Fine-grained anonymous authentication method for multi-attribute authority system

Abstract

A fine-grained anonymous authentication method for multi-attribute authority system, comprising a central authority, a plurality of attribute authorities, N users and M relying parties in the anonymous authentication system of multi-attribute authority. When the multi-attribute authority system is initialized, the central authority initializes public parameters and secret values; the attribute authority generates secret values for each managed attribute and publishes public parameters, and proves possession of the secret value by means of zero-knowledge proof; when the user joins, the user obtains an empty certificate from the central authority; the user successively looks for the attribute authority to sign the certificate, and finally obtains a certificate signed by multiple attributes; when the user obtains the service provided by the relying party, the user proves to the relying party that the required attribute is possessed, and the anonymous authentication is completed. The application generates secret values for each attribute by the attribute authority and publishes public parameters, solves the problem of user collusion with untrusted attribute authorities to forge attributes, and ensures the normal operation of the anonymous authentication of the multi-attribute authority system.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically a fine-grained anonymous authentication method for multi-attribute authoritative systems. Background Technology

[0002] Anonymous credential technology is an encryption technique that verifies a user's permissions or qualifications without revealing their true identity. This characteristic has significant application value in privacy protection and digital identity authentication. In particular, attribute-based credential technology focuses on verifying whether a user possesses specific attributes, rather than directly exposing their true identity, thus providing more robust protection for user privacy.

[0003] Single sign-on (SSO) allows information service providers to verify user privileges based on attributes through a user identity provider, achieving an elegant decoupling between service and identity. Anonymous credential technology can be well applied to the SSO model, completing authentication while protecting privacy, because it only needs to selectively display certain attributes during the authentication process.

[0004] With the development of the network environment, decentralized network architectures, due to their absence of single-point bottlenecks, have been increasingly applied in the commercial field in recent years. In a more realistic context, user attributes come from different attribute authorities. Currently, although some anonymous credential schemes can achieve credential generation by multiple issuers, these schemes require service providers to trust all issuers of the credential. In practice, service providers should only trust the authority associated with the attributes required by the service access policy. For example, if the access policy of a video playback service requires the user to have sufficient balance (issued by video website T) and meet age requirements (issued by the birth record authority), then the service provider only needs to trust video website T and the birth record authority, without needing to consider whether to trust other authorities related to credential attributes. However, current multi-attribute authority anonymous credential schemes are not secure when the credential issuer includes untrusted authorities.

[0005] Therefore, there is an urgent need in this field to implement a fine-grained anonymous authentication method for multi-attribute authoritative systems, so that service providers can still securely and anonymously authenticate users even when the issuer of user credentials contains untrusted authorities. Summary of the Invention

[0006] This invention addresses the aforementioned shortcomings in existing technologies by proposing a fine-grained anonymous authentication method for multi-attribute authoritative systems. Through techniques such as attribute private key binding, blinded signatures, and zero-knowledge proofs, it achieves a balance between security, privacy, decentralized trust, and efficiency, resolving the collusion risk and privacy leakage issues in multi-attribute authoritative systems and providing a reliable technical foundation for next-generation anonymous authentication systems.

[0007] The technical solution of the present invention is as follows:

[0008] A fine-grained anonymous authentication method for a multi-attribute authoritative system is characterized in that the multi-attribute system includes a central authority, multiple attribute authorities, N users, and M dependent parties, and the method includes the following steps:

[0009] Step 1. During the initialization of the multi-attribute authority system, the central authority initializes the public parameters and secret values;

[0010] The central authority initializes public parameters and secret values, including:

[0011] The system is initialized, and the secret value includes: two private keys γ and y0, and N secret member values ​​k1,…,k N , where N is the maximum number of times the credential can be issued; the public parameters include the public key corresponding to the two private keys;

[0012] The public key of the two private keys is Here, g2 is a generator on the pre-agreed group G2.

