Digital body interaction authentication method with functions of behavior privacy protection and supervision

Abstract

The invention discloses a digital body interaction authentication method with behavior privacy protection and supervision functions. The invention relates to six components including a digital avatar, a digital avatar, a service provider, a voucher issuer, a distributed supervision authority and a behavior chain. The method comprises five stages: a system initialization stage, a digital avatar generation stage, an access-to-ID construction stage, an on-chain and off-chain interaction authentication stage and a malicious entity supervision stage. According to the invention, based on the chameleon hash and the block chain technology, a method for accessing one ID is constructed, and the construction of one service and one duplicate is realized by embedding an implicit identity authentication key, so that the non-linkability of a meta-universe digital body in the service access process is realized; and avatar behaviors, preference privacy protection and self-sovereignty control of a natural person on the avatar are realized. In addition, a combined supervision mechanism is constructed by using dynamic threshold secret sharing and a Paillier homomorphic encryption technology, and responsibility asking for malicious entities is realized under the condition of not invading privacy of legal avatars.

Description

Technical Field

[0001] The present invention relates to the technical field of digital identity authentication, and in particular to a digital avatar interactive authentication method with both behavioral privacy protection and supervision. Background Art

[0002] With the rapid development of digitalization and Internet technology, the Metaverse is gradually becoming a reality. Every natural person will have a unique digital avatar in the Metaverse for learning, entertainment, and interaction with others. Digital avatars are the extension and expression of natural persons in the virtual world. They are not only the medium for their activities in the virtual space, but also a new way to demonstrate personal identity, and become a trust anchor in the Metaverse. Therefore, it is particularly important to establish a reliable digital avatar identity authentication mechanism. Although existing research on digital avatar interactive authentication has made certain progress in decentralization, identity privacy protection, and controllability, it is unable to achieve privacy protection of the avatar's identity and behavior while tracing the supervision of malicious entities, and it weakens the natural person's self-control over their digital avatar.

[0003] In response to these challenges, the present invention proposes a digital avatar interactive authentication method that combines behavioral privacy protection and supervision, aiming to ensure that the avatar can be reliably identified and verified when interacting with service platforms, applications and other avatars, so as to prevent fraudulent behaviors such as identity forgery and replay attacks, while ensuring the integrity and privacy of identity authentication data. This method realizes the unlinkability of the digital avatars of the metaverse during service access by means of one service, one avatar, and one access, one ID, as well as the privacy protection of avatar behavior and preferences and the self-sovereignty control of avatars by natural persons. Among them, the construction of one service, one avatar is realized by embedding implicit identity authentication keys, and one access, one ID is realized based on chameleon hashing and blockchain technology. In addition, a joint supervision mechanism is constructed based on dynamic threshold secret sharing and Paillier homomorphic encryption to realize the accountability of malicious entities without infringing the privacy of legitimate avatars. Summary of the invention

[0004] The main purpose of the present invention is to provide a digital avatar interactive authentication method with both behavioral privacy protection and supervision in view of the shortcomings of the prior art. The present invention mainly includes six entities, including: digital avatar (GA, Genuine Avatar), digital avatar (RA, Representative Avatar), service provider (SP, Service Provider), credential issuer (ISR, Issuer), distributed regulatory authority (DRA, Decentralized Regulation Authority), and behavior chain (BC, Behavior Chain).

[0005] (1) Genuine Avatar (GA): The concept of "digital avatar" in the Metaverse generally includes appearance, behavior, voice, preferences, etc. However, in the present invention, a digital avatar is a personal specific executable program that focuses on the avatar identity dimension and represents a natural person to interact with others in the Metaverse. In addition, since the digital avatar has a one-to-one mapping relationship with the real identity of the natural person, the digital avatar is also called the "genuine avatar".

[0006] (2) Representative Avatar (RA): A digital avatar is a metaverse avatar generated by a digital avatar. In the metaverse, avatars generally interact and authenticate with different services by deriving different avatars. Therefore, a digital avatar is also called a representative avatar.

[0007] (3) Service Provider (SP): Service providers provide various services in the Metaverse and need to reasonably obtain relevant privacy information of the digital avatar to determine whether the digital avatar meets the requirements for accessing the service.

[0008] (4) Credential Issuer (ISR): The credential issuer is composed of multiple authorities (Public Security Bureau, Education Bureau, Health Commission, etc.), and issues verifiable credentials (VC) for digital avatars in accordance with the World Wide Web Consortium (W3C) standards.

[0009] (5) Decentralized Regulatory Authority (DRA): The distributed regulatory authority consists of more than three audit nodes and supervises malicious digital avatars and malicious service providers in the metaverse.

[0010] (6) Behavior Chain (BC): The Behavior Chain is a consortium chain built and maintained by DRA as a blockchain node, which records all service interaction behaviors of all digital avatars.

[0011] Specifically, the present invention proposes a digital avatar interactive authentication method with privacy protection and realizes the supervision of malicious entities, which includes the following 7 core steps: ① The credential issuer ISR issues a verifiable credential VC to the digital avatar GA, and GA maintains a VC set locally; ② GA obtains the public key and identity attribute information to be verified of the service provider SP from the behavior chain BC; ③ GA selects a specific credential according to the identity information attribute to be verified, and derives a digital avatar RA; ④ RA constructs an on-chain identity authentication factor for each access and uploads it to BC in the form of a transaction; ⑤ RA sends an off-chain identity authentication factor to SP to initiate a service access request; ⑥ SP calls a smart contract to verify and partially parse RA's request, and uploads the service access supervision information to the chain; (⑦ The distributed authoritative regulatory agency tracks and traces the malicious RA and verifies the information of reporting the malicious SP.

