Anonymous network identity authentication method and system based on trusted root generation

Abstract

The invention relates to an anonymous network identity authentication method and an anonymous network identity authentication system generated based on a trusted root, which realize anonymous generation and controlled privacy protection of a trusted identity identifier of an anonymous network of a user and solve the problems of leakage of user network identity information and track link. Generating a user registration private key on a user side; generating a user anonymous network trusted identity identifier corresponding to the application party based on the user registration private key; signing the trusted identity label of the anonymous network and the application domain information through a user registration private key; the application side verifies the correctness of the user signature information by using the trusted identity management platform public parameter, the application domain public parameter and the user anonymous network trusted identity identifier, and completes the anonymous network identity authentication of the user in the application domain; when there is a supervision demand for the user identity, the trusted identity management platform can trace the anonymous network trusted identity label to track the real identity information of the user.

Description

Technical Field

[0001] The present invention relates to the fields of computer technology and information security technology, and in particular to an anonymous network identity authentication method and system based on trusted root generation. Background Art

[0002] In recent years, in order to effectively resist the problem of unauthorized users or attackers illegally collecting users' real identity information, various network application service providers have adopted decentralized and independent establishment of user network identities, using account and password identity authentication methods; or requiring users to submit real identity information to the center for unified authentication and supervision; or requiring users to use network identity accounts generated by third-party applications and authorize login for identity authentication. However, there are the following defects: (1) The account and password authentication method is a low-security authentication technology that is easy to crack and cannot directly meet the real-name supervision requirements; (2) The centralized identity authentication method makes massive real-name identity information concentrated in the central system. Once the central authentication system fails, it is easy to cause a complete system shutdown due to a single point of failure; (3) The method of using third-party application accounts to authorize user network identities does not generate a unified trusted root, and cannot enable users to have a global identity, which cannot meet the needs of mutual recognition of multiple applications; (4) The unified authentication platform will collect and retain a large amount of user-related plaintext information, and cannot guarantee the privacy and security of the user's network identity. To sum up, the current network identity only achieves basic real-name in the background and anonymity in the front. It lacks effective technical means to solve problems such as network identity trust, privacy protection, identity supervision and concurrent authentication in the context of multi-application integration.

[0003] To this end, an effective method for generating user network identities is needed to ensure that the real-name system supervision requirements can be met and that the network identity is a network trusted identity generated based on a trusted root. At the same time, it is also necessary to ensure the anonymity of the generated network identity among applications, users, and other parties, to protect the privacy and security of user network identity information, and to ensure that no third-party agency is involved in the authentication process. Different applications can independently implement distributed public authentication of user network trusted identities, effectively avoiding single point failures caused by centralized authentication, and achieving truly anonymous authentication in the foreground and real-name supervision in the background. Summary of the invention

[0004] In view of the above analysis, the present invention aims to provide an anonymous network identity authentication method and system based on trusted root generation, which realizes the anonymous generation and controlled privacy protection of the user's anonymous network trusted identity identification, and solves the problems of user network identity information leakage and trajectory linking.

[0005] The purpose of the present invention is mainly achieved through the following technical solutions:

[0006] The present invention discloses an anonymous network identity authentication method based on trusted root generation, comprising:

[0007] The trusted identity management platform generates a public and private key pair and public parameters of the trusted identity management platform;

[0008] The user's real identity is used as the trusted root, based on the trusted root, the trusted identity management platform private key and the user's collaborative calculation, to generate the user registration private key on the user side;

[0009] Based on the user registration private key, generate a user anonymous network trusted identity corresponding to the application party;

[0010] The anonymous network trusted identity and application domain information are signed by the user registered private key, and the user-signed information is sent to the application party; the application domain information includes the application party ID, application domain public parameters and trusted identity management platform public parameters;

[0011] The application party uses the public parameters of the trusted identity management platform, the public parameters of the application domain and the user's anonymous network trusted identity to verify the correctness of the user's signature information and complete the user's anonymous network identity authentication in the application domain.

[0012] Furthermore, the method of using the user's real identity as a trusted root and generating a user registration private key based on the trusted root and a private key of a trusted identity management platform on the user side includes:

[0013] Sending a registration request to the trusted identity management platform through the user device;

[0014] After the trusted identity management platform returns a response, sending the trusted root to the trusted identity management platform;

[0015] Verify the authenticity of the user's network identity information through the trusted identity management platform; if the verification is successful, collaborative calculation is performed with the user based on the trusted root and the trusted identity management platform private key;

[0016] Based on the collaborative calculation result, a user registration private key tightly coupled with the real identity is generated on the user device side.

