Distributed identity selective disclosure method and system

Abstract

The invention provides a distributed identity selective disclosure method and system, the format of an implicit certificate is used as a verifiable certificate of a user, only the Merkel tree root of the user is reflected in the certificate, and a user key pair using the certificate is calculated through parameters in the certificate; and the user can autonomously sign attribute information needing to be disclosed according to the public and private keys corresponding to the certificate. According to the method, the selective disclosure function of the user side attributes is added, the privacy of the user side is better protected, fine-grained control is carried out when the user side shows the attributes, excessive exposure of privacy information during identity verification of the user side is avoided, the authenticity and validity of data are ensured, meanwhile, the identity information of the user side is stored in combination with the block chain, and the user side experience is improved. The problems of data non-intercommunication and data privacy of the user sides are solved, and the privacy of the user sides is greatly protected.

Description

Technical Field

[0001] The present invention belongs to the field of distributed identity technology, and in particular relates to a distributed identity selective disclosure method and system. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] With the rapid development of information technology and the popularization of the Internet, traditional centralized identity management systems are facing more and more challenges and limitations. Traditional authentication and authorization methods often rely on a single centralized identity provider (such as an institution or enterprise). This system not only has security and privacy protection issues, but also limits the user's secure and convenient management of identity data in different networks and applications.

[0004] Traditional centralized identity management systems usually use centralized databases to store and manage user identity information. When using various online services, users need to submit the same identity information for verification multiple times, which not only increases the complexity of the user's operation, but also increases the risk of data leakage and identity theft. In addition, centralized identity management agencies are easy targets for attackers. Once the system is attacked or fails, it may lead to large-scale data leakage and service interruption, seriously affecting the trust of users and the stability of services.

[0005] In terms of privacy protection, traditional identity management often requires users to disclose too much personal information to prove the authenticity of their identity. This information disclosure not only affects the privacy rights of users, but may also be used for commercial purposes or illegal activities, increasing the risk of abuse and leakage of personal data. Summary of the invention

[0006] In order to solve the above problems, the present invention proposes a distributed identity selective disclosure method and system. The present invention utilizes a distributed identity management solution and adds a selective disclosure function of user attributes, which better protects the privacy of the user. Fine-grained control is performed when the user presents the attributes, avoiding excessive exposure of private information when verifying the identity, ensuring the authenticity and validity of the data, and combining the blockchain to store the user's identity information, solving the problem of user data non-interoperability and data privacy, and greatly protecting the user's privacy.

[0007] According to some embodiments, the present invention adopts the following technical solutions:

[0008] A distributed identity selective disclosure method comprises the following steps:

[0009] Each entity involved in the credential transfer generates its own D ID identity, including its own public and private key pairs;

[0010] Generate kilobit prime numbers and elliptic curves based on preset security parameters;

[0011] The user selects a random number as a private key, combines it with the base point of the elliptic curve, calculates the public key, generates a certificate request, and sends the certificate request to the issuer;

[0012] The issuing party receives the certificate request, uses the elements in the attribute set as the leaf nodes of the Merkle tree, obtains the root node through the hash algorithm, selects a random number, calculates the public key reconstruction value, and generates a master certificate by combining the root node, the base point of the elliptic curve, the random number and the user's public key, and calculates the private key reconstruction value in combination with its own private key;

[0013] The user generates a certificate public key and a certificate private key according to the public key reconstruction value and the private key reconstruction value;

[0014] The user signs and calculates the sub-credential based on the attribute set, the root node of the Merkle tree, and the verification path from the leaf node to the root node;

[0015] The verifier receives the primary credential and the sub-credential, extracts the public key reconstruction value from them and calculates the credential public key, checks whether the signature meets the requirements, and checks whether the proof is valid.

[0016] As an optional implementation method, each entity involved in the credential circulation generates its own DID identity, including its own public-private key pair. The public key and private key of the issuer are represented as d_A and Q_A, the public key and private key of the user are represented as d_U and Q_U, and the public key and private key of the verifier are represented as d_V and Q_V, and a hash function and security parameters are defined.