[0012] A digital avatar interactive authentication method with both behavioral privacy protection and supervision includes the following five stages: first, the system initialization stage initializes all entities in the system model; second, the digital avatar generation stage completes the derivation of the digital avatar from the digital avatar and the initialization of related parameters; third, the one-access-one-ID construction stage completes the construction of the authentication factor of the digital avatar when performing each service authentication; fourth, the on-chain and off-chain interactive authentication stage completes the verification of the service request from the avatar service by the service provider; fifth, the malicious entity supervision stage enables the regulator to track and trace the malicious digital avatar under certain conditions and verify the information of reporting the malicious service provider.

[0013] 1. System initialization phase

[0014] In the system initialization phase, the parameters of each entity in the system model are initialized, which mainly includes the following five steps:

[0015] Step 1-1: Distributed Regulatory Authority DRA consists of n0 audit nodes CS i Composition, each CS i At the same time, as a consortium chain node, it builds and maintains the behavior chain BC, and the BC execution system initializes and generates system public parameters.

[0016] Step 1-2: Deploy the smart contract SC that participates in the interactive authentication of the digital avatar on the behavior chain BC ver , and disclose its contract address. The service provider SP can call the smart contract for verification and analysis.

[0017] Step 1-3: The service provider SP, the digital avatar GA and the credential issuer ISR all use the public parameters P on the behavior chain BC to calculate the {p,E p (a,b),G,n} to generate their respective public and private key pairs

[0018] Step 1-4: The service provider SP applies to the distributed regulatory authority DRA to provide services in the metaverse. DRA builds an authentication key AK for the compliant SP to verify the legitimate digital avatar SP (Formula 4) and send it to SP; in addition, the service provider SP needs to disclose the attributes of the identity information to be verified

[0019] Step 1-5: The digital avatar GA can apply for verifiable credentials such as identity cards, passports, degree certificates, etc. from different credential issuers ISR, and maintain a collection of all credentials {VCs} locally.

[0020] 2. Digital Avatar Generation

[0021] After the system is initialized, the digital avatar GA derives avatars RA for different services. RA needs to request authenticity verification from the distributed regulatory authority DRA. After DRA verifies the authenticity of RA, it creates an authenticity authentication key for it.

[0022] In the process of creating GA, the system records the personal identification information of the digital avatar as PII GA , use Shamir (t,n) algorithm to convert PII GA Divide into n0 parts and distribute to each CS i , each CS i DID GA Stores the GA's personal identification information shard for the index where x i Represents the index of the shard, which is used to identify the position of each shard in the Shamir algorithm. It is an integer. Represents personal identification information (PII) GA The i-th shard.

[0023] Next, the digital avatar GA obtains the public information of the service provider SP from the behavior chain BC: and And call the avatar generation algorithm to obtain the avatar RA.

[0024] 3. One-access-one-ID construction

[0025] The RA generates an unlinkable access for each service access of a service provider SP. The specific process is as follows:

[0026] 3-1.RA constructs OnAf, where ECI is the confidential credential information.

[0027] 3-2.RA executes KeyGen ch(.) Get a one-time Chameleon hash public and private key

[0028] 3-3.RA obtains the parameter (CP) through the Chameleon hash collision function CH.Col(.) r ,CP s ).

[0029] 3-4.RA uses Chameleon hash parameters and OnAf to trade TX i Upload behavior chain BC, transaction number TID i Serves as a unique unlinkable ID for the i-th service visit.

[0030] 4. On-chain and off-chain interactive authentication

[0031] The OnAf constructed in the one-access-one-ID phase described above is used for on-chain verification of the service provider; then, the RA uses a unique unlinkable and the authenticity authentication key AK issued by DRA RA Construct the off-chain identity authentication factor OfAf, ef3 is a randomly generated blinding factor; finally, RA sends OfAf to the service provider SP.

[0032] After receiving the off-chain identity authentication factor OfAf sent by the avatar RA, the service provider SP uses the private key Decrypt the OfAf content and verify the authenticity of the RA, and then call the smart contract SC ver To verify and parse the on-chain authentication factor OnAf, and thus determine whether to provide the corresponding service for the avatar, the specific steps are as follows:

[0033] 4-1.SP Pass Decrypt OfAf to get ef1, ef2, H(M1),M2.

[0034] 4-2. SP calculation H(M2·AK SP ) and compares it with H(M1) to determine whether the avatar is authorized by the distributed regulatory authority DRA, that is, to verify the authenticity of RA; if the comparison result is equal, continue with the subsequent steps; otherwise, reject the service request.

[0035] 4-3.SP As input, call the smart contract SC ver To implement validation and parsing.

[0036] 4-4.SP calculation get calculate and with Compare and verify integrity.

[0037] 4-5. SP obtains the certificate To confirm whether RA is qualified to obtain the service; if it is confirmed to be qualified, the service interface is provided to RA, otherwise the service request is rejected.

[0038] V. Malicious Entity Supervision

[0039] 5-1. Tracking and tracing the malicious clones.