[0017] Furthermore, the generating of a user anonymous network trusted identity corresponding to the application party based on the user registration private key includes:

[0018] Create a corresponding application domain public and private key pair for the application party through the trusted identity management platform; and send the application domain public parameters and the trusted identity management platform public parameters to the user;

[0019] The correctness of the domain public parameters and the trusted identity management platform public parameters are verified through the user device; if the verification passes, an anonymous network trusted identity of the user for the corresponding application domain is generated based on the domain public parameters, the trusted identity management platform public parameters and the user registration private key.

[0020] Further, based on the collaborative calculation result, a user network trusted identity parameter tightly coupled with the real identity is generated on the trusted identity management platform side, and a corresponding relationship table between the user real identity and the user network identity parameter is recorded to obtain a user real identity list;

[0021] It also includes retroactive supervision of user network identities, including:

[0022] The application party sends the information including the anonymous network trusted identity identifier, the application domain public parameters, and the trusted identity management platform public parameters to the trusted identity management platform through the supervisor;

[0023] The trusted identity management platform performs open calculation on the anonymous network trusted identity identifier through the application domain public parameters and the trusted identity management platform public parameters to obtain the user network identity parameters, searches in the user real identity list to obtain the user's real identity, and sends the user's real identity information to the supervisor for supervision.

[0024] On the other hand, it also includes an anonymous network identity authentication system based on a trusted root, including: a user device, a trusted identity management platform and an application party;

[0025] The user device is used to collaboratively calculate with the trusted identity management platform to generate a user registration private key, and generate a user anonymous network trusted identity corresponding to the application party based on the user registration private key;

[0026] The trusted identity management platform is used to generate user network trusted identity parameters tightly coupled with the user's real identity information based on the user's real identity information including the trusted root and the user's device in a collaborative calculation, and to generate corresponding application domain public and private key pairs and application domain public parameters for different application domains;

[0027] The application party is used to verify the correctness of the application domain information and the authenticity of the user signature information, and realize anonymous network trusted identity authentication.

[0028] Further, the user equipment includes an anonymous network trusted identity terminal management module and a user identity key management module;

[0029] The user identity key management module is used to coordinate calculation with the trusted identity management platform to obtain and store the user registration private key that is tightly coupled with the user's real identity;

[0030] The anonymous network trusted identity terminal management module is used to generate corresponding anonymous network trusted identity for different application parties based on the user registration private key.

[0031] Furthermore, for different application parties, generating corresponding trusted identity identifiers based on user registration private keys includes:

[0032] Create an application domain public and private key pair for the application party through the trusted identity management platform; and send the application domain public parameters and the trusted identity management platform public parameters to the user;

[0033] The correctness of the domain public parameters and the trusted identity management platform public parameters are verified through the user device; if the verification passes, a trusted identity identifier for the corresponding application domain is generated based on the domain public parameters, the trusted identity management platform public parameters and the user registration private key.

[0034] Furthermore, the trusted identity management platform is used for user registration and application domain management, including a user registration and private key negotiation module and a domain management module;

[0035] The domain management module is used to create domain public and private key pairs, domain public parameters, and trusted identity management platform public parameters of different application domains, and disclose the domain public parameters and trusted identity management platform public parameters to user devices;

[0036] The user registration and private key negotiation module is used to, after verifying the real identity of the user, use the real identity of the user as a trusted root, and collaboratively calculate with the user to generate user network trusted identity parameters that are tightly coupled with the real identity of the user.

[0037] Furthermore, the trusted identity management platform also includes an anonymous network trusted identity storage and revocation module and an anonymous network trusted identity opening module for identity supervision and revocation;

[0038] The anonymous network trusted identity storage and revocation module is used to verify the legitimacy of the request for revocation of the identity based on the user's request, add the user's anonymous network trusted identity to the revocation list and publish it; and store the corresponding table between the user's network trusted identity parameters and the user's real identity information for finding the real user;

[0039] The anonymous network trusted identity identification opening module is used to calculate and search for a user's real identity list based on the anonymous network trusted identity identification, domain public parameters, and trusted identity management platform public parameters using an identification opening algorithm, and trace back to the user's real identity to supervise the user's network identity.

