A digital avatar interaction authentication method with behavior privacy protection and supervision

Abstract

The application discloses a digital avatar interaction authentication method with behavior privacy protection and supervision. The application relates to six components of digital avatar, digital clone, service provider, certificate issuer, distributed supervision authority and behavior chain, and includes five stages: system initialization stage, digital clone generation stage, one access one ID construction stage, on-chain and off-chain interaction authentication stage and malicious entity supervision stage. The application constructs a one access one ID method based on chameleon hash and blockchain technology, and realizes the construction of one service one clone by embedding an implicit identity authentication key, realizes the unlinkability of the metaverse digital avatar in the service access process, and realizes the privacy protection of avatar behavior and preference and the self-sovereign control of the natural person on the avatar. In addition, a joint supervision mechanism is constructed by using dynamic threshold secret sharing and Paillier homomorphic encryption technology, and the accountability of malicious entities is realized without infringing the privacy of legal avatars.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of digital identity authentication, and particularly relates to a digital avatar interactive authentication method with behavior privacy protection and supervision. BACKGROUND

[0002] In today's rapidly developing digital and Internet technology, the metaverse is gradually becoming a reality. Every natural person will have a unique digital avatar in the metaverse for learning, entertainment and interaction with others. The digital avatar is an extension and expression of the natural person in the virtual world, which is not only a medium for their activities in the virtual space, but also a new way to highlight personal identity and become a trust anchor in the metaverse. Therefore, it is particularly important to establish a reliable digital avatar identity authentication mechanism. Although existing research on digital avatar interactive authentication has made some progress in decentralization, identity privacy protection and supervision, it cannot achieve privacy protection of the identity and behavior of the avatar while supervising and tracing malicious entities, and it weakens the self-control of the natural person over the digital avatar.

[0003] To address these challenges, the present application proposes a digital avatar interactive authentication method with behavior privacy protection and supervision, which aims to ensure that the avatar can be reliably identified and verified when interacting with service platforms, applications and other avatars, to prevent fraud such as identity forgery and replay attacks, while ensuring the integrity and privacy of identity authentication data. The method realizes the unlinkability of the metaverse digital avatar in the service access process through a service-a-representative and an access-a-ID, and realizes the privacy protection of the avatar behavior and preference and the self-sovereign control of the natural person over the avatar. Among them, the construction of a service-a-representative is realized by embedding an implicit identity authentication key, and an access-a-ID is realized based on chameleon hash and blockchain technology. In addition, a joint supervision mechanism is constructed based on dynamic threshold secret sharing and Paillier homomorphic encryption to hold malicious entities accountable without infringing on the privacy of legitimate avatars. SUMMARY

[0004] The main purpose of the present application is to provide a digital avatar interactive authentication method with behavior privacy protection and supervision to overcome the shortcomings of the prior art. The present application mainly includes six entities, including: a digital avatar (GA, Genuine Avatar), a digital representative (RA, Representative Avatar), a service provider (SP, Service Provider), an issuer (ISR, Issuer), a decentralized regulation authority (DRA, Decentralized Regulation Authority), and a behavior chain (BC, Behavior Chain).

[0005] (1) Genuine Avatar (GA): The concept of a "digital avatar" in the metaverse includes appearance, behavior, voice, preferences, etc. However, in this invention, a digital avatar is a personally specific executable program that focuses on the identity dimension of the avatar, representing the natural person interacting with others in the metaverse. In addition, since the digital avatar has a one-to-one mapping relationship with the natural person's real identity, the digital avatar is also called a "genuine avatar" (Genuine Avatar).

[0006] (2) Representative Avatar (RA): A digital avatar is a metaverse avatar generated by a digital avatar. Since avatars generally interact and authenticate different services by deriving different avatars in the metaverse, the digital avatar is also called a "representative" (Representative Avatar).

[0007] (3) Service Provider (SP): Service providers provide various services in the metaverse and need to reasonably obtain the relevant privacy information of digital avatars to determine whether the digital avatars meet the requirements for accessing services.

[0008] (4) Issuer (ISR): The issuer is composed of multiple authorities (public security bureaus, education bureaus, health commissions, etc.) and issues verifiable credentials (VC) for digital avatars in accordance with the World Wide Web Consortium (W3C) standard.

[0009] (5) Decentralized Regulation Authority (DRA): The decentralized regulation authority is composed of three or more audit nodes and monitors malicious digital avatars and malicious service providers in the metaverse.

[0010] (6) Behavior Chain (BC): The behavior chain is a consortium chain constructed and maintained by the DRA as a blockchain node, recording all service interaction behaviors of all digital avatars.

[0011] Specifically, the application provides a digital avatar interaction authentication method with privacy protection, and realizes supervision of malicious entities, which includes the following 7 core steps: ① The credential issuer ISR issues a verifiable credential VC to the digital avatar GA, and the GA maintains the VC set locally; ② The GA obtains the public key of the service provider SP and the identity attribute information to be verified from the behavior chain BC; ③ The GA selects a specific credential according to the identity attribute information to be verified, and derives a digital avatar RA; ④ The RA constructs an on-chain identity authentication factor for each access and uploads the BC in the form of a transaction; ⑤ The RA sends the off-chain identity authentication factor to the SP to initiate a service access request; ⑥ The SP calls the smart contract to verify and partially parse the request of the RA, and uploads the service access supervision information to the chain; and ⑦ The distributed authoritative supervision agency traces and traces the malicious RA, and verifies the information of the malicious SP reported.