[0040] 5-2. Verification of information on reporting malicious service providers.

[0041] The beneficial effects of the present invention are as follows:

[0042] A digital avatar interactive authentication method with both behavioral privacy protection and supervision is proposed. It not only realizes the privacy protection of the digital avatar's identity, behavior, and preferences, but also realizes the joint supervision of malicious entities. In addition, it improves the self-control ability of natural persons over their digital avatars. The main advantages are as follows:

[0043] (1) Behavioral privacy protection. By deriving avatars, service interaction and authentication of avatars can be achieved: that is, the one-service-one-avatar method can be used to prevent service providers from jointly regulating the access behavior of the same avatar to different services, thereby preventing natural persons from being profiled. By using the one-access-one-ID method, the avatars can be made unlinkable during the service access process: that is, the service provider cannot identify that these visits come from the same avatar, thereby preventing the service provider from analyzing the behavior patterns or preferences of the avatars.

[0044] (2) Efficient supervision. By embedding supervision factors in the process of constructing avatars and derived avatars, a double-layer link from avatar to avatar and from avatar to natural person is realized, and a joint supervision mechanism is designed to implement supervision and tracing of malicious avatars and verification of information on reporting malicious service providers without infringing the privacy of legitimate digital avatars, so as to protect the orderly development of the metaverse space. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 Schematic diagram of the system model of the present invention.

[0046] Figure 2 It is a schematic diagram of the effect of the present invention. DETAILED DESCRIPTION

[0047] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the present invention is further described below in conjunction with the accompanying drawings.

[0048]

[0049]

[0050] System model design, such as Figure 1 As shown:

[0051] (1) Genuine Avatar (GA): The concept of "digital avatar" in the Metaverse generally includes appearance, behavior, voice, preferences, etc. However, in the present invention, a digital avatar is a personal specific executable program that focuses on the avatar identity dimension and represents a natural person to interact with others in the Metaverse. In addition, since the digital avatar has a one-to-one mapping relationship with the real identity of the natural person, the digital avatar is also called the "genuine avatar".

[0052] (2) Representative Avatar (RA): A digital avatar is a metaverse avatar generated by a digital avatar. In the metaverse, avatars generally interact and authenticate with different services by deriving different avatars. Therefore, a digital avatar is also called a representative avatar.

[0053] (3) Service Provider (SP): Service providers provide various services in the Metaverse and need to reasonably obtain relevant privacy information of the digital avatar to determine whether the digital avatar meets the requirements for accessing the service.

[0054] (4) Credential Issuer (ISR): The credential issuer is composed of multiple authorities (Public Security Bureau, Education Bureau, Health Commission, etc.), and issues verifiable credentials (VC) for digital avatars in accordance with the World Wide Web Consortium (W3C) standards.

[0055] (5) Decentralized Regulatory Authority (DRA): The distributed regulatory authority consists of more than three audit nodes and supervises malicious digital avatars and malicious service providers in the metaverse.

[0056] (6) Behavior Chain (BC): The Behavior Chain is a consortium chain built and maintained by DRA as a blockchain node, which records all service interaction behaviors of all digital avatars.

[0057] The operation process is as follows: ① The credential issuer ISR issues a verifiable credential VC to the digital avatar GA, and GA maintains a VC set locally; ② GA obtains the public key and identity attribute information to be verified of the service provider SP from the behavior chain BC; ③ GA selects a specific credential based on the identity information attributes to be verified, and derives the digital avatar RA; ④ RA constructs an on-chain identity authentication factor for each access and uploads it to BC in the form of a transaction; ⑤ RA sends an off-chain identity authentication factor to SP to initiate a service access request; ⑥ SP calls the smart contract to verify and partially parse RA's request, and uploads the service access supervision information to the chain; ⑦ Distributed authoritative regulatory agencies track and trace malicious RAs and verify the information reporting malicious SPs.

[0058] As shown in the figure, a digital avatar interactive authentication method with both behavioral privacy protection and supervision includes the following steps:

[0059] Step 1. System initialization: Initialize all entities in the system model;

[0060] Step 2. Digital twin generation: completing the derivation of the digital twin from the digital avatar and initializing related parameters;

[0061] Step 3. One-access-one-ID construction: Complete the construction of the authentication factor for the digital twin when performing each service authentication;

[0062] Step 4. On-chain and off-chain interactive authentication: complete the service provider's verification of the avatar service request;

[0063] Step 5. Malicious entity supervision: Under certain conditions, the supervisory party can track and trace the malicious digital avatar and verify the information of reporting malicious service providers;

[0064] Furthermore, the specific method of step 1 is as follows:

[0065] 1-1. Synchronize initialization of the behavior chain and distributed regulatory authority

[0066] The distributed regulatory authority DRA consists of n0 audit nodes CS i Composition, each CS i At the same time, as a consortium chain node, it builds and maintains the behavior chain BC. The BC execution system initializes and generates system public parameters:

[0067] First, BC selects a large prime number p and p Next, select an elliptic curve E p (a, b), and an elliptic curve E with order n being a large prime number p A base point G on (a,b); then, BC initializes and generates its public and private key pair And call the Paillier key generation algorithm KeyGen pa Generate Paillier homomorphic encryption public and private keys for DRA Specifically, first randomly select two large prime numbers p and q so that they satisfy gcd(pq,(p-1)(q-1))=1, calculate n1=pq and λ=lcm(p-1,q-1); secondly, randomly select in The specific contents of the public key and private key returned at the end are shown in Formula 1 and Formula 2;