[0040] Furthermore, the application party includes an anonymous network trusted identity verification module; which is used to verify the correctness of the application domain information using domain public parameters and trusted identity management platform public parameters; and authenticate the user's registered private key signature information through the anonymous network trusted identity, domain public parameters and trusted identity management platform public parameters to determine the correctness of the anonymous network trusted identity and user signature.

[0041] The beneficial effects of the present invention are as follows:

[0042] The present invention generates anonymous network trusted identity identification, user registration private key and domain public parameters, trusted identity management platform public parameters and other application domain information based on the user's real identity information including a trusted root. The application party verifies the user's registration private key signature information by using the anonymous network trusted identity identification, domain public parameters, trusted identity management platform public parameters and other application domain information to determine whether the anonymous network trusted identity identification is a network trusted identity that has been verified by the trusted identity management platform. The supervisor can trace the user's real identity information through the identification opening operation. Thereby, the trusted identity management platform uniformly issues identities, users and the trusted identity management platform jointly generate anonymous network trusted identities, apply distributed authentication identities, and network identities can be supervised. It ensures that the identity identification of the same user in different application domains cannot be linked, and solves the problems of anonymous generation, controlled privacy protection and distributed authentication of user anonymous network trusted identities.

[0043] The application party obtains anonymous user network identity information and cannot decrypt it to obtain the user's real identity information, thus protecting the privacy and security of the user's network identity information.

[0044] Different applications can realize distributed authentication of users' global network trusted identities, solve problems such as system shutdown caused by single point failures in centralized identity authentication, and effectively ensure the authenticity and legitimacy of users' network identities. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The accompanying drawings are only used for the purpose of illustrating specific embodiments and are not to be considered as limiting the present invention. In the entire drawings, the same reference symbols represent the same components;

[0046] Figure 1 This is a flow chart of an anonymous network identity authentication method based on a trusted root according to an embodiment of the present invention;

[0047] Figure 2 The figure is a block diagram of an anonymous network identity authentication system based on a trusted root according to an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The preferred embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used to illustrate the principles of the present invention together with the embodiments of the present invention.

[0049] Embodiment 1

[0050] This embodiment discloses an anonymous network identity authentication method based on a trusted root. Figure 1 As shown, the following steps are included:

[0051] Step S1: The trusted identity management platform generates a public and private key pair and public parameters of the trusted identity management platform; the user's real identity is used as a trusted root to register on the trusted identity management platform, and a user registration private key is generated based on the trusted root, the trusted identity management platform private key and the user's collaborative calculation;

[0052] Specifically, the user registration private key is generated by the following method:

[0053] Sending a registration request to the trusted identity management platform through the user device;

[0054] After the trusted identity management platform returns a response, sending the trusted root to the trusted identity management platform;

[0055] The authenticity of the user's network identity information is verified through the trusted identity management platform; if the verification is successful, a user registration private key that is tightly coupled with the real identity is generated on the user device side based on the trusted root, the trusted identity management platform private key and the user, for example, through secure multi-party computing; the user's network trusted identity parameters that are tightly coupled with the real identity are generated on the trusted identity management platform side, and the correspondence table between the user's real identity based on the trusted root and the user's network identity parameters is recorded to obtain a list of user's real identities; the user's network trusted identity parameters can be a string of numbers for traceability and supervision.

[0056] Exemplarily, during the user registration process, a registration request is sent to a trusted identity management platform (IDP) through a user device. After the trusted identity management platform returns a response, the user sends his or her real identity information, such as ID number, name, phone number, etc., to the trusted identity management platform, and the entire stage is transmitted in a secure channel. After the trusted identity management platform verifies the authenticity of the identity uploaded by the user, it collaborates with the user to calculate the user network trusted identity parameters that are tightly coupled to the real identity based on the trusted root of the real identity (such as ID number, phone number, etc.), and records the corresponding relationship table between the user and the parameters for traceability. At the same time, the user device and the trusted identity management platform collaborate to calculate and generate a user registration private key that is tightly coupled to the real identity.