[0012] A digital avatar interaction authentication method with behavior privacy protection and supervision, including the following five stages: first, the system initialization stage initializes all entities in the system model; second, the digital avatar generation stage completes the derivation of the digital avatar by the digital avatar and the initialization of the related parameters; third, the construction stage of one access one ID completes the construction of the authentication factor of the digital avatar during each service authentication; fourth, the on-chain and off-chain interaction authentication stage completes the verification of the service provider to the avatar service request; and fifth, the malicious entity supervision stage realizes the tracking and tracing of the malicious digital avatar by the supervision party under certain conditions and verifies the information of the malicious service provider reported.

[0013] I. System initialization stage

[0014] In the system initialization stage, the parameters of each entity in the system model are initialized, mainly including the following 5 steps:

[0015] Step 1-1: The distributed supervision authority DRA is composed of n0 audit nodes CS i Each CS i serves as a consortium chain node to build and maintain the behavior chain BC, and the BC performs system initialization to generate system public parameters.

[0016] Step 1-2: Deploy the smart contract SC participating in the digital avatar interaction authentication on the behavior chain BC ver , and disclose its contract address. The service provider SP can call the smart contract for verification and parsing.

[0017] Step 1-3: The service provider SP, the digital avatar GA and the credential issuer ISR generate their own public and private key pairs according to the {p, E p (a,b), G, n} in the public parameters P on the behavior chain BC

[0018] Step 1-4: Service provider SP applies to the distributed regulatory authority DRA for providing services in the metaverse, and the DRA builds an authentication key AK for verifying the legal digital avatar for the compliant SP SP (Formula 4), and sends it to the SP; in addition, the service provider SP needs to disclose the attributes of the identity information to be verified

[0019] Step 1-5: The digital avatar GA can apply for verifiable credentials such as identity cards, passports, and degree certificates from different credential issuers ISR, and locally maintain a set of all credentials {VCs}.

[0020] II. Digital avatar generation

[0021] After system initialization, the digital avatar GA derives a sub-avatar RA for different services, which needs to request authenticity verification from the distributed regulatory authority DRA, and the DRA creates an authenticity authentication key for the RA after authenticity verification.

[0022] In the process of creating GA, the system records the personal identification information of the digital avatar as PII GA , divides PII GA into n0parts using the Shamir(t, n) algorithm, and distributes them to each CS i , each CS i stores the personal identification information fragments of this GA with DID GA as the index where x i represents the index of the fragment, which is an integer, represents the i-th fragment of the personal identification information PII GA .

[0023] Next, the digital avatar GA obtains the public information of the service provider SP from the behavior chain BC: and and calls the sub-avatar generation algorithm to obtain the sub-avatar RA.

[0024] III. Construction of one ID per access

[0025] For each service access of the sub-avatar RA to a certain service provider SP, a non-linkable access The specific process is as follows:

[0026] 3-1. RA builds OnAf, where ECI is the encrypted credential information.

[0027] 3-2. RA executes KeyGen ch(.) Obtain a one-off chameleon hash public and private key

[0028] 3-3. RA obtains parameters (CP r , CP s ) through the chameleon hash collision function CH.Col(.).

[0029] 3-4. RA uploads the chameleon hash parameters and OnAf to the behavior chain BC using transaction TX i , transaction number TID i as the unique non-linkable ID of the i-th service access.

[0030] Four, on-chain and off-chain interaction authentication

[0031] OnAf constructed in the above-described access-ID phase is used for on-chain verification by the service provider; then, the avatar RA constructs an off-chain identity authentication factor OfAf using the unique non-linkable and the authenticity authentication key AK RA issued by the DRA, ef3 is a randomly generated blinding factor; finally, the RA sends OfAf to the service provider SP.

[0032] After the service provider SP receives the off-chain identity authentication factor OfAf sent by the avatar RA, it decrypts OfAf using the private key to obtain the content of OfAf and verify the authenticity of the RA, and then calls the smart contract SC ver to verify and parse the on-chain authentication factor OnAf, so as to determine whether to provide the corresponding service to the avatar, the specific steps being as follows:

[0033] 4-1. SP decrypts OfAf to obtain ef1, ef2, H(M1), M2.

[0034] 4-2. SP calculates H(M2·AK SP ) and compares it with H(M1) to determine whether the avatar is authorized by the distributed regulatory authority DRA, i.e., to verify the authenticity of the RA; if the comparison result is equal, the subsequent steps are continued; otherwise, the service request is rejected.

[0035] 4-3. SP calls the smart contract SC with ver as input to realize verification and parsing.

[0036] 4-4. SP calculates to obtain , calculates and compares it with to verify ​integrity.

[0037] 4-5. SP confirms whether the RA is qualified to obtain the service by the obtained credential; if qualified, provides the service interface to the RA, otherwise rejects the service request.

[0038] Five, malicious entity supervision

[0039] 5-1. Tracking and tracing of malicious avatars.

[0040] 5-2. Verification of reported malicious service provider information.