[0068]

[0069] Secondly, each audit node CS of DRA i Based on the elliptic curve parameters {p,E p (a,b),G,n} generate their respective public and private key pairs Then, BC uses the audit node CS i The public key The Paillier homomorphic encryption private key of DRA is encrypted with dynamic threshold secret sharing technology Slice and generate Finally, the system public parameter P is published to the genesis block, where k is the recovery secret The threshold value, the public parameter P is as follows:

[0070]

[0071] 1-2. Deploy smart contracts on the behavior chain

[0072] Deploy the smart contract SC that participates in the interactive authentication of digital avatars on the behavior chain BC ver , and disclose its contract address; the service provider SP calls the smart contract for verification and analysis;

[0073] 1-3. Calculate the elliptic curve public and private key pairs of all entities

[0074] The service provider SP, the digital avatar GA and the credential issuer ISR all use the public parameters P{p,E p (a,b),G,n} to generate their respective public and private key pairs

[0075] 1-4. The service provider sets the avatar attribute metadata and makes it public on the blockchain

[0076] The service provider SP applies to the distributed regulatory authority DRA to provide services in the metaverse. DRA builds an authentication key AK for the compliant SP to verify the legitimate digital avatar SPand send it to SP; in addition, the service provider SP needs to disclose the attributes of the identity information to be verified The details are as follows:

[0077]

[0078] Among them, H() represents the hash function, Attr i , (i=1,2,…num) represents the attribute, and num represents the number of attributes.

[0079] 1-5. Digital Avatars Acquire and Maintain a Set of Verifiable Credentials

[0080] The digital avatar GA applies for verifiable credentials from different credential issuers ISR and maintains a collection of all credentials {VCs} locally.

[0081] Furthermore, the specific method of step 2 is as follows:

[0082] After the system is initialized, the digital avatar GA derives avatars RA for different services. RA needs to request authenticity verification from the distributed regulatory authority DRA. After DRA verifies the authenticity of RA, it creates an authenticity authentication key for it. The specific process is as follows:

[0083] First, the digital avatar GA has a DID GA , and authentication factor AF; where r1 is a random number, is the Paillier public key of DRA;

[0084]

[0085] Among them, DID GA A decentralized identifier representing an avatar, represents the public key of the digital avatar GA, Represents the private key of the digital avatar GA;

[0086] In the process of creating GA, the system records the personal identification information of the digital avatar as PII GA , use Shamir (t,n) algorithm to convert PII GA Divide into n0 parts and distribute to each CS i , each CS i DID GA Stores the GA's personal identification information shard for the index where x i Represents the index of the shard, which is used to identify the position of each shard in the Shamir algorithm. It is an integer. Represents personal identification information (PII) GAThe i-th shard;

[0087] Next, the digital avatar GA obtains the public information of the service provider SP from the behavior chain BC: and And call the avatar generation algorithm to obtain the avatar RA. The detailed process is shown in Algorithm 1:

[0088] Algorithm 1 Avatar Generation Algorithm

[0089] Define the digital avatar GA, the authentication factor AF of GA, the set of credentials {VCs} maintained by GA, and the Paillier public key of the distributed regulatory authority Public key of the service provider SP and the identity information attributes to be verified And the public parameter P of the behavior chain BC, and define DID RA as follows:

[0090]

[0091] Among them, DID RA Represents the decentralized identifier of the avatar RA, is a power operation on the public key of the service provider SP, r is a random number, AF RA Indicates an intermediate parameter.

[0092] The specific implementation process of the clone production algorithm is as follows:

[0093] ① Construction w is Attributes in VC w Refers to the credential containing the value corresponding to the w attribute;

[0094] ② Based on the initialization parameter P of the blockchain, randomly select an integer 2≤d≤n-1 and calculate the public key The corresponding private key

[0095]

[0096] ③Inherit GA's identity authentication function F Auth ();

[0097] ④ Return to RA, as shown in formula 11:

[0098]

[0099] Finally, GA sends the DID to the Distributed Regulatory Authority DRA RA and DRA calls the smart contract SC reg calculate Obtaining a DID GA , D pa () indicates that the Paillier algorithm uses a private key to decrypt the operation; determine the DID GA Does it exist? If it does, verify it and authenticate the key. Send to RA.

[0100] Furthermore, the specific method of step 3 is as follows:

[0101] The RA generates an unlinkable access for each service access of a service provider SP. The specific process is as follows:

[0102] 3-1.RA constructs OnAf, where ECI is the confidential credential information and its calculation formula is as follows:

[0103] OnAf = {ECI, T Exp ,σ DRA} 12)

[0104]

[0105] Among them, ef1 is a randomly generated blinding factor, E pa () indicates that the Paillier algorithm uses public key encryption operations; T Exp Indicates the validity period; Salt is a random salt value used to prevent being linked, σ DRA Indicates intermediate parameters;

[0106] 3-2.RA executes KeyGen ch (.) Get a one-time Chameleon hash public and private key

[0107] 3-3.RA obtains the parameter (CP) through the Chameleon hash collision function CH.Col(.) r ,CP s ), where ef2 is a randomly generated blinding factor:

[0108]

[0109] 3-4.RA uses Chameleon hash parameters and OnAf to trade TX i Upload behavior chain BC, transaction number TID i As a unique unlinkable ID for the i-th service visit:

[0110]

[0111] M i ={OnAf,(CP r ,CPs )} (17)

[0112]

[0113] in, is the unlinkable ID for the i-th access to the SP service, ω contains the signature and other verification data to verify the validity of the transaction, M i Indicates the transaction content.