[0057] Step S2: Based on the user registration private key, generate the user anonymous network trusted identity corresponding to the application party;

[0058] Specifically, first, the trusted identity management platform (IDP) initializes the application domain, creates a corresponding application domain public-private key pair for the application party through the trusted identity management platform, for example, generates the application domain public-private key pair through an asymmetric key algorithm; and sends the application domain public parameters (such as application domain ID, application domain public key, etc.) and the trusted identity management platform public parameters (IDP public key, etc.) to the user;

[0059] Then, the correctness of the application domain public parameters and the trusted identity management platform public parameters are verified through the user device. Specifically, the application domain public key and the trusted identity management platform public key can be used to verify the information signed by the trusted identity management platform private key to ensure the correctness and legality of the application domain public parameters and the trusted identity management platform public parameters received by the user device; if the verification passes, an anonymous network trusted identity for the user corresponding to the application domain is generated based on the application domain public parameters, the trusted identity management platform public parameters and the user registration private key. In actual applications, an anonymous network trusted identity representing the user identity corresponding to the application domain can be generated through secure multi-party computing.

[0060] In this embodiment, the trusted root can be various types of information that can identify the user's identity, such as citizen identification number, telephone number, bank card number, etc. The anonymous network trusted identity is a provably secure anonymous mapping that is tightly coupled with such identity information of the user. In the anonymous network trusted identity generation stage, the trusted identity management platform first verifies the authenticity of the user's identity, uses the trusted root to collaborate with the user to calculate, the trusted identity management platform generates the user network trusted identity parameters that are tightly coupled with the real identity, and the user generates the user registration private key that is tightly coupled with the real identity. The trusted identity management platform creates application domain information such as domain public parameters and trusted identity management platform public parameters for different application domains. The user uses the user registration private key, domain public parameters and trusted identity management platform public parameters to calculate and generate anonymous network trusted identity for different application domains, effectively ensuring that the identity is a network identity generated based on the trusted root. The anonymous network trusted identity can be used as the public key of the application domain corresponding to the user registration private key, and is used to verify the signature of the user registration private key. In the anonymous network trusted identity authentication stage, the application party cannot decrypt the anonymous network trusted identity to obtain the user's real identity information, thereby ensuring the privacy and security of the user's identity on the application party. Furthermore, this embodiment can generate different anonymous network trusted identity tags for different application domains, and the identity tags of the same user in different application domains cannot be linked, thereby realizing the privacy protection of the user's network behavior trajectory.

[0061] Step S3: Sign the anonymous network trusted identity and the application domain information of the application party with the user registered private key, and send the user signed information and application domain information to the application party. The application domain information includes the application party ID, application domain public parameters and trusted identity management platform public parameters;

[0062] It should be noted that in this embodiment, the user's identity information and business information are signed by the user's registered private key to ensure the authenticity and non-tamperability of the identity information when the user registers, logs in or confirms the rights.

[0063] When a user registers an application, logs in to an application, or confirms ownership, the user uses the user registration private key to sign identity authentication information such as registration information or login information. Since the user registration private key is generated by the user through interactive calculations based on the trusted root and the trusted identity management platform, it is tightly coupled with the real identity. Therefore, the signature of the user registration private key can ensure the authenticity, non-repudiation and non-tamperability of the submitted user identity information.

[0064] Step S4: The application party uses the public parameters of the trusted identity management platform, the public parameters of the application domain and the user's anonymous network trusted identity to verify the correctness of the user's signature information and complete the user's anonymous network identity authentication in the application domain.

[0065] In this embodiment, the application party realizes the distributed authentication of the authenticity and legitimacy of the user identity based on anonymous network trusted identity, domain public parameters, trusted identity management platform public parameters, etc. The authentication process does not require the participation of a third-party organization. The application party verifies the user's registered private key signature information by using the anonymous network trusted identity, domain public parameters, trusted identity management platform public parameters and other application domain information. It effectively avoids the single point of failure caused by centralized authentication and realizes the real front-end anonymous distributed authentication requirements. The application party first determines the correctness and legitimacy of the application domain information, and then determines the correctness of the user's signature information. After the verification is passed, it indicates that the anonymous network trusted identity is a network trusted identity that has been verified by the trusted identity management platform.