[0017] As an optional implementation, the process of generating a kilobit prime number and an elliptic curve according to a preset security parameter includes: generating a kilobit prime number p and an elliptic curve E / F according to a given security parameter k p , the curve is defined in the finite field F p The base point is G, the order is n, and it is assumed that there is a collision-resistant hash function H: {0, 1} * →Z p .

[0018] As an optional implementation method, the user selects a random number as a private key, combines the base point of the elliptic curve, calculates the public key, generates a certificate request, and sends the certificate request to the issuing party. The process includes: the user randomly selects a random number as the private key K user , calculate the public key P user =K user G, the user generates a credential request And send the credential request req to the issuer.

[0019] As an optional implementation method, the issuing party receives the credential request, takes the elements in the attribute set as the leaf nodes of the Merkle tree, obtains the root node through the hash algorithm, selects a random number, calculates the public key reconstruction value, and generates a master credential by combining the root node, the base point of the elliptic curve, the random number and the public key of the user. The process of calculating the private key reconstruction value in combination with its own private key includes:

[0020] The elements in the attribute set are taken as leaf nodes of the Merkle tree, and the root node root=H(m1,…,m n );Generate(root,P user )→(Pub r , Prv r , Cert), the issuing party selects a random number K A , calculate Pub r =K A G+P user , generate the primary certificate Cert = root | | Pub r ; Calculate e = H1 (Cert), calculate the private key reconstruction value Prvv r =eK A +d A , where d A is A's private key.

[0021] As an optional implementation method, the process of generating the certificate public key and the certificate private key according to the public key reconstruction value and the private key reconstruction value includes the following steps: the user calculates e′=H1(Cert), the certificate public key Pub u =e′Pub r +Q A , certificate private key Prv u =e′K user +Prvv r , where Q A Verify Pub for the public key of the issuer u =Prv u G.

[0022] As an optional implementation method, the user signs according to the attribute set, the root node of the Merkle tree, and the verification path from the leaf node to the root node. The process of calculating the sub-credential includes: Proof(S, root, {P i} i∈S )→(π), that is, according to the attribute set S, the Merkle tree root node root, and the verification path from the leaf node to the root node {P i}i∈S , calculate the proof π of the leaf node verification path, and the proof π is defined as H path To verify the leaf node m i With path P i effectiveness;

[0023] Sign9π,Prvv r )→(π, Cert′), that is, randomly select a random number k, k∈[1, n-1], calculate the point R=(x1, y1)=kG, the signature parameter r=x1modn, if r=0, reselect the random number k, calculate h=H(π), calculate s=k -1 ·(h m +sk·r)modn, if s=0, reselect the random number k, sign σ=(r,s), and get the sub-certificate Cert′=σ||π.

[0024] As an optional implementation method, the verifier receives the primary credential and the sub-credential, extracts the public key reconstruction value from them and calculates the credential public key, checks whether the signature meets the requirements, and checks whether the proof is valid. The process includes: the verifier extracts the public key reconstruction value from the credential and calculates the credential public key Pub u =e′Pub r +Q A , the verifier checks whether the signature σ=(r, s) satisfies 1≤r≤n-1 and 1≤s≤n-1, and calculates h=H(π), w=s -1 modn, u1=h·wmodn, u2=r·wmodn, calculate R=(x, y)=u1·G+u2·Pub u If point R=O, output 0; otherwise compare whether v=x1modn; finally check whether the proof of π is valid.

