Anonymous credential privacy generation method with associated user identity information

Abstract

The application particularly relates to an anonymous credential identification privacy generation method associated with user identity information, which comprises the following steps: a user generates a Pedersen commitment; the user sends the Pedersen commitment to a user identity information provider for verification and signature; the user broadcasts the signed Pedersen commitment to all members of a credential issuing committee, and sends identity information fragments to each committee member through a secure channel; the committee member verifies the correctness of the identity information fragments, and jointly calculates an anonymous credential identification; the committee checks the uniqueness of the anonymous credential identification, and if the identification already exists, the process is aborted; if the identification does not exist, the identification is stored in a data structure and the anonymous credential is continuously issued; when a malicious user is found, the user identity is restored by publicly publishing the fragment information and verifying the correctness of the fragments, and aggregating the fragment information. The method can realize the unique binding of the anonymous credential and the user identity information without leaking the user information, and effectively resist identity witch attack.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, and in particular to a method for generating privacy of anonymous credential identification associated with user identity information. BACKGROUND

[0002] In the Internet environment, identity authentication as the first line of defense against network malicious attacks, ensures that only authorized users can access the system or resources, which can effectively prevent hackers and criminals from stealing and misusing other people's identity information for illegal operations. However, the traditional identity authentication method often requires users to provide a large amount of personal information, which may be stolen or misused by criminals during transmission and storage, and the user's behavior is easy to be monitored by various tracking technologies, resulting in a huge risk of misuse of user information. How to protect the privacy information of users in the identity authentication process from being leaked has become a hot issue. In addition, users' awareness of data privacy protection is increasing in the process of using Internet services, and supporting users to voluntarily disclose personal information has become a trend in identity authentication. Under this background, anonymous credential technology as an advanced identity authentication technology has been gradually adopted by the industry. Anonymous credential technology allows users to prove that they have identity credentials that meet their access requirements without revealing their real identity or sensitive information, while ensuring the non-forgeability and anonymity of the credentials.

[0003] Existing anonymous credential technology mainly uses blind signature, zero-knowledge proof and other technologies to make users show credentials without revealing their real identity or sensitive information, while ensuring the non-forgeability and anonymity of the credentials. However, the current related technology does not fully consider the identity Sybil attack initiated by malicious users, that is, malicious users can arbitrarily generate identity attribute information related to them, create and control multiple false identities, and obtain anonymous credentials corresponding to the false identities, and obtain disproportionate influence in different Internet applications, such as affecting the correctness of voting or consensus mechanism, manipulating the market or transactions.

[0004] It should be noted that the information disclosed in the above background section is only used to strengthen the understanding of the background of the present application, and therefore can include information that does not constitute prior art known to those of ordinary skill in the art. SUMMARY

[0005] The present application provides a method for generating privacy of anonymous credential identification associated with user identity information, which can realize the unique binding of anonymous credentials and user identity information without revealing user information, and effectively resist identity Sybil attack.

[0006] Other characteristics and advantages of the present application will become apparent from the following detailed description, or will be learned by practice of the present application.

[0007] According to a first aspect of the present application, there is provided a method for generating privacy-preserving anonymous credential identifiers associated with user identity information, the method comprising:

[0008] The user generates a public / private key pair and maps the identity identifier into a specific domain via a hash function, generating a Pedersen commitment;

[0009] The user sends the Pedersen commitment to a user identity information provider for verification and signing;

[0010] The user broadcasts the signed Pedersen commitment to all members of a credential issuing committee and sends identity information shards to each committee member via a secure channel;

[0011] The committee members verify the correctness of the identity information shards and jointly compute an anonymous credential identifier via secure multi-party computation and zero-knowledge proof techniques;

[0012] The committee checks the uniqueness of the anonymous credential identifier, and if the identifier already exists, the process is aborted; if not, the identifier is stored in a data structure and the anonymous credential is issued;

[0013] When a malicious user is found, the shards are aggregated to recover the user's identity by publicly revealing the shards and verifying their correctness.