[0013] Step 2. The attribute authority generates a secret value for each managed attribute and publishes the parameter publicly, proving possession of the secret value through zero-knowledge proof; the specific steps are as follows:

[0014] (2-1) Each attribute authority manages a set of attribute indexes, and the attribute indexes managed by different attribute authorities contain different elements;

[0015] (2-2) For each element of the attribute index set managed by the attribute authority, the attribute authority generates a secret value y. k And release public parameters Where g2 is a generator on the pre-agreed group G2;

[0016] (2-3) The attribute authority mentioned above proves that it holds the generated secret value y through zero-knowledge proof. k ;

[0017] Step 3. When a user joins, an empty credential σ is obtained from the central authority; details are as follows:

[0018] When the user joins, the central authority selects a secret value k for the user. j and random number v j ∈G1, where G1 is a pre-agreed group;

[0019] Central authoritative calculation of blank vouchers (k) j ,σ j Send to the user.

[0020] Step 4. The user sequentially seeks the attribute authority to sign the credential, ultimately obtaining a credential signed with multiple attributes; details are as follows:

[0021] (4-1) The user holds the secret (k) j ,σ j ), sequentially search for the authority of each attribute to the voucher σ j Signature is performed while searching for attribute authority A. i Before signing, σ j The signed attribute index set is

[0022] (4-2) User to attribute authority A i Send the blinded secret and request A i For σ j Perform attribute signing; the secret after blinding:

[0023] User will σ j Analysis as σ j = (σ1, σ2), select a random number t, and blind the secret held by u (k). j , σ j ),generate

[0024]

[0025] After that, the user selects r k r u and {r s}, s∈I, calculate

[0026]

[0027] Where e is a bilinear pairing mapping e: G1×G2→G T G1, G2, G T Let R0 be a pre-agreed group; I is the set of attribute indexes that have been signed in the user's credentials. The user sends R0 and σ′ to the attribute authority A. i These parameters are used for user-directed authority proofs of ownership (k) j , σ j );

[0028] (4-3) Attribute Authority Ai Check the intersection of the signed attribute index set in the user credentials and its own attribute index set. Whether it is empty, if the intersection is not empty, it means that it has already been the user's credential σ. j If a signature has been made, no further steps are required; if the intersection is empty, attribute authority A... i Send a random challenge c to the user, and the user uses c to prove to the attribute authority that they possess (k) through knowledge proof. j , σ j ), and σ j It contains the signed attribute m s , s∈I;

[0029] (4-4) After the proof is completed, attribute authority A i The set of attributes to be signed by the user The attribute check-in user sends a blinded credential, including: Attribute Authority A i Sign the blinded credential σ′ sent by the user; attribute authority A i Select a random number t i Prepare user attribute sets Generate new voucher The user receives a new credential σ, which contains attributes including the search for attribute authority A. i Previously signed attribute m s s∈I, attribute authority A i The attribute set m of the signature k Holding (k) j , σ=(σ1,σ2)).

[0030] Step 5. When a user obtains services provided by a dependent party, if the attributes contained in the credentials satisfy the dependent party's access control policy... Then, it proves to the dependent party that it possesses the required attributes, thus completing anonymous authentication; the specific steps are as follows:

[0031] (5-1) The access control policy for the services provided by the dependent party includes the attribute index set I. R For index set I R For some indexes i, the access strategy requires a specific attribute value, using I. f This represents this portion of the index set; for other index values, the access policy provides the allowed range, denoted by I. r This represents this part of the index set;

[0032] (5-2) For I r The set of attribute indexes represents the information provided, and the user needs to prove, through knowledge proof, that the signed and valid attribute m in the credential is valid. i Satisfying the access strategy, expressed using a Boolean algorithm:

[0033]

[0034] in, The access strategy is described above, where R is accessed through a specific function f. R And the secret of the blind {r i The generated commitments, c and {z} i These are challenges and responses, respectively.

[0035] (5-3) The user proves to the dependent party through knowledge proof that the credential σ he holds is signed, and the attributes contained in the index set f are also signed with I. r The index contains certain attributes that satisfy the access policy specified by the dependent party. The user sends the parameters required for knowledge proof to the dependent party.

[0036] In step (5-3), the user sends the parameters required for the knowledge proof to the dependent party, including:

[0037] The random numbers t and u are selected in the same manner as in step (4-2), and the calculated σ′ is obtained.