[0041] The present application has the following advantages:

[0042] A digital avatar interaction authentication method with behavior privacy protection and supervision is proposed. Not only the privacy protection of digital avatar identity, behavior and preference is realized, but also the joint supervision of malicious entities is realized. In addition, the self-control ability of natural person to his digital avatar is improved. The main advantages are as follows:

[0043] (1) Behavior privacy protection. By deriving the avatar, the service interaction and authentication of the avatar are realized: that is, by the method of one service one avatar, the access behavior of different services of the same avatar by the joint regulation of the service provider is resisted, so as to avoid the user portrait of the natural person. By the method of one access one ID, the unlinkability of the avatar in the service access process is realized: that is, the service provider cannot identify that these accesses come from the same avatar, so as to avoid the analysis of the behavior pattern or preference of the avatar by the service provider.

[0044] (2) Efficient supervision. By embedding the supervision factor in the process of constructing the avatar and deriving the avatar, the double-layer link from the avatar to the natural person and from the avatar to the natural person is realized, and the joint supervision mechanism is designed to realize the supervision and tracing of malicious avatars and the verification of reported malicious service provider information without infringing the privacy of legal digital avatars, so as to protect the orderly development of the meta universe space. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 System model schematic diagram of the present application.

[0046] Figure 2 Effect diagram of the present application. DETAILED DESCRIPTION

[0047] In order to make the technical means, creative features, purposes and effects realized by the present application easy to understand, the present application will be further described below with reference to the drawings.

[0048]

[0049] ​

[0050] System model design, such as Figure 1 shown:

[0051] (1) Digital Avatar (GA, Genuine Avatar): The concept of "digital avatar" in the metaverse includes appearance, behavior, voice, preference, etc., but in this invention, the digital avatar is a personal specific executable program focusing on the identity dimension of the avatar, representing the natural person interacting with others in the metaverse. In addition, since the digital avatar has a one-to-one mapping relationship with the real identity of the natural person, the digital avatar is also called "genuine avatar" (Genuine Avatar).

[0052] (2) Digital Representative (RA, Representative Avatar): Digital representative is a metaverse representative generated by digital avatar; since in the metaverse, avatars generally interact with different services and authentication by deriving different representatives, digital representative is also called "representative" (Representative Avatar) of digital avatar.

[0053] (3) Service Provider (SP, Service Provider): Service providers provide various services in the metaverse, and need to reasonably obtain the privacy information of digital avatars to determine whether the digital avatars meet the requirements of accessing services.

[0054] (4) Certificate Issuer (ISR, Issuer): The certificate issuer is composed of multiple authorities (public security bureau, education bureau, health commission, etc.), and issues verifiable credentials (VC, Verifiable Credential) for digital avatars according to the World Wide Web Consortium (W3C) standard.

[0055] (5) Distributed Regulatory Authority (DRA, Decentralized Regulation Authority): The distributed regulatory authority is composed of three or more audit nodes, and monitors malicious digital avatars and malicious service providers in the metaverse.

[0056] (6) Behavior Chain (BC, Behavior Chain): The behavior chain is a consortium chain constructed and maintained by DRA as a blockchain node, recording all service interaction behaviors of all digital avatars.

[0057] Its operation process is as follows: 1) the credential issuer ISR issues a verifiable credential VC to the digital avatar GA, and the GA maintains the VC set locally; 2) the GA obtains the public key of the service provider SP and the identity attribute information to be verified from the behavior chain BC; 3) the GA selects a specific credential according to the identity attribute information to be verified, and derives a digital avatar RA; 4) the RA constructs an on-chain identity authentication factor for each access and uploads the BC in the form of a transaction; 5) the RA sends the off-chain identity authentication factor to the SP to initiate a service access request; 6) the SP calls the smart contract to verify and partially parse the request of the RA, and uploads the service access supervision information to the chain; 7) the distributed authority supervision agency traces the malicious RA and verifies the information of reporting malicious SP.

[0058] As shown in the figure, a digital avatar interaction authentication method with behavior privacy protection and supervision, comprising the following steps:

[0059] Step 1. System initialization: initializing all entities in the system model;

[0060] Step 2. Digital avatar generation: completing the derivation of the digital avatar by the digital avatar and the initialization of the related parameters;

[0061] Step 3. Construction of one access one ID: completing the construction of the authentication factor of the digital avatar during each service authentication;

[0062] Step 4. On-chain and off-chain interaction authentication: completing the verification of the service provider to the avatar service request;

[0063] Step 5. Malicious entity supervision: realizing the tracking and tracing of the malicious digital avatar by the supervision party under certain conditions and verifying the information of reporting the malicious service provider;

[0064] Further, the specific method of step 1 is as follows:

[0065] 1-1. Synchronously initializing the behavior chain and the distributed supervision authority

[0066] The distributed supervision authority DRA is composed of n0 audit nodes CS i Each CS i serves as a consortium chain node to build and maintain the behavior chain BC, and the BC performs system initialization to generate system public parameters:

[0067] First, the BC selects a large prime number p, and selects an elliptic curve E p (a,b) in a finite field F p and a base point G on the elliptic curve E p (a,b) with a large prime number n; then, the BC initializes to generate its public and private key pair and call the Paillier key generation algorithm KeyGen pa Generate Paillier homomorphic encryption public and private keys for DRA Specifically, first, two large prime numbers p and q are randomly selected to satisfy gcd(pq,(p-1)(q-1))=1, n1=pq and λ=lcm(p-1,q-1) are calculated; second, a random number r is selected Wherein Finally, the specific content of the public key and the private key is shown in formula 1 and formula 2.