[0014] In some example embodiments, the step of generating a Pedersen commitment by the user comprises:

[0015] The user maps an identity identifier into a specific domain using a hash function H, obtaining

[0016] The user computes a Pedersen commitment id,u of v where g and h are generator elements and r id,u is a random number.

[0017] In some example embodiments, the step of jointly computing an anonymous credential identifier by the committee members comprises:

[0018] The committee members locally compute a combined value of the identity information shards and key shards and generate a corresponding Pedersen commitment;

[0019] The committee members jointly compute an intermediate value of the anonymous credential identifier via secure multi-party computation techniques;

[0020] The committee members verify the correctness of the intermediate value using zero-knowledge proof techniques and generate the final anonymous credential identifier.

[0021] In some example embodiments, the step of checking the uniqueness of the anonymous credential identifier comprises:

[0022] The committee member maintains a data structure to store the anonymous credential identifier and its corresponding credential information;

[0023] The committee member checks whether the newly generated anonymous credential identifier already exists in the data structure;

[0024] If the identifier already exists, the user is marked and the process is aborted; if not, the identifier is stored in the data structure and the anonymous credential is issued.

[0025] In some example embodiments, the step of recovering the user identity comprises:

[0026] When a malicious user is found, the committee member discloses the identity information fragments and their Pedersen commitments;

[0027] The committee member verifies the correctness of the fragments and aggregates the fragment information to recover the user identity;

[0028] By traversing the hash value, the user identity information matching the aggregated value is found.

[0029] According to a second aspect of the present application, an anonymous credential identifier privacy generation system associated with user identity information is provided, comprising:

[0030] A user module for generating a public / private key pair, calculating a Pedersen commitment, and interacting with a user identity information provider;

[0031] A user identity information provider module for verifying and signing the Pedersen commitment submitted by the user;

[0032] A credential issuing committee module for receiving the Pedersen commitment and fragment information broadcast by the user, jointly calculating the anonymous credential identifier, and checking the uniqueness of the identifier;

[0033] A data structure module for storing the anonymous credential identifier and its corresponding credential information;

[0034] A secure multi-party computation module for secure computation and zero-knowledge proof verification among committee members.

[0035] According to a third aspect of the present application, a storage medium having a computer program stored thereon is provided, wherein the computer program, when executed by a processor, implements the anonymous credential identifier privacy generation method associated with user identity information according to the first aspect.

[0036] According to a fourth aspect of the present application, a computer program product is provided, which has stored thereon a computer program, the computer program, when executed by a processor, implements the privacy generation method of the anonymous credential identification associated with user identity information according to the first aspect.

[0037] According to a fifth aspect of the present application, an electronic device is provided, comprising:

[0038] a processor; and

[0039] a memory for storing executable instructions of the processor;

[0040] wherein the processor is configured to implement the privacy generation method of the anonymous credential identification associated with user identity information according to the first aspect by executing the executable instructions.

[0041] The privacy generation method of the anonymous credential identification associated with user identity information provided by the embodiments of the present application further improves the calculation efficiency of the anonymous credential identification under the premise of ensuring security, thereby reducing the calculation overhead of resisting identity witch attack. The method has simple design and low calculation complexity, can be applied to secure multi-party calculation in distributed systems, and has anti-single-point-failure capability. By researching and adopting the secure-computation-friendly identification calculation method, the unique binding of user privacy identity information and anonymous credential is realized, and a more secure, robust, efficient and feasible anonymous credential solution is built.

[0042] Compared with the prior art, the following advantages are achieved:

[0043] 1. Effectively defend against identity witch attack: By adopting the secure-computation-friendly identification calculation method, the unique binding of user identity information and anonymous credential is realized, ensuring that each anonymous credential corresponds to a unique user identity, thereby effectively resisting identity witch attack and improving the security of the system.

[0044] 2. Improve calculation efficiency and reduce overhead: The present application designs a simple and efficient calculation method, reduces the calculation complexity and resource consumption in the anonymous credential identification generation process, reduces the calculation and storage overhead of the system, and improves the efficiency of credential management and generation.

[0045] 3. Enhance system robustness and avoid single-point-failure: Through the distributed credential issuance mechanism, the dependence on a single authentication server is avoided, the anti-attack ability and fault tolerance of the system are enhanced, and even if some nodes fail, the system can still operate normally, avoiding business interruption caused by single-point-failure.