[0038] User selects r k r u and calculate

[0039]

[0040] R f =f(r s ∈I r )

[0041] c = H(σ′,R0,R) f )

[0042] Calculate z k =r k +ck j , z u =r u +cu;

[0043] For all Calculate z s =r s +cm s , convert (σ′, R0, R f ) and the calculated z k , z u and all z s , Send to the dependent party.

[0044] (5-4) The dependent party verifies whether the user's credential attributes meet the access policy. If they do, the user can access the service normally.

[0045] Compared with the prior art, the technical effects of the present invention are as follows:

[0046] By using attribute authority to select a private key and publish a public key for each managed attribute, the tampering of signed attributes is prevented. Compared to existing authentication schemes, this invention offers significant improvements in both security and privacy protection.

[0047] First, the attribute authority is responsible for issuing attribute-based credentials, a process that does not require the involvement of a central authority. For each attribute under its management, the attribute authority selects a private key and publishes public parameters, proving possession of the private key through zero-knowledge proofs. In existing multi-attribute authority anonymous authentication schemes, the attribute authority does not select a private key for each attribute; instead, the attributes it issues are directly signed in the credential using discrete logarithms. This allows users to collude with untrusted attribute authorities, obtaining credentials without modifying the already signed attribute m. i In the case of claiming to possess the attribute m′ i Furthermore, anonymous authentication can be successfully completed, rendering the entire credential untrustworthy. In our proposed solution, the signed attribute m is present in the credential issued by the attribute authority. i Binding the attribute to the private key prevents collusion between the user and an untrusted attribute authority to compromise the signed attribute m. i Claimed as attribute m′ i This enhances the security of the entire solution.

[0048] In terms of privacy protection, thanks to the use of anonymous credential technology, users only need to prove that they have certain attributes when authenticating, without having to show their real identity or other irrelevant attributes, which effectively protects user privacy. Attached Figure Description

[0049] Figure 1 This is a schematic diagram of a multi-attribute authoritative anonymous authentication system.

[0050] Figure 2 This is a flowchart of a fine-grained anonymous authentication method for multi-attribute authoritative systems.

[0051] Figure 3 This is a diagram illustrating how users sequentially search for the authoritative attributes of each attribute to sign the credential.

[0052] Figure 4 This is a diagram illustrating the level of trust that a service provider places on the attributes contained in a user's credentials when performing anonymous user authentication. Detailed Implementation

[0053] The present invention will be further explained below with reference to the accompanying drawings and embodiments, but this should not be construed as limiting the scope of protection of the present invention.

[0054] like Figure 1 The multi-attribute authoritative anonymous authentication system shown includes a central authority, multiple attribute authorities, N users, and M dependent parties. The central authority and each attribute authority are credential issuers, and the dependent parties are service providers. Users obtain anonymous credentials signed with attributes from the credential issuers, and can then anonymously authenticate with the service providers to obtain services.

[0055] like Figure 2 As shown, the overall anonymous authentication process consists of 5 steps:

[0056] Step 1. During the initialization of the multi-attribute authority system, the central authority initializes the public parameters and secret values.

[0057] The secret values ​​include: two private keys γ and y0, and N secret member values ​​k1,…,k N , where N is the maximum number of times a credential can be issued, which is also the maximum number of users that the authentication system can contain. Secret γ and secret y0 are used together for issuing user credentials.

[0058] The public parameters include the public key corresponding to the two private keys. Here, g2 is a generator on the pre-agreed group G2.

[0059] Step 2. The attribute authority joins the system, generates a secret value for each managed attribute, publishes the parameters publicly, and proves possession of the secret value through zero-knowledge proof. The specific process is as follows:

[0060] (2-1) Each attribute authority manages a set of attribute indexes. The attribute index sets managed by different attribute authorities contain different elements.

[0061] (2-2) For each element of the attribute index set managed by attribute authority The attribute authority generates a secret value y. k And release public parameters Where g2 is a generator on a pre-agreed group G2, and the secret value y k Used to prevent users from colluding with other attribute authorities to claim attribute m k For other attributes.

