable statement in layers, and sends the obtained first-level ciphertext and second-level ciphertext to the blockchain; the first-level ciphertext is all information of the verifiable statement, and the second-level ciphertext is selective disclosure of the verifiable statement; Step 5, the user sends a request for service to the verifier, and the verifier sends a request to the identity chain to query the verifiable statement of the user, decrypts the first-level ciphertext or the second-level ciphertext according to the access policy and the second private key of the verifier, obtains decryption information, and the verifier verifies the decryption information, and provides the service to the user after the verification is passed.

2. The distributed digital identity authentication method with privacy protection and access control as claimed in claim 1, wherein, The step 2 comprises: The first public key is converted into a 58-bit fixed-length string by the following hash calculation, which is used as a field in the DID identification.

3. The distributed digital identity authentication method with privacy protection and access control according to claim 1, characterized in that, The step 3 comprises: The DID user agent initializes and generates public parameters, is a prime order multiplicative cyclic group, the generator is , define a bilinear mapping , randomly select parameters ; generate system master private key ; The DID user agent generates a second private key K based on the system public key, the system master private key, the set of user attributes, and a randomly selected second private key K and distributes it to the user and the verifier by the following equation; The step 4 comprises: A user formulates an access policy and generates a linear secret sharing (LSSS) access structure where the function denotes the position of a given attribute in the matrix M, (i) , denotes different attributes, M is a matrix where denotes the number of attributes involved in the access policy, n denotes the variable defined by the LSSS conversion method; the matrix M is generated according to the access policy formulated by the user, the rows of M represent different attribute categories, and the columns are variables defined by attribute values; in the initial stage of encryption, a random vector is selected; for each row in the matrix M, a new parameter is calculated, a random is selected, and two ciphertexts are calculated as follows: The complete ciphertext is as follows: The step 5 comprises: Only the verifier satisfying the access policy can view the secondary ciphertext and get the basic transaction information, including the transaction sender, receiver, transaction hash and block number; the verifier will set its attribute set to match the access policy in the ciphertext, if it fails to match, the decryption fails, the encrypted information is not disclosed, otherwise when the attribute set of the verifier meets the access policy, the transaction information is decrypted and the transaction information is obtained and , the Lagrange interpolation polynomial is used to find the coefficient set satisfying the equation ; The second encryption message is obtained by the following calculation: Decrypting the first level ciphertext: use and perform the following calculation to obtain the plaintext 。 4. The distributed digital identity authentication method with privacy protection and access control as claimed in claim 1, wherein, When the verifiable statement is invalid or needs to be changed, the user formulates a new access policy to encrypt the new verifiable statement information and sends a transaction to the identity chain.

5. A distributed digital identity authentication system with privacy protection and access control, characterized in that, Comprise: Module 1, for enabling the user to provide KYC proof information to the DID user agent, and the DID user agent generates a first public key and a first private key for the user using the signature algorithm of the identity chain after verifying that the KYC proof information is passed; Module 2, for enabling the DID user agent to hash the first public key to generate a DID identification field, and performing legality verification thereon, and generating a globally unique DID identification according to the chain ID of the identity chain and the DID identification field and returning it to the user after the legality verification is passed; and record the authorization and DID to the identity chain; Module 3, for making the issuing party issue a verifiable statement and send it to the user, the DID user agent generates a system public key and a system master private key using an attribute-based encryption algorithm in the system initialization stage, and generates a second private key based on the system public key, the system master private key, the verified user attribute set and a random parameter, and distributes it to the user and the verifier; Module 4, for the user to set an access strategy, hierarchically encrypt the verifiable statement, and send the obtained first-level ciphertext and second-level ciphertext to the blockchain; the first-level ciphertext is the entire information of the verifiable statement, and the second-level ciphertext is the selective disclosure of the verifiable statement; Module 5, for the user to send a request for service to the verifier, the verifier sends a request to the identity chain to query the verifiable statement of the user, decrypts the first-level ciphertext or the second-level ciphertext according to the access strategy and the second private key of the verifier, obtains the decrypted information, and the verifier verifies the decrypted information, and provides the service to the user after verification.

6. The distributed digital identity authentication system with privacy protection and access control of claim 5, wherein, The module 2 includes: The first public key is converted into a 58-bit fixed-length string by the following hash calculation, which is used as a field in the DID identifier.

7. The distributed digital identity authentication system with privacy protection and access control according to claim 5, wherein, The module 3 includes: The DID user agent initializes and generates public parameters, is a prime order multiplicative cyclic group, the generator is , define a bilinear map , randomly select parameters ; generate system master private key ; The DID user agent generates a second private key K based on the system public key, the system master private key, the set of user attributes, and a randomly selected second private key K and distributes it to the user and the verifier by the following equation; The module 4 includes: A user formulates an access policy and generates a linear secret sharing LSSS access structure where the function denotes the position of a given attribute in the matrix M, (i) , denote different attributes, M is a matrix where denotes the number of attributes involved in the access policy and n denotes the variable defined by the LSSS conversion method; the matrix M is generated according to the access policy formulated by the user, the rows of M denote different attribute classes and the columns are variables defined by attribute values; in the initial stage of encryption, a vector is randomly selected; for each row in the matrix M, a new parameter is calculated, a random number is selected and two ciphertexts are respectively calculated as follows: The complete ciphertext is as follows: The module 5 includes: Only the verifier satisfying the access policy can view the secondary ciphertext and get the basic transaction information, including transaction sender, receiver, transaction hash and block number; the verifier will set its attribute set to match the access policy in the ciphertext, if it fails to match, the decryption fails, the encrypted information is not disclosed, otherwise when the attribute set of the verifier meets the access policy, the transaction information is decrypted and the transaction information is obtained and , the Lagrange interpolation polynomial is used to find the coefficient set satisfying the equation ​ The second-level encrypted message is obtained by the following calculation: Decrypting the first level ciphertext: use and perform the following calculation to obtain the plaintext 。 8. The distributed digital identity authentication system with privacy protection and access control of claim 6, wherein, When the verifiable statement is invalid or needs to be changed, the user formulates a new access strategy to encrypt the new verifiable statement information and sends a transaction to the identity chain.

9. A storage medium for storing a program for executing the distributed digital identity authentication method with privacy protection and access control according to any one of claims 1 to 4.

Images