[0046] 4. Simplify the identification calculation process and have strong feasibility: The new secure-computation-friendly identification calculation method has low complexity, is simple to use, and is convenient for large-scale deployment and application of the scheme in actual production environment.

[0047] It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the application, as claimed. BRIEF DESCRIPTION OF DRAWINGS

[0048] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the application and serve to explain the principles of the application. It is readily apparent to one skilled in the art that the following described embodiments are only exemplary and that many other embodiments can be implemented based on these drawings without paying creative labor.

[0049] Figure 1 System structure schematic diagram for exemplary embodiments of the present application;

[0050] Figure 2 Anonymity credential identification privacy generation method flowchart for associating user identity information for exemplary embodiments of the present application. DETAILED DESCRIPTION

[0051] Example implementations will now be described more fully with reference to the accompanying drawings. Example implementations may, however, be implemented in many different forms and should not be construed as limited to the examples set forth herein; rather, these examples are provided so that this disclosure will be thorough and complete, and fully convey the scope of example implementations to those skilled in the art. Features described in the description, structures, or characteristics can be combined in any suitable manner in one or more embodiments.

[0052] In addition, the drawings are merely schematic and are not drawn to scale. Identical reference numerals in the figures designate the same or similar parts throughout the figures and the detailed description. Some of the blocks in the drawings are functional blocks that do not necessarily have a corresponding structure directly correlated in one-to-one manner with the functional blocks. These functional blocks can be implemented by software, or in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0053] In the related art, with the rapid development of decentralized technology and the increasing demand for privacy protection, the shortcomings of the traditional identity authentication system gradually emerge, especially in the scenes of decentralized finance (DeFi), electronic voting, privacy protection access control, etc. The balance between user identity authentication and privacy protection has become a core challenge that needs to be solved in current technology. On the one hand, the centralized identity authentication mechanism exposes problems such as data leakage, privacy infringement and single point failure, and is difficult to meet the needs of security, privacy and verifiability in decentralized systems. On the other hand, how to ensure the effectiveness of identity verification while realizing the anonymity and uniqueness of user identity has become an important technical problem to promote the landing of decentralized applications.

[0054] Alberto Sonnino et al. proposed an anonymous credential technology Coconut based on blind signature. In Coconut, credential issuance depends on a credential issuing committee containing multiple members, and users obtain the signature of user attribute information from the credential issuing committee through blind signature and zero-knowledge proof. The signature process uses the signature scheme given in the literature Short randomizable Signatures, and in the process of obtaining the signature, the members of the credential issuing committee can only determine that the user's attribute meets the requirements of the credential issuance, but cannot obtain the specific value of the user's attribute. When using the credential, the user first randomizes it, and then satisfies the access requirements of the service provider through zero-knowledge proof technology under the premise of hiding the user attribute value. The biggest advantage of Coconut is the convenience of verifying anonymous credentials, but in the credential application stage, the credential issuing committee cannot verify the information submitted by the user, and thus cannot resist identity witch attacks.

[0055] Deepak Maram et al. proposed an anonymous credential scheme CanDID to resist identity witch attack. In CanDID, the credential issuing still relies on the credential issuing committee, where the anonymous credential of the user contains two parts: the main credential and the derived credential. First, the user applies to the credential issuing committee to obtain the main credential, and at the same time, the credential identifier containing the user's identity information is calculated among the committee members based on secure multi-party technology, ensuring the one-to-one correspondence between the user's identity information (identity card number, phone number, etc.) and the main credential, and the user's identity information can be recovered when the user commits malicious behavior, and the user can be traced in time. When the user accesses the Internet application, the user applies to the credential issuing committee to obtain the derived credential for accessing the application based on the user's main credential, and the privacy relationship between the main credential and the derived credential is ensured through zero-knowledge proof. In CanDID, the secure multi-party computation technology is used to jointly calculate the message authentication code of the user's identity information among the members of the credential issuing committee, which is used as the identifier of the user's anonymous credential. By checking whether the identifier exists in the identifier database, the unique binding relationship between the user and the anonymous credential is ensured to resist identity witch attack. However, when calculating the message authentication code of the user's identity information, the calculation cost is too large due to the complexity of the calculation process, which affects the convenient use of the anonymous credential to some extent.

