Anonymous identity verification method and system

Abstract

The embodiment of the invention provides an anonymous identity verification method and device. According to the method, a first device generates a binary indication vector and an auxiliary vector having a predetermined relationship with the binary indication vector according to a serial number index of a first account in a target account set; and generating a signature value C according to the indication vector, the auxiliary vector and the private key of the first account. And calculating a first public key vector according to the first random number selected by the verification device and the public key sequence of the target account set, and calculating a blind value based on the first public key vector and the random number group selected by the local party. The first device also generates first and second sets of commitment values according to the indication vector, the auxiliary vector, and the challenge array and the variable value selected by the verification device. The first device provides the signature value C, the blind value, and the first and second sets of commitment values to a verification device, whereby the verification device verifies whether the first account belongs to the target account set.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to data privacy protection, and more particularly, to a method and system for anonymous identity authentication and verification in a privacy protection scenario. Background Art

[0002] Blockchain technology is an application model that uses computer technologies such as peer-to-peer transmission, consensus mechanism, and encryption algorithm to achieve distributed data storage. In the blockchain network, data storage and recording are achieved through transactions. The transaction content of each transaction is jointly maintained by all nodes in the blockchain network, and no party can tamper with the content in the block. In addition, blockchain uses encryption technology to ensure the security and anonymity of transactions.

[0003] In some scenarios, for the purpose of privacy protection and / or permission control, users need to prove their identity anonymously, such as belonging to a certain set of authorized accounts. For example, in a blockchain scenario, users may want to sign without revealing their identity to initiate a transaction.

[0004] Therefore, it is desirable to provide an effective solution that can achieve anonymous identity proof and verification. Summary of the invention

[0005] One or more embodiments of this specification describe an anonymous identity authentication method, where an account as a proving party can hide its identity in an account set through a ring signature, but prove that it belongs to this account set, thereby achieving anonymous identity certification and verification.

[0006] According to a first aspect, an anonymous identity authentication method is provided, which is performed by a first device and includes:

[0007] Generate a binary indication vector and an auxiliary vector having a predetermined relationship therewith according to the serial number index of the first account in the target account set; generate a first signature value C according to the indication vector, the auxiliary vector and the first private key of the first account; wherein the target account set is identified by a corresponding public key sequence;

[0008] Calculate a first public key vector according to a first random number selected by the verification device and the public key sequence, and calculate a blinding value based on the first public key vector and a random number array selected by the party;

[0009] Generate a result polynomial generated by two vector polynomials and their inner product according to the indication vector, the auxiliary vector and the challenge array selected by the verification device, and generate a first set of commitment values ​​based on coefficients of the result polynomial;

[0010] Substituting the variable value x selected by the verification device into the two vector polynomials, and generating a second set of commitment values ​​based on the substituted calculation results;

[0011] The first signature value, the blinded value, and the first group of commitment values ​​and the second group of commitment values ​​are provided to the verification device for the verification device to verify whether the first account belongs to the target account set.

[0012] According to an implementation, at least one of the first random number, the random number array, and the variable value is received and obtained from a verification device.

[0013] According to another implementation, at least one of the first random number, the random array, and the variable value is generated according to a data source and a generation algorithm specified by the verification device.

[0014] In one embodiment, the first account is an account in a blockchain system, the verification device is a device corresponding to a bookkeeping node in the blockchain, and the method further includes the verification device writing a first transaction issued by the first account into the blockchain after verifying that the first account belongs to the target account set.

[0015] According to one implementation, the aforementioned generation of the first signature value specifically includes: obtaining the first signature value according to the product of the first data item, the second data item, and the third data item, wherein the first data item is determined by taking the first target generator as the base and the first private key as the exponent; the second data item is determined by taking the first generator vector as the base and the indicator vector as the exponent; the third data item is determined by taking the second generator vector as the base and the auxiliary vector as the exponent.

[0016] According to one embodiment, calculating the first public key vector specifically includes: taking the initial public key vector corresponding to the public key sequence as the base and the first random number as the exponent to calculate an intermediate vector; performing positional multiplication of the intermediate vector and the first generator vector to obtain the first public key vector.

[0017] In a further embodiment, the random array selected by this party includes first and second blinding vectors, and a second random number; the aforementioned calculation of the blinding value specifically includes: obtaining the blinding value according to the product of a fourth data item, a fifth data item, and a sixth data item, wherein the fourth data item is determined with the second target generator as the base and the second random number as the exponent; wherein the second target generator is determined according to the first target generator, the first random number, and a basic generator for generating the public key sequence; the fifth data item is determined with the first public key vector as the base and the first blinding vector as the exponent; the sixth data item is determined with the second generator vector as the base and the second blinding vector as the exponent.