[0025] A distributed identity selective disclosure system, comprising:

[0026] The user side is used to participate in the self-generation of the DID identity, including the public-private key pair; select a random number as the private key, combine it with the base point of the elliptic curve, calculate the public key, generate a credential request, and send the credential request to the issuer; and generate the credential public key and credential private key according to the public key reconstruction value and the private key reconstruction value; sign and calculate the sub-credential according to the attribute set, the root node of the Merkle tree, and the verification path from the leaf node to the root node;

[0027] The issuing party is used to participate in the self-generation of the DID identity, including the public and private key pair; receiving the credential request, taking the elements in the attribute set as the leaf nodes of the Merkle tree, and obtaining the root node through the hash algorithm, and selecting a random number, calculating the public key reconstruction value, and combining the root node, the base point of the elliptic curve, the random number and the user's public key to generate the master credential, and combining its own private key to calculate the private key reconstruction value;

[0028] The verifier is used to participate in the self-generation of the D ID identity, including the public and private key pairs; receive the main certificate and sub-certificate, extract the public key reconstruction value from them and calculate the certificate public key, check whether the signature meets the requirements, and check whether the certificate is valid.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] The present invention proposes a distributed identity management solution, which adds a selective disclosure function of user attributes. This function better protects the privacy of users, performs fine-grained control when users present their attributes, avoids excessive exposure of private information when users verify their identities, ensures the authenticity and validity of data, and combines blockchain to store user identity information, thereby solving the problems of non-interoperability of user data and data privacy, and greatly protecting user privacy.

[0031] The present invention adopts the format of implicit certificate as the user's verifiable credential, which only reflects the user's Merkle tree root and calculates the user key pair using the certificate through the parameters in the certificate. The user can independently sign the attribute information that needs to be disclosed based on the public and private keys corresponding to the certificate.

[0032] The present invention can also avoid replay attacks. Even if an attacker intercepts a user's verifiable credentials, he cannot use the credentials to forge an identity, thereby ensuring that the user's identity information is only in the hands of the user.

[0033] The distributed identity management solution of the present invention provides users with a globally unified identity identifier and uses the format of an implicit certificate as the user's verifiable credential, solving the problem of users being unable to unify their identities across platforms and the problem of large-scale user data leakage.

[0034] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0036] Figure 1 The flowchart of an embodiment is shown in FIG. DETAILED DESCRIPTION

[0037] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0038] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0039] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0040] In the absence of conflict, the embodiments in this application and the features in the embodiments may be combined with each other.

[0041] Embodiment 1

[0042] A distributed identity selective disclosure method, such as Figure 1 As shown, the main designs include the user side (or called user), the verifier (or called verification agency) and the issuer (or called issuing agency), which are mainly implemented with the help of the blockchain system.

[0043] The parties are introduced as follows:

[0044] User (U): The actual owner of identity data. The user applies for credentials and verification credentials from the issuing agency and verification agency.

[0045] Issuing authority (A): The issuing authority is the entity that issues the certificate. The issuing authority receives the certificate application sent by the user and verifies the user's identity.

[0046] Verification Authority (V): A verification authority is a party that verifies credentials. Its functions include verifying credentials, verifying zero-knowledge proofs, and verifying signatures.

[0047] Blockchain ledger: The blockchain ledger is a public platform for storing hash values ​​of various identity attributes to ensure the integrity and reliability of the data.

[0048] Then the algorithm mainly involved in this embodiment is introduced:

[0049] Setup(1 λ )→pp: This algorithm is used to generate system public security parameters. λ is the system security parameter, input 1 λ, output system public parameters pp.

[0050] Run by the data owner U. Where pp is a public parameter, Is a collection of attributes. Input attribute collection Output U sends the certificate request req to the issuing party A.

[0051] Credential generation consists of two algorithms.

[0052] This algorithm is used to generate a Merkle tree and verify the root node.

[0053] Generate(root,P user )→(Pub r , Prv r , Cert): Input the Merkle tree root node root and U’s public key P user , verify whether the U attribute is legal. Output the public key reconstruction value Pvb r , Private key reconstruction value Prv r And the primary certificate Cert.

[0054] CertExtraction(Pub r , Prv r )→(Pub u , Prv u ): User U runs the algorithm and inputs the public key to reconstruct the value Pub r And the private key reconstruction value Prv r , output certificate public key Pub u And the certificate private key Prv u .

[0055] CertPresentation(S,root,{P i} i∈S , Prv r )→(Cert′): The user runs the algorithm and inputs the disclosed attribute set S, the Merkle tree root node root, and the verification path from the leaf node to the root node {P i} i∈S . Output sub-certificate Cert′.