[0056] Michael Rosenberg et al. proposed zk-creds based on zero-knowledge proof. In zk-creds, unlike the above two schemes, the generation of anonymous credentials does not depend on the credential issuing committee, and any entity that has user attribute information can play the role of credential issuer, which requires the entity to publish the cryptographic commitment of the user attribute information (as the user's credential) in the public bulletin board. When the user accesses the Internet application, the user needs to use zero-knowledge proof technology to prove that the credential exists in the bulletin board and that the user attribute information contained in the credential meets the access requirements. The existence proof of the credential in the bulletin board does not leak the user's corresponding credential, which ensures anonymity. However, in this scheme, the entity that plays the role of credential issuer needs to be included in the entire anonymous credential system, which limits the feasibility of the scheme in actual deployment, and once the credential issuer is controlled by the attacker, the entire credential system will fail.

[0057] Wei-Zhu Yeoh et al. proposed FIDO-AC based on FIDO2. On the basis of FIDO2, the function is extended to enable it to support the user's anonymous credential, and to realize a more secure and privacy-friendly identity authentication. FIDO-AC provides a scheme of anonymous but verifiable identity information by combining FIDO2 authentication process and electronic identity documents (eID, such as ePassport). The user attribute verification mechanism is introduced on the basis of FIDO2 authentication, which guarantees the minimization of data in the identity authentication process, gives the user control over his own data, and realizes a more secure and private identity authentication mechanism. FIDO-AC combines existing FIDO2 security tokens and trusted electronic identity documents, which improves the security and reliability of identity authentication while having strong compatibility. Although the FIDO-AC scheme has many advantages, it still faces challenges such as identity document dependence, increased authentication complexity, computational performance overhead, and trust management problems, and may need further optimization in identity credential management and computational efficiency.

[0058] In summary, the existing anonymous credential scheme has the following problems in generating anonymous credential identification privacy based on user identity information: either it fails to fully consider how to effectively resist identity witch attack, or it has too large computational overhead or insufficient system security when defending against such attacks, or it lacks feasibility and deployability in actual production environment, or it is vulnerable to attack, resulting in single point of failure and weak system robustness.

[0059] In view of the shortcomings and deficiencies of the prior art, an anonymous credential identification privacy generation method associated with user identity information is provided in the example embodiment, aiming to realize the unique binding of anonymous credential and user identity information, while improving the computational efficiency and reducing the computational overhead of resisting identity witch attack.

[0060] Firstly, the principle of the present application is explained, which is specifically explained from the following four aspects: two-party multiplication calculation function, non-interactive sigma protocol, multi-party secure computation multiplication equality test, anonymous credential, and zero-knowledge proof.

[0061] (1) Two-party multiplication calculation function

[0062] Function input: committee member owns x i and committee member owns y j ;

[0063] Function output: committee member obtains w ij , committee member obtains w ji , and wij +w ji =x i ·y j ;

[0064] Computational process:

[0065] 1. Committee member and Pre-generate multiplication triples, where has (a i , b i , c i ), has (a j , b j , c j ), and

[0066] c i + c j = (a i + a j ) · (b i + bj)

[0067] 2. Committee member Randomly select x ii and x ij from such that x i = x ii + x ij mod p and send x ij to

[0068] 3. Committee member Randomly select y ji and y jj from such that y j = y ji + y jj mod p and send y ji to

[0069] 4. Locally compute u i = x ii + a i and v i = y ji + b i and send u i and v i to

[0070] 5. Locally compute u j = xij +a j and v j =y jj +b j and u j and v j Send to

[0071] 6. and Calculate u = u together i +u j and v = v i +v j ;

[0072] 7. Committee Members Calculated according to the following formula

[0073] w ij =vx ii +uy ji +c i -uv

[0074] 8. Committee Members Calculated according to the following formula

[0075] w ji =vx ij +uy jj +c j

[0076] (2) Verify the correctness of Pedersen commitments using a non-interactive Sigma protocol.