[0018] According to one implementation, the random array selected by the party includes a first and a second blinding vector; generating two vector polynomials includes: based on the indication vector and the challenge array, introducing the product of the first blinding vector and a variable to obtain a first vector polynomial; based on the auxiliary vector and the challenge array, introducing the product of the second blinding vector and a variable to obtain a second vector polynomial.

[0019] In one embodiment, generating a first set of commitment values ​​specifically includes: calculating the linear coefficient value of the result polynomial according to the challenge array, and generating a first commitment value T1 according to the linear coefficient value and a locally generated third random number; calculating the quadratic coefficient value of the result polynomial according to the challenge array, and generating a second commitment value T2 according to the quadratic coefficient value and a locally generated fourth random number.

[0020] Furthermore, in one embodiment, a second set of commitment values ​​is generated based on the substituted calculation results, including: obtaining two target vectors obtained by substituting the variable value x into the two vector polynomials, and a result value obtained by substituting the variable value x into the result polynomial; generating a first verification value based on the third random number, the fourth random number, and the variable value; generating a second verification value based on the variable value and the first private key; generating a third verification value based on the variable value and the random array selected by the party; and determining a second set of commitment values, which includes two target vectors, the result value, the first verification value, the second verification value, and the third verification value.

[0021] According to a second aspect, there is provided an anonymous identity authentication method, comprising:

[0022] The first device generates a binary indication vector and an auxiliary vector having a predetermined relationship therewith according to the serial number index of the first account in the target account set; generates a first signature value C according to the indication vector, the auxiliary vector and the first private key of the first account; wherein the target account set is identified by a corresponding public key sequence;

[0023] The first device calculates a first public key vector according to the first random number selected by the verification device and the public key sequence, and calculates a blinding value based on the first public key vector and the random number array selected by the first device;

[0024] The first device generates a result polynomial generated by two vector polynomials and their inner product according to the indication vector, the auxiliary vector and the challenge array selected by the verification device, and generates a first set of commitment values ​​based on coefficients of the result polynomial;

[0025] The first device substitutes the variable value x selected by the verification device into the two vector polynomials and the result polynomial, and generates a second set of commitment values ​​based on the substituted calculation results;

[0026] The verification device verifies whether the first account belongs to the target account set based on the first signature value, the first public key vector, the blinding value, and the first group of commitment values ​​and the second group of commitment values.

[0027] According to one implementation, verifying whether the first account belongs to the target account set includes: calculating a first calculated value based on the second set of commitment values ​​and the agreed generator; calculating a second calculated value based on the first set of commitment values ​​and the variable value; and verifying whether the first calculated value is equal to the second calculated value.

[0028] According to one embodiment, verifying whether the first account belongs to the target account set includes: calculating a third calculated value based on the first signature value, the first verification vector, the first public key vector, the variable value and the challenge array; calculating a fourth calculated value based on the first public key vector, the agreed generator, and the second group of commitment values; and verifying whether the third calculated value is equal to the fourth calculated value.

[0029] According to a third aspect, an anonymous identity authentication apparatus is provided, which is deployed in a first device and includes:

[0030] A first generating unit is configured to generate a binary indication vector and an auxiliary vector having a predetermined relationship therewith according to a serial number index of the first account in the target account set; and generate a first signature value C according to the indication vector, the auxiliary vector and a first private key of the first account; wherein the target account set is identified by a corresponding public key sequence;

[0031] A second generating unit is configured to calculate a first public key vector according to a first random number selected by the verification device and the public key sequence, and calculate a blinding value based on the first public key vector and a random number array selected by the party;

[0032] A third generating unit is configured to generate a result polynomial generated by two vector polynomials and their inner product according to the indication vector, the auxiliary vector and the challenge array selected by the verification device, and generate a first set of commitment values ​​based on coefficients of the result polynomial;

[0033] a fourth generating unit, configured to substitute the variable value x selected by the verification device into the two vector polynomials, and generate a second set of commitment values ​​based on the substituted calculation results;

[0034] The first signature value, the blinded value, and the first group of commitment values ​​and the second group of commitment values ​​are provided to the verification device for the verification device to verify whether the first account belongs to the target account set.