[0056] Proof(S, root, {P i} i∈S )→(proof): This algorithm is used to generate a zero-knowledge proof of the verification path of the Merkle tree node.

[0057] Sign(Proof,Prv r)→(Cert′): This algorithm is used to sign the certificate obtained in the previous algorithm.

[0058] CertVerification(Cert, Cert′)→(1 / 0): The verifier runs the algorithm, which inputs the primary certificate and the sub-certificate and outputs 1 / 0.

[0059] in, represents the user's attribute set, root represents the root hash of the user attribute tree, P user Indicates the user's temporary key, Cert indicates a verifiable certificate, Pub r Represents the public key reconstruction value, Prv r Indicates the private key reconstruction value, Pub u Represents the certificate public key, Prv r represents the private key of the certificate, Cert represents the verifiable certificate (or master certificate), {P i} i∈S represents the set of Merkle tree verification paths, π represents zero-knowledge proof, and Cert′ represents the sub-certificate.

[0060] The specific steps are introduced below. The method of this embodiment mainly includes six stages: initialization stage, credential request stage, credential generation stage, credential acceptance stage, credential presentation stage, and credential verification stage.

[0061] In the initialization phase, all entities involved in the credential transfer first generate their own DID identities, including their respective public and private key pairs. The public and private keys of the issuer are represented as d_A and Q_A, the public and private keys of the user are represented as d_U and Q_U, and the public and private keys of the verifier are represented as d_V and Q_V. In addition to key generation, the hash function and security parameters used later also need to be defined at this stage.

[0062] Initialization phase:

[0063] Mainly use Setup(1 λ )→pp: Given a security parameter k, generate a kbit prime number p and an elliptic curve E / F p , the curve is defined in the finite field F p The base point is G and the order is n. Assume that there is a collision-resistant hash function H: {0, 1} * →Z p .

[0064] Credentials request phase:

[0065] CertRequest U randomly selects nb its random number as the private key K user , calculate the public key P user =Kuser G. Generate Credential Request And send req to the issuing party A.

[0066] Credential generation phase:

[0067]

[0068] Contains two algorithms:

[0069] The algorithm takes the elements in the attribute set as the leaf nodes of the Merkle tree and obtains the root node root=H(m1,…,m n ).

[0070] Generate(root,P user )→(Pub r , Prv r , Cert): A selects a random number K A , calculate Pub r =K A G+P user , generate certificate Cert = root | | Pub r . Calculate e=H1(Cert), calculate the private key reconstruction value Prvv r =eK A +d A , where d A is A's private key.

[0071] Credentials acceptance phase:

[0072] CertExtraction(Pub r , Prv r )→(Pub u , Prv u ):U calculates e′=H1(Cert), the certificate public key Pub u =e′Pub r +Q A , certificate private key Prv u =e′K user +Prvv r . Where Q A Is the public key of the issuing party A. Verify Pub u =Prv u G.

[0073] Credentials presentation stage:

[0074] CertPresentation(S,root,{P i} i∈S)→(π, Cert): The credential presentation includes two algorithms:

[0075] Proof(S, root, {P i} i∈S )→(π): The algorithm inputs the disclosure attribute set S, the Merkle tree root node root, and the verification path from the leaf node to the root node {P i} i∈S Output the proof π of the leaf node verification path. The proof π is defined as, H path To verify the leaf node m i With path P i effectiveness.

[0076] Sign(π,Prvv r )→(π, Cert′): Randomly select a random number k, k∈[1, n-1]. Calculate the point R=(x1, y1)=kG, signature parameter r=x1modn, if r=0, reselect the random number k, calculate h=H(π), calculate s=k -1 ·(h m +sk·r)modn, if s=0, reselect random number k. Signature σ=(r,s). Output sub-certificate Cert′=σ||π.