[0068]

[0069] Second, each audit node CS i of DRA generates its own public and private key pair based on the elliptic curve parameters {p,E p (a,b),G,n} Then, BC uses the public key of the audit node CS i and the dynamic threshold secret sharing technology to fragment the Paillier homomorphic encryption private key of DRA, and generates Finally, the system publishes the public parameter P to the genesis block, where k is the threshold for recovering the secret The public parameter P is as follows:

[0070]

[0071] 1-2. Deploy smart contract on behavior chain

[0072] Deploy the smart contract SC participating in digital avatar interaction authentication on the behavior chain BC ver , and publish its contract address; the service provider SP calls the smart contract for verification and analysis;

[0073] 1-3. Calculate the elliptic curve public and private key pairs of all entities

[0074] The service provider SP, the digital avatar GA and the certificate issuer ISR all generate their own public and private key pairs according to the public parameter P {p,E p (a,b),G,n} on the behavior chain BC

[0075] 1-4. Service provider sets avatar attribute meta information and chain public

[0076] The service provider SP applies to the distributed regulatory authority DRA for providing services in the meta universe, and the DRA constructs an authentication key AK for verifying legal digital avatars for compliant SPs SPand sends it to the SP; in addition, the service provider SP needs to publish the attributes of the identity to be verified The details are as follows:

[0077]

[0078] where H() represents a hash function, Attr i , (i = 1, 2, … num) represents an attribute, and num represents the number of attributes.

[0079] 1-5. Digital avatar obtains and maintains a set of verifiable credentials

[0080] The digital avatar GA applies for and obtains verifiable credentials from different credential issuers ISR, and locally maintains a set of all credentials {VCs}.

[0081] Further, the specific method of step 2 is as follows:

[0082] After system initialization is completed, the digital avatar GA respectively derives a sub-identity RA for different services, and the RA needs to request authenticity verification from the distributed regulatory authority DRA, and the DRA creates an authenticity authentication key for the RA after authenticating the authenticity of the RA. The specific process is as follows:

[0083] First, the digital avatar GA has a DID GA , and an authentication factor AF; wherein r1 is a random number, is the Paillier public key of the DRA;

[0084]

[0085] where DID GA represents the decentralized identifier of the avatar, represents the public key of the digital avatar GA, represents the private key of the digital avatar GA;

[0086] In the process of creating GA, the system records the personal identification information of the digital avatar as PII GA , divides PII GA into n0parts using the Shamir(t, n) algorithm, and distributes them to each CS i , each CS i stores the personal identification information fragments of the GA with DID GA as the index where x i represents the index of the fragment, which is an integer, represents the personal identification information PII GAThe i-th shard;

[0087] Then, the digital avatar GA obtains the public information of the service provider SP from the behavior chain BC: And And calls the split body generation algorithm to obtain the split body RA, and the detailed process is shown in algorithm 1:

[0088] Algorithm 1 split body generation algorithm

[0089] Define the digital avatar GA, the authentication factor AF of GA, the credential set {VCs} maintained by GA, the Paillier public key of the distributed regulatory authority The public key of the service provider SP And the identity information attribute to be verified And the public parameter P of the behavior chain BC, and define DID RA As follows:

[0090]

[0091] Wherein, DID RA Indicates the decentralized identifier of the split body RA, Is the power operation on the public key of the service provider SP, r is a random number, and AF RA Indicates an intermediate parameter.

[0092] The specific implementation process of the split body production algorithm is as follows:

[0093] 1. Construct w is The attribute in w VC Indicates the credential containing the value corresponding to the attribute w;

[0094] 2. Based on the initialization parameter P of the block chain, randomly select an integer 2≤d≤n-1, and calculate the public key The corresponding private key

[0095]

[0096] 3. Inherit the identity authentication function F Auth () of GA;

[0097] 4. Return RA, as shown in formula 11:

[0098]

[0099] Finally, GA sends DID RA And To the distributed regulatory authority DRA, and the DRA calls the smart contract SC reg To calculate Obtain DID GA , D pa () represents the Paillier algorithm using private key decryption operation; determine whether the DID GA exists, if it exists, the verification is passed and the authenticity authentication key is sent to the RA.

[0100] Further, the specific method of step 3 is as follows:

[0101] The RA generates an unlinkable access ID for each service access of a certain service provider SP. The specific process is as follows:

[0102] 3-1. RA constructs OnAf, wherein ECI is the ciphertext information, and the calculation formula is as follows:

[0103] OnAf={ECI, T Exp ,σ DRA} 12)

[0104]

[0105] Wherein, ef1 is a randomly generated blinding factor, E pa () represents the Paillier algorithm using public key encryption operation; T Exp represents the validity period; Salt is a random number salt value, which is used to prevent being linked, and σ DRA represents an intermediate parameter;

[0106] 3-2. RA executes KeyGen ch (.) to obtain one-time chameleon hash public and private keys

[0107] 3-3. RA obtains parameters (CP r , CP s ) through chameleon hash collision function CH.Col(.), wherein ef2 is a randomly generated blinding factor:

[0108]

[0109] 3-4. RA uploads the chameleon hash parameters and OnAf to the behavior chain BC using transaction TX i , and transaction number TID i as the unique unlinkable ID of the i-th service access:

[0110]

[0111] M i ={OnAf, (CP r , CPs )} (17)

[0112]

[0113] in, This refers to the unlinkable ID of the i-th access to the SP service, ω contains the signature and other verification data used to verify the validity of the transaction, and M... i This indicates the details of the transaction.