[0077] Input: Proofer's private input (v, r) and public parameter Pedersen commitment C

[0078] Output: Zero-knowledge proof of π, proving that the Persen commitment C is calculated from the given (v,r)

[0079] Objective: To generate zero-knowledge proofs for π that ensure its value satisfies the following without leaking v and r:

[0080] C = g v h r

[0081] Calculation process:

[0082] 1. Common parameter generation, including generator g, hash function H, security group G, etc.

[0083] 2. The prover is randomly selected from Z. q Choose b, s; calculate the commitment value: X = gb h s

[0084] 3. Prover generates: e = H(C, X)

[0085] And calculates

[0086] z = b + e · a

[0087] t = s + e · r

[0088] Then the prover sends π = (X, z, t) to the verifier

[0089] 4. Verifier verifies whether the following equation holds:

[0090] g t h z = X + e · C

[0091] (3) Anonymous Credential

[0092] In the design of decentralized identity authentication systems, anonymous credentials (Anonymous Credential) are an important tool for protecting user privacy and achieving secure identity verification. They allow users to prove that their identity has been verified and has certain specific qualifications without revealing their real identity, thereby meeting the needs of the system in terms of privacy protection, identity deduplication, and security. As a cryptographic tool, anonymous credentials have the following characteristics:

[0093] a. Anonymity: The credential holder can prove the legitimacy of their identity without revealing their specific identity information.

[0094] b. Verifiability: The credential is generated by a trusted party (such as a distributed committee), and service providers can verify its authenticity and validity

[0095] c. Non-tamperability: Once the credential is generated, it cannot be tampered with or forged

[0096] d. Decentralization: The generation and verification process of the credential does not rely on a single trusted center, making it suitable for distributed system design.

[0097] Through anonymous credentials, the system can implement the "minimum disclosure principle" of identity authentication, that is, while providing services, only the necessary authentication results are exposed, without revealing the user's real identity information.

[0098] The generation and verification of anonymous credentials are based on zero-knowledge proof and digital signature technology in cryptography to ensure anonymity and security.

[0099] (4) Zero-knowledge proof

[0100] Zero-Knowledge Proof (ZKP) is a kind of cryptography technology, which allows the prover to prove the authenticity of a statement to the verifier without revealing any actual information. Zero-Knowledge Proof has a wide range of applications in decentralized identity authentication, privacy protection and distributed systems, especially in ensuring the privacy and security of user identity information and the correctness of the deduplication mechanism in the system. The types of Zero-Knowledge Proof can be divided into interactive Zero-Knowledge Proof and non-interactive Zero-Knowledge Proof; interactive Zero-Knowledge Proof is the traditional Zero-Knowledge Proof method, in which the prover and the verifier exchange information through multiple rounds of interaction, and the verifier tests whether the prover can correctly prove the statement through some challenge questions; in non-interactive Zero-Knowledge Proof, the prover and the verifier do not need multiple rounds of interaction, but pass the proof in a single message. This method is usually completed by constructing a common reference string (CRS).

[0101] The present application is dedicated to anonymous credential application, which realizes the privacy binding of user identity information and anonymous credential, guarantees the unique association of anonymous credential and user, and resists identity witch attack. In this process, the sensitive identity information of the user is not leaked, and the user identity information can be restored when the user behavior is abnormal, so as to realize the tracing of abnormal users.

[0102] As shown in Figure 1 , the present system includes three main roles: user (User, u), user identity information provider (User Information Provider, UIP), and committee (Committee, C) for identity information authentication and anonymous credential issuance.

[0103] The method of the present application includes several stages: initialization, user identity information acquisition, user identity information fragmentation and verification, user identity information deduplication, and user identity information tracing.