[0077] Credentials verification phase:

[0078] CertVerification(π, Cert, Cert′)→(1 / 0): The verifier V first extracts the public key reconstruction value in the certificate and calculates the certificate public key Pub u =e′Pub r +Q A V checks whether the signature σ=(r, s) satisfies 1≤r≤n-1 and 1≤s≤n-1, and calculates h=H(π), w=s -1 modn, u1=h·wmodn, u2=r·wmodn, calculate R=(x, y)=u1·G+u2·Pub u , if point R = O, then output 0. Otherwise, compare whether v = x1modn. Finally, check whether the proof of π is valid.

[0079] Embodiment 2

[0080] A distributed identity selective disclosure system, comprising:

[0081] The user side is used to participate in the self-generation of the DID identity, including the public-private key pair; select a random number as the private key, combine it with the base point of the elliptic curve, calculate the public key, generate a credential request, and send the credential request to the issuer; and generate the credential public key and credential private key according to the public key reconstruction value and the private key reconstruction value; sign and calculate the sub-credential according to the attribute set, the root node of the Merkle tree, and the verification path from the leaf node to the root node;

[0082] The issuing party is used to participate in the self-generation of the D ID identity, including the public and private key pair; receiving the certificate request, taking the elements in the attribute set as the leaf nodes of the Merkle tree, and obtaining the root node through the hash algorithm, and selecting a random number, calculating the public key reconstruction value, and combining the root node, the base point of the elliptic curve, the random number and the user's public key to generate the master certificate, and combining its own private key to calculate the private key reconstruction value;

[0083] The verifier is used to participate in the self-generation of the D ID identity, including the public and private key pairs; receive the main certificate and sub-certificate, extract the public key reconstruction value from them and calculate the certificate public key, check whether the signature meets the requirements, and check whether the certificate is valid.

[0084] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made by those skilled in the art within the spirit and principle of the present invention without creative labor shall be included in the protection scope of the present invention.

Claims

1. A distributed identity selective disclosure method, characterized in that: The following steps are involved: Each entity involved in the credential transfer generates its own DID identity, including its own public and private key pairs; Generate kilobit prime numbers and elliptic curves based on preset security parameters; The user selects a random number as a private key, combines it with the base point of the elliptic curve, calculates the public key, generates a certificate request, and sends the certificate request to the issuer; The issuing party receives the certificate request, uses the elements in the attribute set as the leaf nodes of the Merkle tree, obtains the root node through the hash algorithm, selects a random number, calculates the public key reconstruction value, and generates a master certificate by combining the root node, the base point of the elliptic curve, the random number and the user's public key, and calculates the private key reconstruction value in combination with its own private key; The user generates a certificate public key and a certificate private key according to the public key reconstruction value and the private key reconstruction value; The user signs and calculates the sub-credential based on the attribute set, the root node of the Merkle tree, and the verification path from the leaf node to the root node; The verifier receives the primary credential and the sub-credential, extracts the public key reconstruction value from them and calculates the credential public key, checks whether the signature meets the requirements, and checks whether the proof is valid.

2. A distributed identity selective disclosure method as claimed in claim 1, characterized in that: Each entity involved in the credential circulation generates its own DID identity, including its own public-private key pair. The issuer's public key and private key are represented as d_A and Q_A, the user's public key and private key are represented as d_U and Q_U, and the verifier's public key and private key are represented as d_V and Q_V, and the hash function and security parameters are defined.

3. A distributed identity selective disclosure method as claimed in claim 1, characterized in that: The process of generating a kilobit prime number and an elliptic curve according to a preset security parameter includes: generating a kilobit prime number p and an elliptic curve E / F according to a given security parameter k p , the curve is defined in the finite field F p The base point is G, the order is n, and it is assumed that there exists a collision-resistant hash function H: {0, 1} * →Z p .

4. A distributed identity selective disclosure method as claimed in claim 1, characterized in that: The user selects a random number as a private key, combines the base point of the elliptic curve, calculates the public key, generates a certificate request, and sends the certificate request to the issuing party. The process includes: the user randomly selects a random number as the private key K user , calculate the public key P user =K user G, the user generates a credential request And send the credential request req to the issuer.