[0114] Furthermore, the specific method for step 4 is as follows:

[0115] The OnAf constructed in the one-access-one-ID phase described above is used for on-chain verification of the service provider; then, the clone RA uses a unique, unlinkable... and the authenticity authentication key AK issued by DRA RA Construct an off-chain identity authentication factor OfAf, where ef3 is a randomly generated blinding factor; finally, RA sends OfAf to the service provider SP.

[0116]

[0117] M2 = ef3·DID RA (twenty one)

[0118] To simplify the parameters, the intermediate calculation results are denoted as M1 and M2, that is, M1 and M2 represent intermediate parameters.

[0119] After receiving the off-chain authentication factor OfAf from the clone RA, the service provider SP uses its private key. The OfAf content is decrypted and the authenticity of the RA is verified, and then the smart contract SC is invoked. ver The on-chain authentication factor OnAf is verified and parsed to determine whether to provide the corresponding service for the avatar. The specific steps are as follows:

[0120] 4-1.SP passed Decrypt OfAf to obtain ef1, ef2, H(M1),M2;

[0121] 4-2. SP Calculation of H(M2·AK) SP It is then compared with H(M1) to determine whether the clone is authorized by the Distributed Regulatory Authority (DRA), i.e., to verify the authenticity of the RA; if the comparison results are equal, the subsequent steps are continued; otherwise, the service request is rejected.

[0122] 4-3.SP As input, the smart contract SC is called. ver The following is the specific process for implementing verification and parsing:

[0123] 4-3-1. According to Obtain transaction TX i , and transaction content M i = {OnAf, (CP r , CP s )}, the recipient public key in the transaction is Therefore, only the SP obtains the transaction content, and other SPs cannot obtain this transaction through the OfAf;

[0124] 4-3-2. Through retrieve the associated transaction TX i' , if the transaction exists, the output address is empty, then terminate the function running to prevent replay attacks;

[0125] 4-3-3. Verify whether the time exceeds the validity period T contained in OnAf Exp , if it is overdue, terminate;

[0126] 4-3-4. Call the chameleon hash algorithm and the XOR algorithm to calculate Wherein, the input from the transaction TX i , OnAf, CP r , CP s from the content of the transaction TX i , ef2 from the input of the SP;

[0127] 4-3-5. Upload σ DRA from OnAf to the transaction TX i' behavior chain BC; wherein the transaction links the previous transaction TX i ;

[0128]

[0129] Wherein, TID i' represents the unique identification number of the transaction TX i' , Tin represents the input of the transaction, and Tout represents the output of the transaction;

[0130] 4-3-6. Return ECI', to the SP;

[0131] 4-4. SP calculates Obtain Calculate and compare with , verify the integrity of ;

[0132] 4-5. SP obtains the voucher to confirm whether the RA is qualified to obtain the service; if qualified, provide the service interface to the RA, otherwise reject the service request;

[0133] Further, the step 5 is specifically as follows:

[0134] When a certain audit node CS in the distributed regulatory authority DRA j finds malicious behavior, invokes the smart contract SC reg to other audit nodes CS in the DRA i Apply for joint supervision, when more than k CS i (including CS j ) agree, CS j retrieves the Paillier private key of the DRA through the Dss.Rcv algorithm The specific process is as follows:

[0135] First, each CS participating in joint supervision i downloads the public key of the behavior chain BC calculates and sends to the smart contract SC reg ;

[0136]

[0137] (x' i ,y' i ) represents the point coordinates obtained by the point multiplication (i.e. scalar multiplication) of the private key of the audit node CS i and the behavior chain public key.

[0138] Then, the smart contract SC reg calculates Y' i =x' i +y' i , i = 1, 2, … k and where x i is the point coordinate x' i obtained by the point multiplication of the private key of CS i and the behavior chain public key. The smart contract SC reg constructs k points and does Lagrange interpolation to obtain a k-1 degree polynomial g(x), see formula 24, then calculates g(0) value, which is the Pailler private key

[0139]

[0140] 5-1. Tracking and tracing of malicious clones

[0141] The smart contract SC reg uses Decryption of the clone RA's regulatory factor σ DRA Obtain the DID of the digital avatar GA RA , and then obtain the personal identification information PII of the natural person uniquely mapped by GA GA , to realize the tracking and tracing of RA, the specific process is as follows:

[0142] 5-1-1. Smart contract SC reg Through transaction TX i' Obtain σ DRA , And calculate Obtain DID RA ; further calculate Obtain DID GA ;

[0143] 5-1-2. Smart contract SC reg Send DID i to all CS GA , CS i query DID GA according to the index, obtain the identity information fragments saved locally belonging to RA and return to the smart contract SC reg ;

[0144] 5-1-3. When the number of fragments exceeds the threshold number of time, the smart contract SC reg can restore PII GA by Lagrange interpolation algorithm and send it to the initiator CS j , that is, the tracking and tracing of RA is completed;

[0145] 5-2. Verification of reporting malicious service provider information

[0146] The clone RA reports to the distributed regulatory authority DRA that the service provider SP has the suspicion of leaking its privacy information, and the DRA verifies the authenticity of the report information by comparing the on-chain and off-chain , the specific process is as follows:

[0147] 5-2-1. RA sends j to CS to initiate a regulatory application for SP;

[0148] 5-2-2. CS j calls the smart contract SC reg to decrypt c to obtain and calculate

[0149] 5-2-3. Smart contract SC reg obtains σ from transaction TX2DRA , compute obtain and compare, if the hash value of the credential is consistent, it is considered that the service provider SP indeed exists the suspicion of leaking the privacy of RA.