[0114] Furthermore, the specific method of step 4 is as follows:

[0115] The OnAf constructed in the one-access-one-ID phase described above is used for on-chain verification of the service provider; then, the RA uses a unique unlinkable and the authenticity authentication key AK issued by DRA RA Construct the off-chain identity authentication factor OfAf, ef3 is a randomly generated blinding factor; finally, RA sends OfAf to the service provider SP;

[0116]

[0117] M2=ef3·DID RA (twenty one)

[0118] In order to simplify the parameters, the intermediate calculation results are recorded as M1 and M2, that is, M1 and M2 represent intermediate parameters.

[0119] After receiving the off-chain identity authentication factor OfAf sent by the avatar RA, the service provider SP uses the private key Decrypt the OfAf content and verify the authenticity of the RA, and then call the smart contract SC ver To verify and parse the on-chain authentication factor OnAf, and thus determine whether to provide the corresponding service for the avatar, the specific steps are as follows:

[0120] 4-1.SP Pass Decrypt OfAf to get ef1, ef2, H(M1),M2;

[0121] 4-2. SP calculation H(M2·AK SP ) and compare it with H(M1) to determine whether the avatar is authorized by the distributed regulatory authority DRA, that is, to verify the authenticity of RA; if the comparison result is equal, continue with the subsequent steps; otherwise, reject the service request;

[0122] 4-3.SP As input, call the smart contract SC ver To implement verification and parsing, the specific process is as follows:

[0123] 4-3-1. Based on Get transaction TX i , and transaction content M i ={OnAf,(CP r ,CP s )}, the recipient public key in this transaction is Therefore, only this SP obtains the transaction content, and other SPs cannot obtain this transaction through this OfAf;

[0124] 4-3-2. Pass Retrieve the associated transaction TX i' , if the transaction exists and its output address is empty, then terminate the function to prevent replay attacks;

[0125] 4-3-3. Verify whether the time exceeds the validity period T contained in OnAf Exp , if it times out, terminate;

[0126] 4-3-4. Call the Chameleon hash algorithm and XOR algorithm to calculate in, From transaction TX i Input, OnAf, CP r ,CP s From transaction TX i The content of ef2 comes from the input of SP;

[0127] 4-3-5. From OnAf DRA TX i' Upload the behavior chain BC; where this transaction links to the previous transaction TX i ;

[0128]

[0129] Among them, TID i' Indicates transaction TX i' The unique identification number of the transaction, Tin represents the input of the transaction, and Tout represents the output of the transaction;

[0130] 4-3-6. ECI', Return to SP;

[0131] 4-4.SP calculation get calculate and with Compare and verify integrity;

[0132] 4-5. SP obtains the certificate To confirm whether RA is qualified to obtain the service; if it is confirmed to be qualified, the service interface is provided to RA, otherwise the service request is rejected;

[0133] Furthermore, the specific method of step 5 is as follows:

[0134] When an audit node CS in the distributed regulatory authority DRA j When malicious behavior is discovered, the smart contract SC is called reg To other audit nodes CS in DRA i Apply for joint supervision, when more than k CS i (including CS j ) agrees, CS j Recover DRA's Paillier private key through the Dss.Rcv algorithm The specific process is as follows:

[0135] First, each CS participating in the joint supervision i Download the public key of the behavior chain BC calculate And sent to the smart contract SC reg ;

[0136]

[0137] (x' i ,y' i ) indicates that the audit node CS i The point coordinates are obtained by multiplying the private key of the behavior chain and the public key (i.e. scalar multiplication).

[0138] Next, the smart contract SC reg Calculate Y' i =x' i +y' i , i = 1, 2, ... k and Among them, x i It's CS i The point coordinates x' are obtained by multiplying the private key of the behavior chain with the public key i . Smart Contract SC reg Construct k points And do Lagrange interpolation to get a k-1 degree polynomial g(x), see formula 24, then calculate the value of g(0) to be the Pailler private key

[0139]

[0140] 5-1. Tracking the source of malicious clones

[0141] Smart Contract SC reg use Decoding the regulatory factor σ of the RA clone DRA Get the DID of the digital avatar GA RA , and then obtain the personal identification information (PII) of the natural person uniquely mapped by GA GA , in order to realize the tracking and tracing of RA, the specific process is as follows:

[0142] 5-1-1. Smart Contract SC reg By trading TX i' Get σ DRA , And calculate Obtaining a DID RA ; Further calculation Obtaining a DID GA ;

[0143] 5-1-2. Smart Contract SC reg To all CS i Sending DID GA , C.S. i Query DID by index GA , obtain the identity information fragments belonging to RA stored locally And return to the smart contract SC reg ;

[0144] 5-1-3. When the number of fragments exceeds the threshold, the smart contract SC reg PII can be recovered through the Lagrange interpolation algorithm GA , and sent to the initiator CS j , that is, the tracing of RA is completed;

[0145] 5-2. Verification of information on reporting malicious service providers

[0146] The RA reports to the distributed regulatory authority DRA that the service provider SP is suspected of leaking its private information. DRA compares the on-chain and off-chain To verify the authenticity of the reported information, the specific process is as follows:

[0147] 5-2-1.RA to CS j send Filing a regulatory application against the SP;

[0148] 5-2-2.CS j Calling smart contract SC reg Decrypt c to obtain And calculate

[0149] 5-2-3. Smart Contract SC reg Get σ from transaction TX2DRA ,calculate get and with By comparison, if the hash values ​​of the credentials are consistent, it is considered that the service provider SP is indeed suspected of leaking the privacy of RA.