5. A distributed identity selective disclosure method as claimed in claim 1, characterized in that: The issuing party receives the certificate request, takes the elements in the attribute set as the leaf nodes of the Merkle tree, obtains the root node through the hash algorithm, selects a random number, calculates the public key reconstruction value, and generates a master certificate by combining the root node, the base point of the elliptic curve, the random number and the public key of the user. The process of calculating the private key reconstruction value in combination with its own private key includes: The elements in the attribute set are taken as leaf nodes of the Merkle tree, and the root node root=H(m1,…,m n );Generate(root,P user )→(Pub r , Prv r , Cert), the issuing party selects a random number K A , calculate Pub r =K A G+P user , generate the primary certificate Cert = root | | Pub r ; Calculate e = H1 (Cert), calculate the private key reconstruction value Pr vv r =eK A +d A , where d A is A's private key.

6. A distributed identity selective disclosure method as claimed in claim 1, characterized in that: The process of generating the certificate public key and the certificate private key by the user according to the public key reconstruction value and the private key reconstruction value includes the following steps: the user calculates e′=H1(Cert), the certificate public key Pub u =e′Pub r +Q A , certificate private key Prv u =e′K user +Pr vv r , where Q A Verify Pub for the public key of the issuer u =Prv u G.

7. A distributed identity selective disclosure method as claimed in claim 1, characterized in that: The user signs according to the attribute set, the root node of the Merkle tree, and the verification path from the leaf node to the root node. The process of calculating the sub-credential includes: Proof(S, root, {P i } i∈S )→(π), that is, according to the attribute set S, the Merkle tree root node root, and the verification path from the leaf node to the root node {P i } i∈S , calculate the proof π of the leaf node verification path, and the proof π is defined as H path To verify the leaf node m i With path P i effectiveness.

8. A method for selectively disclosing a distributed identity as claimed in claim 7, characterized in that the user The party also randomly selects a random number k, k∈[1,n-1], calculates the point R=(x1,y1)=kG, and the signature parameter r=x1modn. If r=0, reselect the random number k, calculate h=H(π), and calculate s=k -1 ·(h m +sk·r)modn, if s=0, reselect the random number k, sign σ=(r,s), and obtain the sub-certificate Cert′=σ||π.

9. A distributed identity selective disclosure method as claimed in claim 1, characterized in that: The verifier receives the primary certificate and the sub-certificate, extracts the public key reconstruction value from them and calculates the certificate public key, checks whether the signature meets the requirements, and checks whether the certificate is valid. The process includes: the verifier extracts the public key reconstruction value from the certificate and calculates the certificate public key Pub u =e′Pub r +Q A , the verifier checks whether the signature σ=(r, s) satisfies 1≤r≤n-1 and 1≤s≤n-1, and calculates h=H(π), w=s -1 modn, u1=h·wmodn, u2=r·wmodn, calculate R=(x, y)=u1·G+u2·Pub u If point R=O, output 0; otherwise compare whether v=x1modn; finally check whether the proof of π is valid.

10. A distributed identity selective disclosure system, characterized in that: include: The user side is used to participate in the self-generation of the DID identity, including the public-private key pair; select a random number as the private key, combine it with the base point of the elliptic curve, calculate the public key, generate a credential request, and send the credential request to the issuer; and generate the credential public key and credential private key according to the public key reconstruction value and the private key reconstruction value; sign and calculate the sub-credential according to the attribute set, the root node of the Merkle tree, and the verification path from the leaf node to the root node; The issuing party is used to participate in the self-generation of the DID identity, including the public and private key pair; receiving the credential request, taking the elements in the attribute set as the leaf nodes of the Merkle tree, and obtaining the root node through the hash algorithm, and selecting a random number, calculating the public key reconstruction value, and combining the root node, the base point of the elliptic curve, the random number and the user's public key to generate the master credential, and combining its own private key to calculate the private key reconstruction value; The verifier is used to participate in the self-generation of the DID identity, including the public and private key pairs; receive the main certificate and sub-certificate, extract the public key reconstruction value from them and calculate the certificate public key, check whether the signature meets the requirements, and check whether the certificate is valid.

Images