[0150] The experimental data are shown in Table 1, wherein T SM represents a scalar multiplication operation in an elliptic curve; T ME is a modular exponentiation operation; T L (n) is a Lagrange interpolation operation on n points (n is 5); T SHR (n) is a secret value split into n pieces by a shamir secret sharing algorithm (n is 5); T H is a SHA256 hash operation; T P is a bilinear pairing operation; the experimental results in the table are average values of 1000 times of algorithm running.

[0151] Table 1 Time consumption (ms) of basic operations

[0152] Operation [CAT SM ]]> [CAT ME ]]> T L (n)]]> T SHR (n)]]> [CAT H ]]> [CAT P ]]> Time / ms 0.0002 0.0014 0.0061 0.0162 0.0012 5.1422

[0153] As shown in Table 2, the initialization stage of the scheme includes system initialization and digital avatar generation, and mainly performs initialization of behavior chain public parameters and public and private keys of elliptic curves of each entity, construction of two parts of the avatar, and a total of 0.0185 ms; in the authentication stage, the scheme performs multiple elliptic curve private key decryption and chameleon hash operations, and a total of 0.0138 ms; finally, in the supervision stage, the supervision overhead of the digital avatar and the service provider of the scheme is consistent, and the Lagrange interpolation and Paillier decryption are performed on multiple points, and a total of 0.0099 ms. In the authentication and supervision stage, the scheme has obvious advantages in the calculation overhead compared with other schemes.

[0154] Table 2 Time overhead (ms)

[0155]

[0156] The scheme designs the interactive authentication and joint supervision mechanism in a decentralized manner, and protects the identity and behavior privacy of the digital avatar while realizing the authentication and supervision, and has all the privacy protection and security attributes in Table 3

[0157] Table 3 Comparison of privacy protection and security attributes

[0158]

[0159] The storage cost of the above scheme is compared and analyzed, and the result is as follows Figure 2 ​As shown, the bar chart compares storage costs from the perspectives of digital identity, server, and blockchain, while the line chart reflects the total cost of each comparison scheme.

[0160] The various existing methods provided in this invention may be provided with corresponding literature if needed.

[0161] In this scheme, the digital avatar needs to store approximately 256 + 64 + 32 = 352 bytes of verifiable credentials, a chameleon hash private key, and an avatar's authenticity authentication key. The server needs to store 64 bytes of off-chain identity authentication factors, 5 * 256 bytes of Shamir fragments of the avatar's Personal Identification Information (PII) used for regulatory traceability, 32 bytes of the server's authentication key, and the Paillier private key. The sharding is 5*165 bytes, totaling 64 + 5*256 + 32 + 5*165 = 2201 bytes. The blockchain needs to store 64 bytes of elliptic curve and blockchain public parameters, approximately 60 bytes of avatar attribute metadata, and 328 bytes of on-chain identity authentication factors, totaling 64 + 60 + 328 = 452 bytes. Compared to the literature review, the total overhead of this paper is moderate and slightly better than other solutions.

Claims

1. A digital avatar interaction authentication method with behavior privacy protection and supervision, characterized in that, Comprising the following steps: Step 1. System initialization: initialization of all entities in the system model; Step 2. Digital avatar generation: derivation of a digital avatar for a digital avatar and initialization of related parameters; Step 3. Construction of one access one ID: construction of an authentication factor for a digital avatar when performing each service authentication; Step 4. On-chain and off-chain interaction authentication: completion of service provider verification of avatar service requests; Step 5. Malicious entity supervision: realization of the supervision party's tracking and tracing of malicious digital avatars under certain conditions and verification of information reporting malicious service providers; Step 3 is specifically as follows: The split RA generates unlinkable access for each service access to a service provider SP The specific process is as follows: 3-1. RA builds OnAf, wherein ECI is a cryptographic credential information, and its calculation formula is as follows: OnAf = {ECI, T Exp , σ DRA} (12) Wherein, VC w Refers to the credential containing the value corresponding to the w attribute, ef1 is a randomly generated blinding factor, E pa () indicates that the public key encryption operation is used by the Paillier algorithm; T Exp Indicates the validity period; Salt is a random number salt value, used to prevent being linked, σ DRA Indicates the intermediate parameter; 3-2. RA performs KeyGen ch (.) Obtain one-time chameleon hash public-private key 3-3. RA obtains parameters (CP r , CP s ) through a chameleon hash collision function CH.Col(.) of the RA, wherein ef2 is a randomly generated blinding factor: 3-4. RA will upload the chameleon hash parameters along with OnAf utilizing transaction TX i Behavior chain BC, transaction number TID i Unique non-linkable ID as ith service visit: M i = {OnAf, (CP r , CP s )} (17) wherein, is the non-linkable ID of the ith access to the SP service, ω contains the signature and other verification data for verifying the validity of the transaction, M i represents the transaction content.