[0035] According to a fourth aspect, there is provided an anonymous identity authentication system, comprising a first device and a verification device, wherein:

[0036] The first device is configured to generate a binary indicator vector and an auxiliary vector having a predetermined relationship therewith according to the serial number index of the first account in the target account set; generate a first signature value C according to the indicator vector, the auxiliary vector and the first private key of the first account; wherein the target account set is identified by a corresponding public key sequence; calculate a first public key vector according to a first random number selected by a verification device and the public key sequence, and calculate a blinding value based on the first public key vector and a random array selected by the party; generate a result polynomial generated by two vector polynomials and their inner product according to the indicator vector, the auxiliary vector and the challenge array selected by the verification device, and generate a first group of commitment values ​​based on the coefficients of the result polynomial; substitute the variable value x selected by the verification device into the two vector polynomials and the result polynomial, and generate a second group of commitment values ​​based on the substituted calculation results;

[0037] The verification device is configured to verify whether the first account belongs to the target account set based on the first signature value, the first public key vector, the blinding value, and the first group of commitment values ​​and the second group of commitment values.

[0038] According to a fifth aspect, a computing device is provided, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method of the first aspect or the second aspect is implemented.

[0039] In the embodiments of this specification, the device where the first account is located generates a signature value C, a blinded value S, and two sets of commitment values ​​according to the position of the first account in the target account set and the account private key. These data are blinded and obfuscated with random numbers, and will not disclose the information of the first account (including its position ind and its private key). As a result, the verification device can verify whether the first account belongs to the target account set without knowing which account the first account represented by the device is, thereby realizing anonymous identity authentication. In addition, the data size in the above-mentioned proof process is small, which supports distributed scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0041] Figure 1 A schematic diagram of identity authentication based on ring signature in blockchain is shown;

[0042] Figure 2 A flow chart showing an anonymous identity authentication method according to one embodiment;

[0043] Figure 3 A schematic diagram showing the structure of a device in one embodiment is shown;

[0044] Figure 4 A schematic diagram showing an anonymous identity authentication system according to one embodiment. DETAILED DESCRIPTION

[0045] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0046] Ring signature is an anonymous signature technology that allows the signer to sign without revealing his or her identity. A ring signature consists of a signer and a set. The members of the set can be anyone, but only the signer and a member of the set know the signer's identity. Through the ring signature, the signer can prove to the outside world that he or she is a member of the set, but he or she cannot be identified as a member of the set.

[0047] Ring signatures can be applied to blockchain to achieve identity privacy protection in blockchain. Figure 1 Figure 2 shows a schematic diagram of identity authentication based on ring signature in blockchain. Figure 1 As shown, user u s You can confuse your public key with a series of accounts u1,…,u on the chain n The public keys pk1,…pk n Then use your own private key sk S Initiate a transaction and upload it to the blockchain. The verifier can verify the ring signature to determine that it is a signature made by a user in the above account set, and then verify the validity of the transaction, but the verifier cannot know which specific user the transaction came from, that is, the identity of the transaction initiator. The verified transaction can be stored on the chain in the usual way. In this way, identity confirmation and identity hiding in the blockchain are realized through ring signatures, that is, identity authentication under anonymity.

[0048] However, the current ring signature schemes in the industry have some shortcomings. The signature size of some ring signature schemes is large. In distributed scenarios such as blockchain, signatures are stored between multiple nodes, resulting in a large signature size. In the ring signature schemes used by some cryptocurrencies, the signature size is linearly related to the number of members in the confusion set, which leads to excessively large signature sizes and high storage costs. On the other hand, some ring signature schemes are not friendly enough to distributed storage support. In some existing technical ideas, the security definition of ring signatures requires a trusted third party to generate private keys to ensure that a single participant cannot master multiple private keys in the ring signature. This requirement cannot be met in distributed scenarios, resulting in the ring signature scheme in this technical idea being unable to be applied to distributed scenarios such as blockchain.

[0049] In view of this, in the embodiments of this specification, a new ring signature implementation scheme is proposed, which has a smaller signature size, supports distributed scenarios, and can efficiently implement anonymous identity authentication and verification.

[0050] The following describes the process of the ring signature protocol implemented for anonymous identity authentication in conjunction with the accompanying drawings. Figure 2 A flowchart of an anonymous identity authentication method according to an embodiment is shown. It can be seen that Figure 2 The flowchart involves a first device and a verification device. The first device is a first account u s Assume that the first account belongs to the target account set u1,…,u consisting of n accounts. n , and is hidden in the account set. In addition, the target account set is represented by its corresponding n public keys pk1,…pk n The above n public keys are in a public state. Assume that the above n public keys are generated using the same elliptic curve generator g and their corresponding private keys, that is, any pk i satisfy: This common generator g is referred to as the basic generator hereinafter.