[0066] Furthermore, the anonymous network trusted identity generated by the present invention is an anonymous and supervised network trusted identity. The user network identity authentication method of this embodiment also includes retroactive supervision of the user network identity, including:

[0067] When it is necessary to conduct retrospective supervision on user identities, the application party will send information including anonymous network trusted identity identifiers, application domain public parameters, and trusted identity management platform public parameters to the trusted identity management platform through the supervisor;

[0068] The trusted identity management platform performs open calculations on the anonymous network trusted identity through the public parameters of the application domain and the public parameters of the trusted identity management platform, obtains the user's network identity parameters, searches in the user's real identity list, obtains the user's real identity based on the trusted root, and sends the user's real identity information to the regulator for supervision.

[0069] When a user needs to revoke his / her user identity, he / she submits a request to the trusted identity management platform to revoke the identity, and the request information includes the user identity. After receiving the request and verifying the legitimacy of the request, the trusted identity management platform will add the user's anonymous network trusted identity to the revocation list and publish it if the verification passes.

[0070] When it is necessary to trace and supervise the identity, only the trusted identity management platform can open the anonymous network trusted identity and trace the user's real identity information, thereby protecting the user's real identity information from being leaked. The supervisor sends the anonymous network trusted identity and application domain information to the trusted identity management platform to find the user's real identity. The trusted identity management platform opens the anonymous network trusted identity through application domain information calculation and obtains the user's real identity. The supervisor uses the user's real identity information sent by the trusted identity management platform to supervise the user's identity and network behavior.

[0071] Embodiment 2:

[0072] The present invention also provides an anonymous network identity authentication system based on a trusted root. Figure 2 As shown, it includes: user equipment, trusted identity management platform and application party; wherein,

[0073] The user equipment includes an anonymous network trusted identity terminal management module and a user identity key management module; used to collaboratively calculate with the trusted identity management platform to generate a user registration private key, and generate a user anonymous network trusted identity corresponding to the application party based on the user registration private key; including:

[0074] Create an application domain public and private key pair for the application party through the trusted identity management platform; and send the application domain public parameters and the trusted identity management platform public parameters to the user;

[0075] The correctness of the domain public parameters and the public parameters of the trusted identity management platform are verified through the user device; if the verification passes, an anonymous network trusted identity for the corresponding application domain is generated based on the domain public parameters, the public parameters of the trusted identity management platform and the user's registered private key.

[0076] The anonymous network trusted identity terminal management module is used to generate corresponding anonymous network trusted identity for different application parties based on the user registration private key;

[0077] The user identity key management module is used to collaborate with the trusted identity management platform to obtain and store the user registration private key that is tightly coupled with the user's real identity.

[0078] The user device of this embodiment is responsible for the generation, storage and other life cycle management of the user's anonymous network trusted identity, and is responsible for the key management function of collaborative calculation with the trusted identity management platform to generate the user registration public and private key pairs.

[0079] During the user registration stage on the trusted identity management platform, the user submits his or her real identity information to the trusted identity management platform for verification of the user's real identity. After the verification is passed, the user's device obtains a user registration private key that is tightly coupled with the user's real identity through collaborative interaction with the trusted identity management platform, ensuring that the user's real identity information has been verified by the trusted identity management platform and the legitimacy of the user's registration private key information.

[0080] During the anonymous network trusted identity generation phase, users calculate and generate anonymous network trusted identities for different application domains based on the user's registered private key, domain public parameters, and trusted identity management platform public parameters.

[0081] During the anonymous network trusted identity authentication phase, the user sends account information to the application, including but not limited to the user's anonymous network trusted identity, account information, domain public parameters, trusted identity management platform public parameters, etc., and signs it with the user's registered private key to ensure the authenticity of the information.

[0082] The trusted identity management platform includes a domain management module and a user registration and private key negotiation module, which is used to generate user network trusted identity parameters tightly coupled with the user's real identity information based on the user's real identity information including the trusted root and the user's device, and to generate corresponding application domain public and private key pairs and application domain information for different application domains;

[0083] The domain management module is used to create domain public and private key pairs, domain public parameters, and trusted identity management platform public parameters of different application domains, and disclose the domain public parameters and trusted identity management platform public parameters to user devices;

[0084] The user registration and private key negotiation module is used to verify the real identity of the user, use the real identity of the user as the trusted root, and collaborate with the user to generate the user network trusted identity parameters that are tightly coupled with the real identity of the user;

[0085] Furthermore, the trusted identity management platform also includes an anonymous network trusted identity storage and revocation module and an anonymous network trusted identity opening module, which are used for anonymous network trusted identity supervision and revocation;

[0086] The anonymous network trusted identity storage and revocation module is used to verify the legitimacy of the request for revocation of the identity based on the user's request, add the user's anonymous network trusted identity to the revocation list and publish it; and store the corresponding table between the user's network trusted identity parameters and the user's real identity information for finding the real user;

[0087] The anonymous network trusted identity identification opening module is used to calculate and search the user's real identity list based on the anonymous network trusted identity identification, domain public parameters, and trusted identity management platform public parameters, and trace the user's real identity to supervise the user's network identity using the identification opening algorithm.