[0104] As shown in Figure 2 , the specific steps can include the following steps:

[0105] Step S1, the user generates a public key / private key pair, and maps the identity identifier to a specific domain through a hash function to generate a Pedersen commitment;

[0106] Step S2, the user sends the Pedersen commitment to the user identity information provider for verification and signature;

[0107] ​Step S3, the user broadcasts the signed Pedersen commitment to all members of the credential issuing committee, and sends the identity information shards to each committee member through a secure channel;

[0108] Step S4, the committee members verify the correctness of the identity information shards, and jointly calculate the anonymous credential identifier through secure multi-party computation and zero-knowledge proof technology;

[0109] Step S5, the committee checks the uniqueness of the anonymous credential identifier, if the identifier already exists, the process is aborted; if not, the identifier is stored in the data structure and the anonymous credential is issued;

[0110] Step S6, when a malicious user is found, the user's identity is restored by publishing the shard information and verifying the correctness of the shards.

[0111] In the following, the various steps of the method for generating an anonymous credential identifier with associated user identity information in the present example embodiment will be described in more detail in conjunction with the accompanying drawings and examples.

[0112] (1) Initialization

[0113] The user u generates a public / private key pair (pk u , sk u );

[0114] The user identity information provider UIP generates its public / private key pair (pk UIP , sk UIP ) for verifying the user identity information;

[0115] The committee members for anonymous credential issuance generate key shards for user identity information privacy binding, the corresponding public key is pk ID ; in addition, for any committee member , a private key for distributed signature is generated

[0116] (2) User identity information acquisition

[0117] The user u maps its identity identifier (such as ID card number, passport number, etc.) to a specific domain using a hash function H, obtaining v id,u is calculated using the following formula: id,u

[0118]

[0119] where g and h are generators, rid,u is a random number in a certain domain are randomly selected.

[0120] User u sends (C id,u , r id,u , pk u ) to user identity information provider UIP;

[0121] After UIP verifies the correctness of C id,u , it uses the private key sk UIP to sign C id,u , obtains σ id,u , and sends it to user u.

[0122] (3) User public key pk u is associated with identity privacy

[0123] User u broadcasts (C id,u , σ id,u ) to all members of committee ;

[0124] For i∈[1,|C|], user u generates wherein and are randomly selected from and satisfy

[0125]

[0126] User u broadcasts to all members of committee , and sends to committee members

[0127] Committee members verify the correctness of , and ensure the correctness of .

[0128] (4) All members of committee jointly calculate the anonymous credential identity of user u

[0129] 4-1) Committee members locally calculate (have and )

[0130]

[0131] wherein ​

[0132]

[0133] and broadcast to committee members;

[0134] 4-2) Committee members Calculate β i (generate shares ofβ)

[0135] Committee members Randomly select β from i and Calculate

[0136] Generate zero-knowledge proof Realize that without leaking β i and ensure that its value satisfies:

[0137]

[0138] Broadcast to committee members

[0139] 4-3) For all committee members Calculate ρ i So that The calculation method is:

[0140] Calculate δ ii = β i τ i

[0141] For and Calculate Where δ ij is kept secret by , δ ji is kept secret by ; Where δ ij + δ ji = β i · τ j ;

[0142] Calculate

[0143] 4-4) All committee members Jointly verify the generated ρ icorrectness, i.e. that no β i (i = 1,..., n) and τ i (i = 1,..., n) are verified under the following equation:

[0144]

[0145] The following is the specific process:

[0146] For committee members Each member owns and where for

[0147]

[0148] and is a random factor generated by the committee node for generating Pedersen commitment and

[0149]

[0150] Committee members Randomly select a private key share e q in Z i , calculate the ElGamal public key share Then use zero-knowledge proof to prove the correctness of the ElGamal public key ; Committee nodes Public E i , calculate the shared public key

[0151] Committee members Calculate the ElGamal commitment i , β i , ρ i

[0152]

[0153] Use zero-knowledge proof to prove that the ElGamal commitment and the Pedersen commitment respectively commit to the same value (τ i , β i , ρ i ), and then broadcast among committee members.

[0154] Calculate

[0155] ​

[0156] verified with zero-knowledge proof correctness of the computation is then revealed among the committee members

[0157] committee computation

[0158]

[0159] where

[0160] committee member randomly selected compute

[0161]

[0162] This step is to protect the value of ∑τ i ·∑β i -∑ρ i from being leaked. If the committed value ∑τ i ·∑β i -∑ρ i ≠ 0, then randomize the committed value The random result is unpredictable; then verified with zero-knowledge proof is computed by , then is revealed among the committee.