[0051] The verification device can be any device that verifies the ring signature. In the blockchain scenario, the verification device can be the device where the accounting node is located, but is not limited to this. The specific implementation process of the ring signature protocol is described below.

[0052] In step 201, the first device generates a binary indicator vector and an auxiliary vector having a predetermined relationship therewith according to the sequence index of the first account in the target account set.

[0053] Specifically, the first device first determines that the first account is in the target account set u1,…,u n The serial number index in the target account set is the public key sequence (pk1,…pk n ) in the sequence number. The sequence number index or number is recorded as ind. Based on the sequence number index ind, a binary indicator vector is generated The indicator vector In the , the ind position is 1, and the rest of the positions are 0.

[0054] In addition, according to the indicator vector Generate the corresponding auxiliary vector The two satisfy the following relationship (1):

[0055]

[0056] Then, in step 202, the first device generates a first signature value according to the indication vector, the auxiliary vector and the first private key sk of the first account.

[0057] In one embodiment, the first device may A random number α is randomly selected and the first signature value C is calculated by the following formula (2):

[0058]

[0059] In formula (2), sk is the private key of the first account, h and g0 can be the elliptic curve generator agreed with the verification device, and are all generator vectors composed of n selected generators, that is,

[0060] It can be seen that the first signature value C is based on the product of three data items, superimposed h α The first data item is determined by taking the first target generator g0 as the base and the first private key sk as the exponent; the second data item is determined by taking the first generator vector As the base, the indicator vector The third data item is determined by the second generator vector As the base, the auxiliary vector Determined for the index.

[0061] Formula (2) involves the exponential operation between vectors, which is defined as follows: vector a = (a1, ..., a N ) of the vector b=(b1,…,b N ) is expressed as

[0062] After generating the first signature value C as above, in step 203, the first device may send the first signature value C to the verification device.

[0063] After the verification device receives the first signature value, in step 204, the verification device randomly selects a random number from the aforementioned integer ring, hereinafter referred to as the first random number The first random number d is sent to the first device.

[0064] In step 205, the first device verifies the first random number selected by the verification device and the aforementioned public key sequence (pk1, ...pk n ), calculate the first public key vector.

[0065] It can be understood that the public key sequence can correspond to an initial public key vector {pk1,…pk nIn step 205, the first device may merge the information of the first random number and the information of the first generator vector into the initial public key vector, blind it, and obtain the first public key vector In a specific example, the first public key vector can be calculated according to the following formula (3):

[0066]

[0067] According to the above formula (3), we can first use the initial public key vector {pk1,…pk n} as the base, and the first random number d as the exponent, calculate the intermediate vector; then, add the intermediate vector to the first generator vector {g1,…,g n} Perform bitwise multiplication to obtain the first public key vector

[0068] In step 206, the first device calculates a blinding value S based on the first public key vector and a random array selected by the first device.

[0069] In this step, the first device selects some random numbers, including the first and second blinding vectors Random Numbers Based on these random numbers and the first public key vector, a blinding value S is calculated. In one example, the blinding value can be calculated according to the following formula (4):

[0070]

[0071] in,

[0072] According to formula (4), the calculation of the blinded value corresponds to the calculation of the first commitment value. Specifically, it can be based on the product of the three data items, superimposed h ρ The random items are generated by the second target generator, wherein the three data items can be referred to as the fourth to sixth data items, wherein the fourth data item is generated by the second target generator. As the base, the second random number r sk is determined by the index; the second target generator The fifth data item is determined based on the first target generator g0, the first random number d and the basic generator g for generating the public key sequence; As the base, with the first blinded vector The sixth data item is determined by the second generator vector As the base, the second blinding vector Determined for the index.

[0073] Since the second target generator The information of the first target generator g0 and the second random number rsk Corresponding to the first private key sk, it can be considered that the fourth data item in the blinded value S corresponds to the first data item of the first signature value C. Since the first public key vector The first generator vector is fused in Therefore, the fifth data item of the blinded value corresponds to the second data item of the first signature value C, and the sixth data item corresponds to the third data item of C. In this way, a blinded value that has a certain correspondence with the first signature value is obtained.