[0062] (2-3) The attribute authority proves that it holds the generated secret value y through zero-knowledge proof. k The zero-knowledge proof process is as follows:

[0063] Prove that you have y k The publicly disclosed parameters are

[0064] 1: Choose R = g r

[0065] 2: Based on a secure hash function, the result obtained with R as input.

[0066] 3: z = cy k +r

[0067] 4: Output (R, c, z)

[0068] Where R is a random commitment, c is a challenge, and z is the response to challenge c. Other parties can verify Y. k c R = g z To verify whether the private key selected by the attribute authority for this attribute is y. k .

[0069] The process of a user obtaining an empty credential from the central authority and then sequentially searching for the credential signature attributes of each attribute authority is as follows: Figure 3 As shown.

[0070] Step 3. When a user joins, an empty credential σ is obtained from the central authority.

[0071] When a user joins, the central authority selects a secret value k for the user. j and random v j ∈G1, where G1 is a pre-defined group.

[0072] Central authoritative calculation of blank vouchers (k) j , σ j Send to the user.

[0073] Step 4. The user sequentially seeks the attribute authority to sign the credential, ultimately obtaining a credential signed with multiple attributes. The specific process is as follows:

[0074] (4-1) The user holds the secret (k) j , σ j ), sequentially search for the authority of each attribute to the voucher σ j Signature is performed while searching for attribute authority A. i Before signing, σ j The signed attribute index set is

[0075] (4-2) User to attribute authority A i Send the blinded secret and request A i For σ j Perform attribute signing. Details are as follows:

[0076] In search of attribute authority A i Previously, the user had accessed other authorities and signed several attributes m in the credentials. ss∈I. The user is currently searching for attribute authority A. i Sign the credential with new attributes.

[0077] First, the user proves to the attribute authority that they possess (k) j , σ j ), will σ j Analysis as σ j = (σ1, σ2), select a random number t, and blind the secret held by u (k). j , σ j ),generate

[0078]

[0079] After that, the user selects r k r u and (r) s ), s∈I, calculate

[0080]

[0081] Where e is a bilinear pairing mapping e: G1×G2→G T G1, G2, G T Let R0 be a pre-agreed group; I is the set of attribute indexes that have been signed in the user's credentials. The user sends R0 and σ′ to the attribute authority A. i .

[0082] (4-3) Attribute Authority A i Check the intersection of the signed attribute index set in the user credentials and its own attribute index set. Whether it is empty, if the intersection is not empty, it means that it has already been the user's credential σ. j If a signature has been made, no further steps are required; if the intersection is empty, attribute authority A... i Send a random challenge c to the user, and the user uses c to prove to the attribute authority that they possess (k) through knowledge proof. j , σ j ), and σ j It contains the signed attribute m s s∈I. Specifically:

[0083] After the user receives c, calculate

[0084] z k =r k +ck j , z u =r u +cu

[0085] And for each s∈I, calculate z s =r s +cms Send the calculation results to attribute authority A. i .

[0086] Attribute Authority A i Resolve σ′ as σ′=(σ1′,σ2′), and check:

[0087]

[0088] If the equation holds true, the proof is successful, and the user has successfully proven to the attribute authority that they possess (k) j , σ j ).

[0089] (4-4) After the proof is completed, attribute authority A i The set of attributes to be signed by the user The attributes are checked into the blinded credentials sent by the user, and the user receives a new credential σ, which contains attributes including finding attribute authority A. i Previously signed attribute m s s∈I, attribute authority A i The attribute set m of the signature k The details are as follows:

[0090] Attribute Authority A i First, select a random number. The set of attributes to be signed by the user Wherein, random number t i Used to blind attributes and their corresponding private keys. Attribute Authority A i Generate new credentials and send them to the user:

[0091]

[0092] The user receives a new credential σ, which contains attributes including the search for attribute authority A. i Previously signed attribute m s s∈I, and attribute authority A i Signature attributes The user now holds the secret (k) j ,σ).