[0163] aggregate commitment compute

[0164]

[0165] where

[0166] Let where

[0167]

[0168] committee member 's ElGamal private key share is e i , compute

[0169]

[0170] Give a zero-knowledge proof to verify that the equation holds; each committee member reveals W i , compute ​​​

[0171] because at this time

[0172]

[0173] If ∑τ i ·∑β i -∑ρ i =0, then

[0174]

[0175] Therefore, we need to verify the equation at this point. Does it hold true? If it does, then it means ∑τ i ·∑β i -∑ρ i =0, that is

[0176] 4-5) After verification, committee members will publicly disclose ρ i We obtain ρ;

[0177] 4-6) Committee members Calculate η i =ρ -1 ·β i and calculate And broadcast it to other committee members;

[0178] at this time,

[0179] (5) Determination of the uniqueness of the credential identifier and the applicant's identity information

[0180] Calculated Subsequently, the committee examined the maintained data structure ID table, which stores anonymous credential identifiers idx(v) in key-value pairs. id,u ) and the corresponding anonymous credential information, check whether the key-value pairs in the IDtable are unique, if the retrieval finds idx(v id,u If the idx(v) already exists, it means the user has previously applied for anonymous credentials; mark the user and terminate the process; if it does not exist, it means this is the user's first application, and the idx(v) will be used. id,u After being stored in the ID table, the subsequent anonymous credential issuance process continues.

[0181] Calculated Subsequently, the committee examines the maintained list of anonymous credential identifiers, IDtable, a data structure that stores anonymous credential identifiers idx(v...). id,u) and the corresponding anonymous credential information, check whether the key-value pairs in the ID table are unique, if the search finds idx(v id,u If the idx(v) already exists, it means the user has previously applied for anonymous credentials; mark the user and terminate the process; if it does not exist, it means this is the user's first application, and the idx(v) will be used. id,u After being stored in the ID table, the subsequent anonymous credential issuance process continues.

[0182] (6) User traceability

[0183] When a malicious user credential identifier is found to be idx(v) id,u If the ID already exists in the ID table, shard each committee. and its Pedersen commitment Publicly verify the correctness of the sharding; aggregate only after successful verification. Get v id,u Since this scheme maps user identity attribute information using a hash function, and user identity attribute information (such as ID card number, passport number, etc.) has certain regularities and limitations, the user identity hash value v aggregated with each node of the committee can be found by traversing the data. id,u The matching value can then be traced back to the user's identity information. To restore identity information.

[0184] This invention introduces a secure and computationally friendly method for generating anonymous credential identifiers, achieving a unique binding between anonymous credentials and user identity information. This ensures system security while reducing computational and storage overhead, making the anonymous credential scheme easier to deploy and apply in real-world production environments. The new scheme does not rely on a single credential issuer; instead, all members of a committee collaborate and reach a consensus to generate, compare, maintain, and issue anonymous credentials, resulting in strong system robustness. Furthermore, by effectively defending against Identity Sybil attacks, the system avoids providing ineffective services and responses to fraudulent users, enhancing user satisfaction and trust.

[0185] This invention features low computational complexity and ease of implementation. Its design is concise and efficient, computationally friendly, and suitable for distributed systems. It avoids system dependence on a single credential issuer, possesses resistance to single points of failure, and ensures system robustness. By using a uniquely bound anonymous credential identifier, it deduplicates potentially fraudulent identity information, enhancing the system's robustness and reliability.

[0186] The present application breaks through the technical bottleneck of the existing anonymous credential scheme in defending identity witch attack. By studying and adopting the security calculation friendly identification calculation method, the unique binding of user privacy identity information and anonymous credential is realized. The method improves the calculation efficiency of anonymous credential identification and reduces the calculation overhead of resisting identity witch attack under the premise of ensuring security. At the same time, the design is simple and efficient, suitable for secure multi-party computation in distributed systems, and has strong anti-single point failure capability.