[0074] In step 207, the first device sends the blinded value S to the verification device.

[0075] In step 208, after receiving the blinded value S, the verification device selects a challenge array (y, z) and sends it to the first device.

[0076] In step 209, the first device generates a result polynomial generated by two vector polynomials and their inner product according to the indication vector, the auxiliary vector and the obtained challenge array, and generates a first set of commitment values ​​based on coefficients of the result polynomial.

[0077] In one embodiment, the first device is based on the indication vector Auxiliary vector Challenge arrays y and z, introduce the aforementioned first and second blinding vectors and variable X, and obtain two vector polynomials. Specifically, it can be based on the indicator vector and challenge array, introducing the first blinding vector The product of the variable X gives the first vector polynomial; based on the auxiliary vector and the challenge array, introducing a second blinding vector The product with the variable X gives the second vector polynomial.

[0078] In a specific example, the first vector polynomial l(X) and the second vector polynomial r(X) can be constructed according to the following formula (6):

[0079]

[0080] in,

[0081] Correspondingly, the resulting polynomial t(X) can be expressed as:

[0082] t(X)=<l(X),r(X)> =t0+t1·X+t2·X 2 (7)

[0083] It should be noted that the indicator vector shown in formula (1) and auxiliary vector The relationship between , we can see that for any random variable y and the corresponding The following relationship (8) also holds, that is, the relationship of formula (1) can be rewritten as the following formula (8):

[0084]

[0085] because is 1 in only one position, so: Combining this with formula (8), we can obtain that for any random variable z, the following formula (9) also holds:

[0086]

[0087] Formula (9) can be equivalently transformed into:

[0088]

[0089] It can be seen that the inner product on the left side of formula (10) is the inner product of the constant terms (i.e., the terms without variable X) in the two vector polynomials shown in formula (6). Therefore, the right side of formula (10) corresponds to the constant term t0 in the result polynomial t(X), that is,

[0090]

[0091] It can be seen that the constant term t0 of the resulting polynomial is only related to the challenge array (y,z) and is a value that the verification device can also calculate independently.

[0092] The first device can select the first and second blinding vectors based on the challenge array and the two blinding vectors. and , calculate the coefficient values ​​of these two coefficients.

[0093] Next, the first device calculates a first set of commitment values ​​based on the coefficient values ​​of the result polynomial. Specifically, the first commitment value T1 can be generated based on the calculated coefficient value t1 of the first term and the locally generated third random number τ1; the second commitment value T2 can be generated based on the coefficient value t2 of the second term and the locally generated fourth random number τ2.

[0094] In a specific example, the first commitment value and the second commitment value may be generated as follows:

[0095]

[0096] Among them, g is the basic generator, and h is the auxiliary generator used in calculating the first signature value C and the blinded value.

[0097] In this way, the first device calculates the first set of commitment values ​​according to the coefficients of the result polynomial. Thus, in step 210, the first device sends the first set of commitment values ​​T1 and T2 to the verification device.

[0098] In step 211, after receiving the first set of commitment values, the verification device randomly selects a variable value x and sends it to the first device.

[0099] In step 212, the first device substitutes the variable value x selected by the verification device into the two aforementioned vector polynomials, and generates a second set of commitment values ​​based on the substituted calculation results.

[0100] In this step, the first device substitutes the variable value x into the aforementioned first vector polynomial l(X) and second vector polynomial r(X), and the two target vectors obtained are and Right now:

[0101]

[0102] Based on this, the first device calculates the inner product of the two target vectors and obtains the result value The result value This is equivalent to substituting the variable value x into the result polynomial t(X) to obtain the calculated result:

[0103]

[0104] In addition, the first device generates a first verification value τ according to the aforementioned third random number τ1, fourth random number τ2, and variable value x. x :

[0105]

[0106] In addition, the first device also generates a second verification value η and a third verification value μ according to the variable value x, the first private key sk, and the random number selected by the first device in the previous step. Specifically, the second and third verification values ​​can be generated as follows:

[0107] η=-sk+r sk ·x

[0108] μ=α+ρ·x (16)

[0109] The two target vectors calculated above are and Result value First to third verification values ​​τ x ,η,μ, constitute the second set of commitment values.

[0110] At step 213, the first device sends the second set of commitment values ​​to the verification device.

[0111] In step 214, the verification device verifies the first signature value C and the first public key vector The blinded value S, as well as the first set of commitment values ​​and the second set of commitment values, verify whether the first account belongs to the target account set.