[0088] The application side includes an anonymous network trusted identity verification module, which is used to verify the correctness of the application domain information and the authenticity of the user signature information to achieve trusted identity authentication;

[0089] The anonymous network trusted identity verification module verifies the correctness of the application domain information using domain public parameters and trusted identity management platform public parameters; and authenticates the user's registered private key signature information through the anonymous network trusted identity, domain public parameters and trusted identity management platform public parameters to determine the correctness of the anonymous network trusted identity and user signature.

[0090] The application party in this embodiment is responsible for verifying the correctness of the relevant application domain information and the authenticity of the user's signature information, thereby ensuring the legitimacy and correctness of the user's anonymous network trusted identity, and providing services to the user. By using the domain public parameters, trusted identity management platform public parameters and other application domain information, the user's registered private key signature information is authenticated to determine whether the anonymous network trusted identity and user signature are correct. During the authentication process, there is no need to go to the center for authentication, which can meet the distributed public authentication requirements.

[0091] In summary, the present invention generates anonymous and controllable network trusted identity identification, user registration private key and domain public parameters, trusted identity management platform public parameters and other application domain information based on the user's real identity information including the trusted root. The application party verifies the user's registration private key signature information by using the anonymous network trusted identity identification, domain public parameters, trusted identity management platform public parameters and other application domain information to determine whether the anonymous network trusted identity identification is a network trusted identity that has been verified by the trusted identity management platform. The supervisor can trace the user's real identity information through the identification opening operation. Thereby, the trusted identity management platform uniformly issues identities, users and the trusted identity management platform jointly generate anonymous network trusted identities, apply distributed authentication identities, and network identities can be supervised. It ensures that the identities of the same user in different application domains cannot be linked, and solves the problems of anonymous generation, controlled privacy protection and distributed authentication of user anonymous network trusted identities.

[0092] Those skilled in the art will appreciate that all or part of the process of the method in the above embodiment can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0093] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. An anonymous network identity authentication method based on trusted root generation, characterized in that: include: The trusted identity management platform generates a public and private key pair and public parameters of the trusted identity management platform; The user's real identity is used as the trusted root, based on the trusted root, the trusted identity management platform private key and the user's collaborative calculation, to generate the user registration private key on the user side; Based on the user registration private key, generate a user anonymous network trusted identity corresponding to the application party; The anonymous network trusted identity and application domain information are signed by the user registered private key, and the user-signed information is sent to the application party; the application domain information includes the application party ID, application domain public parameters and trusted identity management platform public parameters; The application party uses the public parameters of the trusted identity management platform, the public parameters of the application domain and the user's anonymous network trusted identity to verify the correctness of the user's signature information and complete the user's anonymous network identity authentication in the application domain.

2. The anonymous network identity authentication method based on trusted root generation according to claim 1 is characterized in that: The method uses the real identity of the user as the trusted root, generates the user registration private key based on the trusted root and the private key of the trusted identity management platform on the user side, including: Sending a registration request to the trusted identity management platform through the user device; After the trusted identity management platform returns a response, sending the trusted root to the trusted identity management platform; Verify the authenticity of the user's network identity information through the trusted identity management platform; if the verification is successful, collaborative calculation is performed with the user based on the trusted root and the trusted identity management platform private key; Based on the collaborative calculation result, a user registration private key tightly coupled with the real identity is generated on the user device side.

3. The anonymous network identity authentication method based on trusted root generation according to claim 1 is characterized in that: The generating of a user anonymous network trusted identity corresponding to the application party based on the user registration private key includes: Create a corresponding application domain public and private key pair for the application party through the trusted identity management platform; and send the application domain public parameters and the trusted identity management platform public parameters to the user; The correctness of the domain public parameters and the trusted identity management platform public parameters are verified through the user device; if the verification passes, an anonymous network trusted identity of the user for the corresponding application domain is generated based on the domain public parameters, the trusted identity management platform public parameters and the user registration private key.