2. The digital avatar interaction authentication method with behavior privacy protection and supervision according to claim 1, characterized in that, Step 1 is specifically as follows: Step 1 is specifically as follows: 1-1. Synchronize the behavior chain and the distributed supervision authority The distributed regulatory authority DRA is composed of n0 audit nodes CS i Each CS i At the same time, as a consortium chain node, it builds and maintains the behavior chain BC, and BC performs system initialization to generate system public parameters: First, the BC selects a large prime number p and a finite field F p Next, the BC selects an elliptic curve E p (a, b) and a base point G on the elliptic curve E p (a, b) with order n, where n is a large prime number; then, the BC initializes to generate its public and private key pair and calls the Paillier key generation algorithm KeyGen pa to generate the Paillier homomorphic encryption public and private keys for the DRA Specifically, first, two large prime numbers p and q are randomly selected, which satisfy gcd(pq, (p-1)(q-1)) = 1, n1 = pq and λ = lcm(p-1, q-1) are calculated; second, a random number g is selected where Finally, the specific content of the public and private keys is shown in Formula 1 and Formula 2. Secondly, each audit node CS of the DRA i Based on the elliptic curve parameters {p, E p (a, b), G, n}, generate the respective public and private key pairs Then, the BC uses the public key of the audit node CS i and the dynamic threshold secret sharing technology to fragment the Pailier homomorphic encryption private key of the DRA , and generate Finally, the publishing system discloses the parameters P to the genesis block, where k is the threshold for recovering the secret The public parameters P are as follows:​ 1-2. Deploy the smart contract on the behavior chain Deploying a smart contract SC on the behavior chain BC that participates in the digital avatar interaction authentication ver and discloses its contract address; the service provider SP calls the smart contract for verification and resolution; 1-3. Calculate the elliptic curve public and private key pair of all entities The service provider SP, the digital avatar GA and the credential issuer ISR all generate their respective public-private key pairs from the public parameters P {p, E p (a,b), G, n} to generate their respective public-private key pairs 1-4. Service provider sets avatar attribute meta information and chains it publicly The service provider SP applies to the distributed regulatory authority DRA for providing services in the metaverse, and the DRA builds an authentication key AK for verifying a legal digital avatar for the compliant SP SP and sends it to the SP; in addition, the service provider SP needs to disclose the attributes of the identity information to be verified Specifically as follows: wherein H() represents a hash function, Attr i , (i = 1, 2, … num) represents an attribute, and num represents the number of attributes. 1-5. Digital avatar obtains and maintains a verifiable credential set The digital avatar GA applies for a verifiable credential from different credential issuing parties ISR, and locally maintains a set of all credentials {VCs}.

3. The digital avatar interaction authentication method with behavior privacy protection and supervision according to claim 2, characterized in that, Step 2 is specifically as follows: After system initialization, the digital avatar GA respectively derives a sub-avatar RA for different services, and the RA needs to request a real-time verification from the distributed supervision authority DRA, and the DRA creates a real-time authentication key for the RA after real-time verification of the RA, and the specific process is as follows: First, the digital avatar GA possesses a DID GA , and an authentication factor AF; where r1 is a random number, is a Paillier public key of the DRA; wherein the DID GA represents a decentralized identifier of the avatar, represents a public key of the digital avatar GA, represents a private key of the digital avatar GA; In the process of creating the GA, the system records the personal identification information of the digital avatar as PII GA , divides the PII into n0parts with Shamir(t, n) algorithm, and distributes them to each CS GA i , each CS i stores the personal identification information fragments of the GA with DID GA as the index where x i represents the index of the fragment, which is an integer, and is used to identify the position of each fragment in the Shamir algorithm, represents the personal identification information PII GA of the i-th fragment;​ Next, the digital avatar GA obtains the public information of the service provider SP from the behavior chain BC: and and calls the split body generation algorithm to obtain the split body RA.

4. The digital avatar interaction authentication method with behavior privacy protection and supervision according to claim 3, characterized in that, The sub-avatar generation algorithm is specifically implemented as follows: define a digital avatar GA, an authentication factor AF of the GA, a set of credentials {VCs} maintained by the GA, a Paillier public key of a distributed supervisory authority a public key of a service provider SP and an identity information attribute to be verified and a public parameter P of a behavior chain BC, while defining a DID RA as follows: wherein DID RA represents a decentralized identifier of the avatar RA, is an exponentiation operation on the public key of the service provider SP, r is a random number, AF RA represents an intermediate parameter; The specific implementation process is as follows: ①construct w is attribute in vc w refers to a credential containing the value corresponding to the w attribute; ii. Randomly select an integer 2≤d≤n-1 based on the initialization parameter P of the blockchain, and calculate the public key The corresponding private key ③ Inherit the identity authentication function function F of GA Auth () ; Return RA, as shown in formula 11: Finally, the GA sends the DID to the distributed regulatory authority DRA RA and The DRA invokes the smart contract SC reg Computes Obtains the DID GA , D pa () represents the Paillier algorithm using the private key decryption operation; determine whether the DID GA exists, if it exists, the verification is passed and the authenticity authentication key is sent to the RA.