[0150] The experimental data are shown in Table 1, where T SM Represents scalar multiplication in elliptic curve; T ME is the modular exponentiation operation; T L (n) is the Lagrange interpolation operation for n points (the value of n is 5); T SHR (n) is the secret value split into n pieces (the value of n is 5) through the Shamir secret sharing algorithm; T H is the SHA256 hash operation; T P is a bilinear pairing operation; the experimental results in the table are the average values ​​of 1000 runs of the algorithm.

[0151] Table 1 Basic operation time consumption (ms)

[0152] operate <![CDATA[T SM ]]> <![CDATA[T ME ]]> <![CDATA[T L (n)]]> <![CDATA[T SHR (n)]]> <![CDATA[T H ]]> <![CDATA[T P ]]> Time / ms 0.0002 0.0014 0.0061 0.0162 0.0012 5.1422

[0153] As shown in Table 2, the initialization phase of the scheme of the present invention includes system initialization and digital avatar generation, mainly initializing the public parameters of the behavior chain and the public and private keys of each entity's elliptic curve, and constructing the avatar, totaling 0.0185ms; in the authentication phase, the scheme performs multiple elliptic curve private key decryption and chameleon hash operations, totaling 0.0138ms; finally, in the supervision phase, the scheme has the same supervision overhead for the digital avatar and the service provider, performing Lagrange interpolation and one Paillier decryption through multiple points, totaling 0.0099ms. In the authentication and supervision phases, the scheme has obvious advantages over other schemes in terms of computational overhead.

[0154] Table 2 Time cost (ms)

[0155]

[0156] This solution designs interactive authentication and joint supervision mechanisms in a decentralized manner, and protects the identity and behavior privacy of digital avatars while achieving authentication and supervision. It has all the privacy protection and security attributes in Table 3.

[0157] Table 3 Comparison of privacy protection and security attributes

[0158]

[0159] The present invention compares and analyzes the storage costs of the above solutions, and the results are as follows: Figure 2As shown in the figure, the bar chart compares other solutions and summarizes the storage costs from the perspectives of digital avatars, servers, and blockchains, while the line chart reflects the total overhead of each comparison solution.

[0160] The various existing methods provided in the present invention can provide corresponding documents if necessary.

[0161] In this scheme, the digital avatar needs to store verifiable credentials, Chameleon hash private key and avatar authenticity authentication key, which is about 256+64+32=352 bytes. The server needs to store 64 bytes of off-chain identity authentication factors, 5*256 bytes of Shamir shards of avatar personal identification information PII for supervision and traceability, 32 bytes of server authentication key and Paillier private key. The shards are 5*165 bytes, totaling: 64+5*256+32+5*165=2201 bytes. The blockchain needs to store 64 bytes of elliptic curve and blockchain public parameters, about 60 bytes of avatar attribute metadata, and 328 bytes of on-chain identity authentication factors, totaling 64+60+328=452 bytes. Compared with the references, the total overhead of this paper is moderate and slightly better than other solutions.

Claims

1. A digital avatar interactive authentication method with both behavioral privacy protection and supervision, characterized in that: The steps include: Step 1. System initialization: Initialize all entities in the system model; Step 2. Digital twin generation: completing the derivation of the digital twin from the digital avatar and initializing related parameters; Step 3. One-access-one-ID construction: Complete the construction of the authentication factor for the digital twin when performing each service authentication; Step 4. On-chain and off-chain interactive authentication: complete the service provider's verification of the avatar service request; Step 5. Malicious entity supervision: Under certain conditions, the supervisory party can track and trace the malicious digital avatars and verify the information of reporting malicious service providers.