[0093] Figure 4This demonstrates the level of trust a service provider places on attributes included in user credentials during anonymous authentication. The service requires attributes m1, m2, and m4, and the dependent party trusts authorities AA1, AA3, and AA4, who are the issuers of attributes m1, m2, and m4. During authentication, the user claims and proves that their credentials contain attributes m1, m2, and m4. Another credential attribute is m3, issued by AA3, which is not within the dependent party's trust domain. This invention enables secure user authentication under these circumstances, ensuring that the attributes m1, m2, and m4 claimed by the user as being included in their credentials are indeed true attributes. Existing multi-attribute authoritative anonymous authentication schemes cannot achieve this.

[0094] Step 5. When a user obtains services provided by a dependent party, if the attributes contained in the credentials satisfy the dependent party's access control policy... Then, it proves to the dependent party that it possesses the required attributes, completes anonymous authentication, and obtains the service. The specific steps are as follows:

[0095] (5-1) The dependent party specifies the attribute index set I included in the access control policy for the services it provides. R For index set I R For some indexes i, the access strategy requires a specific attribute value, using I. f This represents the set of attribute indexes; for other index values, the access policy provides a allowed range, and user attributes only need to meet this range, represented by I. r This represents the set of attribute indexes.

[0096] (5-2) For I r The set of attribute indexes represents the information provided, and the user needs to prove, through knowledge proof, that the signed and valid attribute m in the credential is valid. i Satisfying the access strategy, expressed using a Boolean algorithm:

[0097]

[0098] in, The access strategy is described above, where R is accessed through a specific function f. R And the secret of the blind {r i The generated commitments, c and {z} i These are the challenge and the response, respectively.

[0099] (5-3) The user proves to the dependent party through knowledge proof that the certificate σ he holds is signed with I. f The attributes contained in the index set are also tagged with I. r The index contains certain attributes that satisfy the access policy specified by the dependent party. The user sends the parameters required for knowledge proof to the dependent party. Specifically:

[0100] The user selects random numbers t and u in the same manner as in step (4-2), and calculates σ′.

[0101] User selects r k r u and {r s}, calculate:

[0102]

[0103] R f =f(r s ∈I r )

[0104] c = H(σ′,R0,R) f )

[0105] Calculate z k =r k +ck j , z u =r u +cu;

[0106] For all Calculate z s =r s +cm s , convert (σ′, R0, R f ) and the calculated z k , z u and all z s , Send to the dependent party. The user calculates z. s =r s +cm s , Because the certificate contains I f In addition to the attributes in the document, it also includes other attributes, which the user needs to verify with the dependent party that the certificate contains I. f The attributes in.

[0107] (5-4) The dependent party verifies whether the user's credential attributes meet the access policy. If they do, the user can access the service normally. Details are as follows:

[0108] After receiving the user authentication message, the dependent party verifies whether the user attributes meet the access policy by checking the following equation:

[0109]

[0110] If all the above equations are true, then the user has completed the knowledge proof, and the dependent party confirms that the user's credentials contain the access policy. If the required attributes are met and anonymous authentication is successful, the user can access the service normally.

[0111] Any matters not covered in the above embodiments of the present invention are well-known in the art.

[0112] This invention generates an independent private key for each attribute authority for the attributes it manages and proves to the system that it possesses the private key using zero-knowledge proofs. During attribute signing, the attribute value is bound to the private key, generating a mathematically linked credential. When a user requests an attribute signature, the attribute authority checks whether the user's credential already contains attributes it manages (verified through the intersection of index sets), preventing duplicate signatures or attribute tampering, thus ensuring that the user cannot collude with an untrusted attribute authority to tamper with signed attributes. The attribute sets managed by different attribute authorities are mutually exclusive, and their private keys are generated independently; even if some attribute authorities are compromised, the security of other attributes cannot be affected.

[0113] When a user requests a signature from an attribute authority, empty credentials are blinded using random numbers to generate temporary credentials, hiding the association information of the original credentials. This ensures that different signing sessions cannot be associated with the same user, preventing attribute authorities or dependent parties from tracking user behavior. When a user proves to a dependent party that an attribute satisfies the access policy, the existence and scope of the attribute are proven only through mathematical commitments and challenge-response mechanisms, without disclosing specific attribute values ​​or identity information.