4. The anonymous network identity authentication method based on trusted root generation according to claim 2 is characterized in that: Based on the collaborative calculation result, generating a user network trusted identity parameter tightly coupled with the real identity on the trusted identity management platform side, and recording a corresponding relationship table between the user real identity and the user network identity parameter to obtain a user real identity list; It also includes retroactive supervision of user network identities, including: The application party sends the information including the anonymous network trusted identity identifier, the application domain public parameters, and the trusted identity management platform public parameters to the trusted identity management platform through the supervisor; The trusted identity management platform performs open calculation on the anonymous network trusted identity identifier through the application domain public parameters and the trusted identity management platform public parameters to obtain the user network identity parameters, searches in the user real identity list to obtain the user's real identity, and sends the user's real identity information to the supervisor for supervision.

5. An anonymous network identity authentication system based on a trusted root, characterized in that: include: User devices, trusted identity management platforms, and applications; The user device is used to collaboratively calculate with the trusted identity management platform to generate a user registration private key, and generate a user anonymous network trusted identity corresponding to the application party based on the user registration private key; The trusted identity management platform is used to generate user network trusted identity parameters tightly coupled with the user's real identity information based on the user's real identity information including the trusted root and the user's device in a collaborative calculation, and to generate corresponding application domain public and private key pairs and application domain public parameters for different application domains; The application party is used to verify the correctness of the application domain information and the authenticity of the user signature information, and realize anonymous network trusted identity authentication.

6. The anonymous network identity authentication system based on trusted root generation according to claim 5 is characterized in that: The user equipment includes an anonymous network trusted identity terminal management module and a user identity key management module; The user identity key management module is used to coordinate calculation with the trusted identity management platform to obtain and store the user registration private key that is tightly coupled with the user's real identity; The anonymous network trusted identity terminal management module is used to generate corresponding anonymous network trusted identity for different application parties based on the user registration private key.

7. The anonymous network identity authentication system based on trusted root generation according to claim 6 is characterized in that: The corresponding trusted identity identification is generated for different application parties based on the user registration private key, including: Create an application domain public and private key pair for the application party through the trusted identity management platform; and send the application domain public parameters and the trusted identity management platform public parameters to the user; The correctness of the domain public parameters and the trusted identity management platform public parameters are verified through the user device; if the verification passes, a trusted identity identifier for the corresponding application domain is generated based on the domain public parameters, the trusted identity management platform public parameters and the user registration private key.

8. The anonymous network identity authentication system based on trusted root generation according to claim 5, characterized in that: The trusted identity management platform is used for user registration and application domain management, including a user registration and private key negotiation module and a domain management module; The domain management module is used to create domain public and private key pairs, domain public parameters, and trusted identity management platform public parameters of different application domains, and disclose the domain public parameters and trusted identity management platform public parameters to user devices; The user registration and private key negotiation module is used to, after verifying the real identity of the user, use the real identity of the user as a trusted root, and collaboratively calculate with the user to generate user network trusted identity parameters that are tightly coupled with the real identity of the user.

9. The anonymous network identity authentication system based on trusted root generation according to claim 5, characterized in that: The trusted identity management platform also includes an anonymous network trusted identity storage and revocation module and an anonymous network trusted identity opening module for identity supervision and revocation; The anonymous network trusted identity storage and revocation module is used to verify the legitimacy of the request for revocation of the identity based on the user's request, add the user's anonymous network trusted identity to the revocation list and publish it; and store the corresponding table between the user's network trusted identity parameters and the user's real identity information for finding the real user; The anonymous network trusted identity identification opening module is used to calculate and search for a user's real identity list based on the anonymous network trusted identity identification, domain public parameters, and trusted identity management platform public parameters using an identification opening algorithm, and trace back to the user's real identity to supervise the user's network identity.

10. The anonymous network identity authentication system based on trusted root generation according to claim 5, characterized in that: The application side includes an anonymous network trusted identity verification module; Used to verify the correctness of application domain information using domain public parameters and trusted identity management platform public parameters; and authenticate the user's registered private key signature information through anonymous network trusted identity, domain public parameters and trusted identity management platform public parameters to determine the correctness of the anonymous network trusted identity and user signature.

Images