2. According to claim 1, a digital avatar interactive authentication method with both behavior privacy protection and supervision is characterized in that: Step 1: Step 1: 1-1. Synchronize initialization of the behavior chain and distributed regulatory authority The distributed regulatory authority DRA consists of n0 audit nodes CS i Composition, each CS i At the same time, as a consortium chain node, it builds and maintains the behavior chain BC. The BC execution system initializes and generates system public parameters: First, BC selects a large prime number p and p Next, select an elliptic curve E p (a, b), and an elliptic curve E with order n being a large prime number p A base point G on (a, b); then, BC initializes and generates its public and private key pair And call the Paillier key generation algorithm KeyGen pa Generate Paillier homomorphic encryption public and private keys for DRA Specifically, first randomly select two large prime numbers p and q to satisfy gcd(pq, (p-1)(q-1))=1, calculate n1=pq and λ=lcm(p-1, q-1); secondly, randomly select in The specific contents of the public key and private key returned at the end are shown in Formula 1 and Formula 2; Secondly, each audit node CS of DRA i Based on the elliptic curve parameters {p, E p (a, b, G, n} generate their respective public and private key pairs Then, BC uses the audit node CS i The public key The Paillier homomorphic encryption private key of DRA is encrypted with dynamic threshold secret sharing technology Slice and generate Finally, the system public parameter P is published to the genesis block, where k is the recovery secret The threshold value, the public parameter P is as follows: 1-2. Deploy smart contracts on the behavior chain Deploy the smart contract SC that participates in the interactive authentication of digital avatars on the behavior chain BC ver , and disclose its contract address; the service provider SP calls the smart contract for verification and analysis; 1-3. Calculate the elliptic curve public and private key pairs of all entities The service provider SP, the digital avatar GA and the credential issuer ISR all use the public parameters P{p, E p (a, b, G, n} to generate their respective public and private key pairs 1-4. The service provider sets the avatar attribute metadata and makes it public on the blockchain The service provider SP applies to the distributed regulatory authority DRA to provide services in the metaverse. DRA builds an authentication key AK for the compliant SP to verify the legitimate digital avatar SP and send it to SP; in addition, the service provider SP needs to disclose the attributes of the identity information to be verified The details are as follows: Among them, H() represents the hash function, Attr i , (i=1,2,...num) represents the attribute, num represents the number of attributes; 1-5. Digital Avatars Acquire and Maintain a Set of Verifiable Credentials The digital avatar GA applies for verifiable credentials from different credential issuers ISR and maintains a collection of all credentials {VCs} locally.

3. According to claim 2, a digital avatar interactive authentication method with both behavior privacy protection and supervision is characterized in that: Step 2: After the system is initialized, the digital avatar GA derives avatars RA for different services. RA needs to request authenticity verification from the distributed regulatory authority DRA. After DRA verifies the authenticity of RA, it creates an authenticity authentication key for it. The specific process is as follows: First, the digital avatar GA has a DID GA , and authentication factor AF; where r1 is a random number, is the Paillier public key of DRA; Among them, DID GA A decentralized identifier representing an avatar, represents the public key of the digital avatar GA, Represents the private key of the digital avatar GA; In the process of creating GA, the system records the personal identification information of the digital avatar as PII GA , use Shamir (t, n) algorithm to convert PII GA Divide into n0 parts and distribute to each CS i , each CS i DID GA Stores the GA's personal identification information shard for the index where x i Represents the index of the shard, which is used to identify the position of each shard in the Shamir algorithm. It is an integer. PII GA The i-th shard; Next, the digital avatar GA obtains the public information of the service provider SP from the behavior chain BC: and And call the avatar generation algorithm to obtain the avatar RA.

4. According to claim 3, a digital avatar interactive authentication method with both behavior privacy protection and supervision is characterized in that: The avatar generation algorithm is specifically implemented as follows: Define the digital avatar GA, the authentication factor AF of GA, the set of credentials {VCs} maintained by GA, and the Paillier public key of the distributed regulatory authority Public key of the service provider SP and the identity information attributes to be verified And the public parameter P of the behavior chain BC, and define DID RA as follows: Among them, DID RA Represents the decentralized identifier of the avatar RA, is a power operation on the public key of the service provider SP, r is a random number, AF RA Indicates intermediate parameters; The specific implementation process is as follows: ① Construction w is Attributes in VC w Refers to the credential containing the value corresponding to the w attribute; ② Based on the initialization parameter P of the blockchain, randomly select an integer 2≤d≤n-1 and calculate the public key The corresponding private key ③Inherit GA's identity authentication function F Auth (); ④ Return to RA, as shown in formula 11: Finally, GA sends the DID to the Distributed Regulatory Authority DRA RA and DRA calls the smart contract SC reg calculate Obtaining a DID GA , D pa () indicates that the Paillier algorithm uses a private key to decrypt the operation; determine the DID GA Does it exist? If it does, verify it and authenticate the key. Send to RA.

5. A digital avatar interactive authentication method with both behavior privacy protection and supervision according to claim 3 or 4, characterized in that: Step 3: The RA generates an unlinkable access for each service access of a service provider SP. The specific process is as follows: 3-1.RA constructs OnAf, where ECI is the confidential credential information and its calculation formula is as follows: OnAf={ECI,T Exp ,σ DRA } (12) Among them, ef1 is a randomly generated blinding factor, E pa () indicates that the Paillier algorithm uses public key encryption operations; T Exp Indicates the validity period; Salt is a random salt value used to prevent being linked, σ DRA Indicates intermediate parameters; 3-2.RA executes KeyGen ch (.) Get a one-time Chameleon hash public and private key 3-3.RA obtains the parameter (CP) through the Chameleon hash collision function CH.Col(.) r , CP s ), where ef2 is a randomly generated blinding factor: 3-4.RA uses Chameleon hash parameters and OnAf to trade TX i Upload behavior chain BC, transaction number TID i As a unique unlinkable ID for the i-th service visit: M i ={OnAf,(CP r ,CP s )} (17) in, is the unlinkable ID for the i-th access to the SP service, ω contains the signature and other verification data to verify the validity of the transaction, M i Indicates the transaction content.