[0112] Specifically, the verification device can first verify that the result value in the second set of commitment values Is it equal to the inner product of the two target vectors, that is, verification:

[0113]

[0114] Obviously, if the first device performs calculation according to the protocol, the above formula (17) should hold.

[0115] In one embodiment, the verification device also performs the following second verification process: the verification device calculates a first calculated value V1 according to the second set of commitment values ​​and the agreed generator; calculates a second calculated value V2 according to the first set of commitment values ​​and the variable value x; and verifies whether the first calculated value is equal to the second calculated value.

[0116] In a specific example, the first calculated value V1 is Where g is the aforementioned basic generator, h is the aforementioned auxiliary generator, They all come from the second set of committed values ​​sent by the first device, and t0 can be calculated by itself according to formula (11).

[0117] The second calculated value V2 can be set as T1 and T2 both come from the first set of committed values ​​sent by the first device.

[0118] The second verification process can be expressed as:

[0119]

[0120] It can be understood that if the first device performs calculation according to the protocol, then:

[0121]

[0122] So we have:

[0123]

[0124] Substituting formula (20) into the exponential part of the base g in the first calculated value V1 and substituting formula (15) into the exponential part of the base h, combined with the definitions of T1 and T2 in formula (12), it can be demonstrated that if the first device performs calculations according to the protocol, then relationship (18) holds, that is, the first calculated value should be equal to the second calculated value.

[0125] In one embodiment, the verification device further performs the following third verification process. Specifically, the verification device verifies the first signature value C, the blinding value S, and the first public key vector according to the first signature value C, the blinding value S, and the first public key vector. The variable value x and the challenge array are used to calculate a third calculated value V3; in addition, the first public key vector The agreed generator and the second set of commitment values ​​are used to calculate a fourth calculated value V4; and verify whether the third calculated value is equal to the fourth calculated value.

[0126] In a specific example, the verification device first generates the agreed generator vector according to the value of y in the challenge array. Transform and obtain the transformation generator vector The transformation can be expressed as follows:

[0127]

[0128] On this basis, the third calculated value V3 can be set as:

[0129]

[0130] Wherein, C is the first committed value, and S is the blinded value, both of which are values ​​received from the first device; Generate the element vector for the above transformation, is the first public key vector, which can be calculated by the verification device according to formula (3), and (y, z) is the challenge array selected by the verification device.

[0131] Accordingly, the fourth calculated value V4 can be set as:

[0132]

[0133] Where h is the pre-agreed auxiliary generator mentioned above, According to formula (5), and η both come from the second set of committed values ​​sent by the first device.

[0134] The third verification process can be expressed as:

[0135]

[0136] It can be understood that when the first device belongs to the target account set, there is pk ind =g sk Substituting this relationship, it can be demonstrated that if the first device performs calculation according to the protocol, then relationship (24) holds, that is, the third calculated value should be equal to the fourth calculated value. In this way, identity authentication of the first account of the first device is achieved.

[0137] Looking back at the above process, the information generated by the first device and provided to the verification device, from the first signature value C, the blinded value S, to the first set of commitment values ​​and the second set of commitment values, will not disclose the information of the first account (including its location ind and its private key). As a result, the verification device can verify whether the first account belongs to {pk1,…pk n} represents the target account set, thereby achieving anonymous authentication.

[0138] In the above process, the components of the entire ring signature include as well as Therefore, the size is 2n+8 elements. Using the inner product proof technology of Bulletproofs, the storage of the ring signature can be reduced to This makes the data size of the ring signature logarithmic to the number of members n, greatly reducing the signature size.

[0139] In addition, it is necessary to understand that Figure 2 An example implementation scenario of anonymous identity authentication is shown, in which the first device obtains the challenge array and variable values ​​by interacting with the verification device, and provides the verification device with data such as the signature value and commitment value in the ring signature. In another implementation scenario, the above anonymous identity authentication can also be implemented in a non-interactive manner.