[0187] It should be noted that, as another aspect, the present application also provides a storage medium, which can be included in an electronic device, or exist independently without being assembled into the electronic device. The storage medium carries one or more programs, which, when executed by an electronic device, cause the electronic device to implement the method described in the above embodiments. For example, the electronic device can implement each step of the method as shown in Figure 2

[0188] In one embodiment, the present application provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the above method embodiments.

[0189] In addition, the above figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present application, and are not for limiting purposes. It is easy to understand that the processes shown in the above figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be executed synchronously or asynchronously, for example, in multiple modules.

[0190] Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. The application is intended to cover any variations, uses, or adaptations of the application following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice in the art to which the application pertains. The specification and examples are to be regarded as exemplary only, and the true scope and spirit of the application are indicated by the appended claims.

[0191] It should be understood that the present application is not limited to the precise construction that has been described above and shown in the accompanying drawings, and that various modifications and changes can be effected therein by those skilled in the art without departing from the scope of the application. The scope of the application is to be defined by the appended claims.​

Claims

1. A method for generating anonymous credential identifiers that are associated with user identity information, characterized in that, The method includes: Users generate public / private key pairs and map their identity identifiers to a specific domain using a hash function, generating a Pedersen commitment; The user will send the Pedersen commitment to the user's identity information provider for verification and signature; The user broadcasts the signed Pedersen commitment to all members of the credential issuance committee and sends fragments of the identity information to each committee member via a secure channel. Committee members verify the correctness of the identity information fragments and jointly calculate the anonymous credential identifier using secure multi-party computation and zero-knowledge proof techniques; the steps of the committee members jointly calculating the anonymous credential identifier include: Committee members locally calculate the combined value of the identity information fragment and the key fragment, and generate the corresponding Pedersen commitment; Committee members jointly calculated the median value of the anonymous credential identifier using secure multi-party computation techniques; Committee members used zero-knowledge proof technology to verify the correctness of the intermediate values ​​and generate the final anonymous credential identifier; The committee checks the uniqueness of the anonymous credential identifier. If the identifier already exists, the process is terminated; if it does not exist, the identifier is stored in a data structure and anonymous credentials continue to be issued. When a malicious user is detected, the fragment information is made public and its correctness is verified. The fragment information is then aggregated to restore the user's identity.

2. The method according to claim 1, characterized in that, The steps for the user to generate a Pedersen commitment include: Users utilize hash functions H Identity Mapping to a specific domain In the middle, we get ; User computing Pedersen commitment ,in and For generators, It is a random number.

3. The method according to claim 1, characterized in that, The committee's steps for verifying the uniqueness of anonymous credential identifiers include: The committee members maintain a data structure that stores anonymous credential identifiers and their corresponding credential information. Committee members checked whether the newly generated anonymous credential identifier already existed in the data structure; If the identifier already exists, the user is flagged and the process is terminated; if it does not exist, the identifier is stored in the data structure and anonymous credentials are issued.

4. The method according to claim 1, characterized in that, The steps for restoring user identity include: When malicious users are discovered, committee members publicly disclose fragments of their identity information and their Pedersen commitments; Committee members verify the correctness of the shards and aggregate the shard information to restore the user's identity; By traversing the hash values, user identity information that matches the aggregate value is found.

5. A system for implementing the method according to any one of claims 1-4, characterized in that, include: The user module is used to generate public / private key pairs, calculate Pedersen commitments, and interact with the user identity information provider. The user identity information provider module is used to verify and sign the Pedersen commitment submitted by the user. The credential issuance committee module is used to receive Pedersen commitments and fragmentation information broadcast by users, jointly calculate anonymous credential identifiers, and check the uniqueness of the identifiers; The data structure module is used to store anonymous credential identifiers and their corresponding credential information; The secure multi-party computation module is used for secure computation and zero-knowledge proof verification among committee members.

6. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the method for generating anonymous credential identifier privacy associated with user identity information as described in any one of claims 1 to 4.

7. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the anonymous credential identifier privacy generation method for associated user identity information as described in any one of claims 1 to 4.

8. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the anonymous credential identifier privacy generation method for associated user identity information according to any one of claims 1 to 4 by executing the executable instructions.

Images