6. A digital avatar interactive authentication method with both behavior privacy protection and supervision according to claim 5, characterized in that: Step 4: The OnAf constructed in the one-access-one-ID phase described above is used for on-chain verification of the service provider; then, the RA uses a unique unlinkable and the authenticity authentication key AK issued by DRA RA Construct the off-chain identity authentication factor OfAf, ef3 is a randomly generated blinding factor; finally, RA sends OfAf to the service provider SP; <h2 style=";text-align:left;direction:ltr">M2=ef3·DID<h2 style=";text-align:left;direction:ltr"> RA <h2 style=";text-align:left;direction:ltr"> (21) Among them, M1 and M2 represent intermediate parameters; After receiving the off-chain identity authentication factor OfAf sent by the avatar RA, the service provider SP uses the private key Decrypt the OfAf content and verify the authenticity of the RA, and then call the smart contract SC ver To verify and parse the on-chain authentication factor OnAf, and thus determine whether to provide the corresponding service for the avatar, the specific steps are as follows: 4-1.SP Pass Decrypt OfAf to get ef1, ef2, H(M1), M2; 4-2. SP calculation H(M2·AK SP ) and compare it with H(M1) to determine whether the avatar is authorized by the distributed regulatory authority DRA, that is, to verify the authenticity of RA; if the comparison result is equal, continue with the subsequent steps; otherwise, reject the service request; 4-3.SP As input, call the smart contract SC ver To implement verification and parsing; 4-4.SP calculation get calculate and with Compare and verify integrity; 4-5. SP obtains the certificate To confirm whether RA is qualified to obtain the service; if it is confirmed to be qualified, the service interface is provided to RA, otherwise the service request is rejected.

7. A digital avatar interactive authentication method with both behavior privacy protection and supervision according to claim 6, characterized in that: The specific process of step 4-3 is as follows: 4-3-1. Based on Get transaction TX i , and transaction content M i ={OnAf, (CPx, CP s )}, the recipient public key in this transaction is Therefore, only this SP obtains the transaction content, and other SPs cannot obtain this transaction through this OfAf; 4-3-2. Pass Retrieve the associated transaction TX i′ , if the transaction exists and its output address is empty, then terminate the function to prevent replay attacks; 4-3-3. Verify whether the time exceeds the validity period T contained in OnAf Exp , if it times out, terminate; 4-3-4. Call the Chameleon hash algorithm and XOR algorithm to calculate in, From transaction TX i Input, OnAf, CP r , CP s From transaction TX i The content of ef2 comes from the input of SP; 4-3-5. From OnAf DRA TX i′ Upload the behavior chain BC; where this transaction links to the previous transaction TX i ; Among them, TID i′ Indicates transaction TX i′ The unique identification number of the transaction, Tin represents the input of the transaction, and Tout represents the output of the transaction; 4-3-6. ECI′, Return to SP.

8. A digital avatar interactive authentication method with both behavior privacy protection and supervision according to claim 6 or 7, characterized in that: Step 5: When an audit node CS in the distributed regulatory authority DRA j When malicious behavior is discovered, the smart contract SC is called reg To other audit nodes CS in DRA i Apply for joint supervision, when more than k CS i (including CS j ) agrees, CS j Recover DRA's Paillier private key through the Dss.Rcv algorithm The specific process is as follows: First, each CS participating in the joint supervision i Download the public key of the behavior chain BC calculate And sent to the smart contract SC reg ; (x′ i , y′ i ) indicates that the audit node CS i The point coordinates are obtained by multiplying the private key of the behavior chain with the public key (i.e., scalar multiplication); Next, the smart contract SC reg Calculate Y′ i = x′ i +y′ i , i = 1, 2, ... k and Among them, x i It's CS i The point coordinates x′ are obtained by multiplying the private key of the behavior chain with the public key of the behavior chain. i ; Smart Contract SC reg Construct k points And do Lagrange interpolation to get a k-1 degree polynomial g(x), see formula 24, then calculate the value of g(0) to be the Pailler private key 9. A digital avatar interactive authentication method with both behavior privacy protection and supervision according to claim 8, characterized in that: Step 5 includes tracing the malicious clone, smart contract SC reg use Decoding the regulatory factor σ of the RA clone DRA Get the DID of the digital avatar GA RA , and then obtain the personal identification information (PII) of the natural person uniquely mapped by GA GA , in order to realize the tracking and tracing of RA, the specific process is as follows: 5-1-1. Smart Contract SC reg By trading TX i′ Get σ DRA , And calculate Obtaining a DID RA ; Further calculation Obtaining a DID GA ; 5-1-2. Smart Contract SC reg To all CS i Sending DID GA , C.S. i Query DID by index GA , obtain the identity information fragments belonging to RA stored locally And return to the smart contract SC reg ; 5-1-3. When the number of fragments exceeds the threshold, the smart contract SC reg PII can be recovered through the Lagrange interpolation algorithm GA , and sent to the initiator CS j , that is, the tracking and tracing of RA is completed.

10. A digital avatar interactive authentication method with both behavior privacy protection and supervision according to claim 8, characterized in that: Step 5 includes verification of the reported malicious service provider information. The RA reports to the distributed regulatory authority DRA that the service provider SP is suspected of leaking its private information. DRA compares the on-chain and off-chain To verify the authenticity of the reported information, the specific process is as follows: 5-2-1.RA to CS j send Filing a regulatory application against the SP; 5-2-2.CS j Calling smart contract SC reg Decrypt c to obtain And calculate 5-2-3. Smart Contract SC reg Get σ from transaction TX2 DRA ,calculate get and with By comparison, if the hash values ​​of the credentials are consistent, it is considered that the service provider SP is indeed suspected of leaking RA's privacy.

Images