[0140] Specifically, the verification device can specify some data generators, such as pseudo-random number generators, generators based on hash functions, etc. Using the agreed generator, the same random number can be generated based on the same data source. Figure 2 When the first device needs to obtain the random number selected by the verification device, it can obtain the corresponding random number according to the data source and data generation algorithm specified by the verification device. Figure 2In step 205, when the first device needs to obtain the first random number d, the first device can generate the first random number according to the specified first generator and the public first data source. The public first data source can be data disclosed in the blockchain system or the result of the previous calculation of the first device. For example, after the first device calculates the first commitment value C, the calculated value can be used as a random seed and input into the pseudo-random number generator to obtain the first random number d. Similarly, in step 209, when the first device needs to obtain the challenge array (y, z), it can generate the challenge array (y, z) according to the specified second data source and the second generator. The second generator can be the same generator as the aforementioned first generator or a different generator, which is not limited here. The second data source can be data disclosed in the blockchain system or the result of the previous calculation of the first device, such as the first commitment value C and the blinding value S. Other random numbers that need to be selected by the verification device, such as the variable x, can also be obtained in the above manner. In this way, the first device obtains the random number selected by the verification device in a non-interactive manner to complete the ring signature.

[0141] On the one hand, the non-interactive approach can save communication between devices, and on the other hand, it can support scenarios with multiple verification devices. For example, a data source and a generator can be agreed upon in a blockchain system. In this way, any verification device in the blockchain system can verify the ring signature generated by the first account mentioned above. When the first random number needs to be used, the verification device generates a first random number d according to the agreed first generator and the first data source. For example, the first signature value C is read, used as a random seed, and input into the agreed pseudo-random number generator to obtain the first random number. Since the generator and data source based on are the same, the verification device can generate the same random number as the first device. When the challenge array (y, z) needs to be used, the verification device similarly generates the challenge array according to the agreed second generator and the second data source, and will not be repeated. The above verification device may include but is not limited to each accounting node in the blockchain system. When the verification device is an accounting node, the verification device can obtain the transaction issued by the first account and the generated ring signature, and write the transaction issued by the first account into the blockchain when the ring signature is successfully verified. Other nodes in the blockchain system can also verify the above ring signature when necessary.

[0142] In this way, the first device does not have to interact with each verification device one by one to generate a ring signature; instead, it generates a universal ring signature in a non-interactive manner, sends it to each node of the blockchain network, and then publishes it to the blockchain chain, so that any verification device in this process can verify the ring signature, better support distributed scenarios, and further improve verification efficiency.

[0143] According to an embodiment of another aspect, an anonymous identity authentication apparatus is provided, which is deployed in a first device. The first device can be implemented as any device, platform, and computing cluster with computing and processing capabilities. Figure 3 A schematic diagram of the structure of a device in one embodiment is shown. Figure 3 As shown, the device 300 includes:

[0144] The first generating unit 31 is configured to generate a binary indication vector and an auxiliary vector having a predetermined relationship therewith according to the serial number index of the first account in the target account set; generate a first signature value C according to the indication vector, the auxiliary vector and the first private key of the first account; wherein the target account set is identified by a corresponding public key sequence;

[0145] The second generating unit 32 is configured to calculate a first public key vector according to a first random number selected by the verification device and the public key sequence, and calculate a blinding value based on the first public key vector and a random number array selected by the party;

[0146] A third generating unit 33 is configured to generate a result polynomial generated by two vector polynomials and their inner product according to the indication vector, the auxiliary vector and the challenge array selected by the verification device, and generate a first set of commitment values ​​based on coefficients of the result polynomial;

[0147] A fourth generating unit 34 is configured to substitute the variable value x selected by the verification device into the two vector polynomials, and generate a second set of commitment values ​​based on the substituted calculation results;

[0148] The first signature value, the blinded value, and the first group of commitment values ​​and the second group of commitment values ​​are provided to the verification device for the verification device to verify whether the first account belongs to the target account set.

[0149] According to yet another aspect of the embodiment, an anonymous identity authentication system is provided. Figure 4 A schematic diagram of an anonymous identity authentication system according to an embodiment is shown, which includes a first device 41 and a verification device 42. In one example, the first device 41 is a device where a first account is located, and the first account can be, for example, an account in a blockchain system. The verification device 42 can be any device that needs to verify the first account.

[0150] Specifically, the first device 41 is configured to generate a binary indicator vector and an auxiliary vector having a predetermined relationship therewith according to the serial index of the first account in the target account set; generate a first signature value C according to the indicator vector, the auxiliary vector and the first private key of the first account; wherein the target account set is identified by a corresponding public key sequence; calculate a first public key vector according to a first random number selected by a verification device and the public key sequence, and calculate a blinding value based on the first public key vector and a random array selected by the party; generate a result polynomial generated by two vector polynomials and their inner product according to the indicator vector, the auxiliary vector and the challenge array selected by the verification device, and generate a first set of commitment values ​​based on the coefficients of the result polynomial; substitute the variable value x selected by the verification device into the two vector polynomials and the result polynomial, and generate a second set of commitment values ​​based on the substituted calculation results.