[0114] The bilinear pairing-based verification mechanism ensures security while reducing exponential and modular inverse calculations, making it suitable for resource-constrained Internet of Things (IoT) devices. Attribute authorities can be dynamically added to the system; adding new attributes does not require refactoring global parameters, supporting high-concurrency users and attribute management.

[0115] The specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various modifications or variations within the scope of the claims, which do not affect the essence of the present invention.

Claims

1. A fine-grained anonymous authentication method for multi-attribute authoritative systems, characterized in that, The multi-system comprises a central authority, multiple attribute authorities, N users, and M dependent parties. The method includes the following steps: Step 1. In the system initialization phase, the central authority generates public parameters and secret values, including: Select bilinear paired groups G1, G2, G... T g1 is a generator on group G1, and g2 is a generator on group G2, i.e., g1∈G1 and g2∈G2; Generate private key And calculate the corresponding public key. Generate N secret member values ​​k1,…,k N , used as a unique identifier for user credentials, where N is the maximum number of times a credential can be issued; Step 2. Each attribute has a unique set of attribute indexes managed by the authority. And perform the following operations for each attribute: For each element of the attribute index set managed by the attribute authority, generate a private key y. k and publish public keys Prove to the system that you hold the private key y using zero-knowledge proof. k ; Step 3. During user registration, the central authority assigns a secret value k to the user. j and random number v j ∈G1, generate an empty voucher And the secret (k) j ,σ j Send to the user; Step 4. The user sequentially requests attribute signatures from multiple attribute authorities to obtain a credential signed with multiple attributes, specifically including: User-oriented attribute authority A i Send blinded credentials in, This is a random blinding factor; Attribute Authority A i The user credentials do not contain the attribute set managed by the user. And verify the user's knowledge of the secret (k) through a challenge-response mechanism. j ,σ j The legal possession of ) and σ j It contains the signed attribute m s ,s∈I; After verification, attribute authority A i Use the private key to blind the credential σ ′ Sign and generate new credentials The user receives a new credential σ and holds (k) j ,σ=(σ1,σ2)); Step 5. When a user requests a service from a dependent party, if the credential attributes satisfy the dependent party's access control policy... Anonymous authentication is then achieved through zero-knowledge proofs, including: The dependent party specifies the access control policy for the services it provides. Includes a defined attribute index set I f and range attribute index set I r ; User-generated commitment and R f =f(r s ∈I r ), and generate the challenge c = H(σ) ′ ,R0,R f ); The user calculates the response and sends it to the dependent party, which verifies the following equation: and Service permissions are granted after successful verification; Step 4 also includes: The blinded credential generation process satisfies the following: each time a user requests a signature, an independent random number is used. Empty voucher σ j Blinding is performed to ensure that different signature sessions are not correlated; The attribute authority's signature operation on blinded credentials includes the introduction of random numbers. Used to blind attribute signatures and prevent signatures from being traced.

2. The fine-grained anonymous authentication method for multi-attribute authoritative systems according to claim 1, characterized in that, The zero-knowledge proof in step 2 also includes: The verifier checks Y k c R = g z To verify the authority of the attribute for the private key y k Holding.

3. The fine-grained anonymous authentication method for multi-attribute authoritative systems according to claim 1, characterized in that, In step 5, the range attribute index set I r The verification is achieved by the user constructing a scope-related commitment R. f And based on Boolean algorithm Prove that the attribute value satisfies the access policy.

4. The fine-grained anonymous authentication method for multi-attribute authoritative systems according to claim 1, characterized in that, The bilinear pairwise mapping e: G1×G2→G T The pairing is asymmetric bilinear, and the groups G1, G2, G... T The order of is a prime number p.

5. The fine-grained anonymous authentication method for multi-attribute authoritative systems according to claim 1, characterized in that, The user empty credential σ j The generation of satisfies the following conditions: Among them, v j ∈G1 is a random number, k j This is a unique secret value for the user.

Images