5. The digital avatar interaction authentication method with behavior privacy protection and supervision according to claim 4, characterized in that, Step 4 is specifically as follows: OnAf constructed in the access ID phase is used for on-chain verification of the service provider; then, the Doppelganger RA uses a unique unlinkable and authenticity attestation key AK issued by the DRA RA An off-chain identity authentication factor OfAf is constructed, and ef3 is a randomly generated blinding factor; finally, the RA sends OfAf to the service provider SP; M2= ef3- DID RA (21) Wherein M1 and M2 represent intermediate parameters; After receiving the off-chain identity authentication factor OfAf sent by the avatar RA, the service provider SP decrypts the OfAf content with the private key decrypts the OfAf content and verifies the authenticity of the RA, and then calls the smart contract SC ver to verify and parse the on-chain authentication factor OnAf, so as to judge whether to provide the corresponding service for the avatar, and the specific steps are as follows: 4-1. SP pass decrypting OfAf to obtain ef1, ef2, H(M1), M2; 4-2. SP Calculation of H(M2·AK) SP It is then compared with H(M1) to determine whether the clone is authorized by the Distributed Regulatory Authority (DRA), i.e., to verify the authenticity of the RA; if the comparison results are equal, the subsequent steps are continued; otherwise, the service request is rejected. 4-3. SP with As input, the smart contract SC ver to implement the verification and resolution; 4-4. SP computation obtained calculated compared with verified for integrity ​ 4-5. SP confirms whether the RA is eligible to obtain the service by the obtained credentials; if eligible, provides the service interface to the RA, otherwise rejects the service request. come eligible, provides the service interface to the RA, otherwise rejects the service request.

6. The digital avatar interaction authentication method with behavior privacy protection and supervision according to claim 5, characterized in that, Step 4-3 is specifically as follows: 4-3-1. According to Obtaining transaction TX i , and transaction content M i = {OnAf, (CP r , CP s )}, the recipient public key in the transaction is Therefore, only the SP obtains the transaction content, and other SPs cannot obtain this transaction through the OfAf. 4-3-2. By retrieving the associated transaction TX i' If the transaction exists and its output address is empty, the function run is terminated to prevent a replay attack. 4-3-3. Verify whether the time exceeds the valid period T included in OnAf Exp If the time is exceeded, terminate. 4-3-4. Call the chameleon hash algorithm and XOR algorithm to calculate where, from the input of transaction TX i OnAf,CP r ,CP s from the content of transaction TX i ef2 from the input of SP; 4-3-5. The σ from OnAf is DRA with transaction TX i' uploading the behavior chain BC; wherein the transaction links the previous transaction TX i ; wherein TID i' represents a unique identification number of a transaction TX i' , Tin represents an input of the transaction, and Tout represents an output of the transaction; 4-3-6. Will Return to SP.

7. The digital avatar interaction authentication method with behavior privacy protection and supervision according to claim 6, characterized in that, Step 5 is specifically as follows: When a certain audit node CS in the distributed regulatory authority DRA j finds malicious behavior, it invokes the smart contract SC reg to other audit nodes CS in the DRA i to apply for joint supervision, when more than k CS i (including CS j ) agree, CS j restores the Paillier private key of the DRA through the Dss.Rcv algorithm The specific process is as follows: First, each CS participating in the joint supervision i the public key of the download behavior chain BC computing and sending to the smart contract SC reg ; (x i , y i ) denotes a point coordinate resulting from a point multiplication (i.e. scalar multiplication) by the private key of the auditing node CS i and the behavior chain public key; Then, the smart contract SC reg computes Y' i = x' i + y' i , i = 1, 2, … k and where x i is the point coordinate x' i obtained by point multiplication of the private key of CS i and the behavior chain public key; the smart contract SC reg constructs k points and performs Lagrange interpolation to obtain a k-1 degree polynomial g(x), see formula 24, and then calculates the value of g(0) as the Pailler private key 8. The digital avatar interaction authentication method with behavior privacy protection and supervision according to claim 7, characterized in that, Step 5 includes tracing and tracing of malicious avatars, smart contract SC reg With Decryption of the supervision factor σ of the avatar RA DRA Obtain the DID of the digital avatar GA RA , and then obtain the personal identification information PII of the natural person uniquely mapped by GA GA To realize the tracing of RA, the specific process is as follows: 5-1-1. Smart contract SC reg By transaction TX i' Obtain σ DRA , And calculate Obtain DID RA ; Further calculate Obtain DID GA ; 5-1-2. Smart contract SC reg to all CS i Send DID GA , CS i Query DID according to index GA , get the identity information fragments belonging to RA saved locally and return to smart contract SC reg ; 5-1-3. When the number of fragments exceeds the threshold number of time, the smart contract SC reg PII can be obtained by Lagrange interpolation algorithm GA , and sent to the initiator CS j , that is, the tracking of RA is completed.

9. The digital avatar interaction authentication method with behavior privacy protection and supervision according to claim 7, characterized in that, Step 5 includes verification of the report of malicious service provider information, the shill RA reports to the distributed regulatory authority DRA that the service provider SP has a suspicion of leaking its privacy information, and the DRA verifies the authenticity of the report information by comparing on-chain and off-chain The specific process is as follows: 5-2-1. RA to CS j sending filing a regulatory application against the SP; 5-2-2.CS j Call the smart contract SC reg Decrypt c to obtain And calculate 5-2-3. Smart contract SC reg From transaction TX2, obtain σ DRA , compute Obtain and compare with If the hash values of the credentials are consistent, it is considered that the service provider SP does indeed have a suspicion of leaking the privacy of RA.

Images