[0151] The verification device 42 is configured to verify whether the first account belongs to the target account set based on the first signature value, the first public key vector, the blinding value, and the first group of commitment values ​​and the second group of commitment values.

[0152] Through the above anonymous identity authentication system, it is possible to confirm that the first account belongs to the target account set without exposing the specific account information of the first account.

[0153] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute Figure 2 A method performed in a first device and / or a verification device.

[0154] According to another embodiment, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, Figure 2 A method performed in a first device and / or a verification device.

[0155] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0156] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0157] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0158] Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

[0159] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0160] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0161] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0162] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0163] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0164] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0165] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0166] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0167] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0168] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0169] The above description is only an example of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. For those skilled in the art, one or more embodiments of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims.

Claims

1. An anonymous identity authentication method, performed by a first device, comprising: Generate a binary indicator vector and an auxiliary vector having a predetermined relationship therewith according to the serial number index of the first account in the target account set; Generate a first signature value C according to the indication vector, the auxiliary vector and the first private key of the first account; wherein the target account set is identified by a corresponding public key sequence; Calculate a first public key vector according to a first random number selected by the verification device and the public key sequence, and calculate a blinding value based on the first public key vector and a random number array selected by the party; Generate a result polynomial generated by two vector polynomials and their inner product according to the indication vector, the auxiliary vector and the challenge array selected by the verification device, and generate a first set of commitment values ​​based on coefficients of the result polynomial; Substituting the variable value x selected by the verification device into the two vector polynomials, and generating a second set of commitment values ​​based on the substituted calculation results; The first signature value, the blinded value, and the first group of commitment values ​​and the second group of commitment values ​​are provided to the verification device for the verification device to verify whether the first account belongs to the target account set.

2. The method according to claim 1, wherein: At least one of the first random number, the random number array and the variable value is received and obtained from the verification device; or, At least one of the first random number, the random number array and the variable value is generated according to a data source and a generation algorithm specified by the verification device.

3. The method according to claim 1, wherein: The first account is an account in the blockchain system, the verification device is a device corresponding to a bookkeeping node in the blockchain, and the method further includes, after the verification device verifies that the first account belongs to the target account set, writing a first transaction issued by the first account into the blockchain.

4. The method according to claim 1, wherein: The generating of the first signature value comprises: A first signature value is obtained according to the product of the first data item, the second data item, and the third data item, wherein the first data item is determined with the first target generator as the base and the first private key as the exponent; the second data item is determined with the first generator vector as the base and the indicator vector as the exponent; and the third data item is determined with the second generator vector as the base and the auxiliary vector as the exponent.

5. The method according to claim 4, wherein: Calculating the first public key vector includes: An intermediate vector is calculated by taking the initial public key vector corresponding to the public key sequence as a base and the first random number as an exponent; The intermediate vector is multiplied by the first generator vector to obtain the first public key vector.

6. The method according to claim 1, wherein: The random array selected by the party includes a first and a second blinding vector; Generating two vector polynomials involves: Based on the indication vector and the challenge array, introducing the product of a first blinding vector and a variable to obtain a first vector polynomial; Based on the auxiliary vector and the challenge array, a product of a second blinding vector and a variable is introduced to obtain a second vector polynomial.

7. The method according to claim 1, wherein: Generate the first set of commitment values, including: Calculate the linear term coefficient value of the result polynomial according to the challenge array, and generate a first commitment value T1 according to the linear term coefficient value and a locally generated third random number; The quadratic term coefficient value of the result polynomial is calculated according to the challenge array, and a second commitment value T2 is generated according to the quadratic term coefficient value and a fourth random number generated locally.

8. The method according to claim 1, wherein: Verifying whether the first account belongs to the target account set includes: Calculate a first calculated value according to the second set of committed values ​​and the agreed generator; Calculate a second calculated value according to the first group of committed values ​​and the variable value; Verify that the first calculated value is equal to the second calculated value.

9. The method according to claim 1, wherein: Verifying whether the first account belongs to the target account set includes: Calculate a third calculated value according to the first signature value, the blinded value, the first public key vector, the variable value and the challenge array; Calculate a fourth calculated value according to the first public key vector, the agreed generator, and the second group of commitment values; It is verified whether the third calculated value is equal to the fourth calculated value.

10. A computing device comprising a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 9 is implemented.

Images