Chameleon signature-based distributed identity authentication method and device for web3

Abstract

The application provides a Web3-oriented distributed identity authentication method and device based on chameleon signature, and belongs to the technical field of information security. In an entity registration process, an entity generates a public-private key pair based on a discrete logarithm assumption; the entity includes a certificate issuer, a user and a verifier; in a certificate issuance process, the verifier issues verifiable credentials to the user by using a chameleon signature algorithm based on the discrete logarithm assumption; in a certificate use process, the user signs the received verifiable credentials by using the chameleon signature algorithm based on the discrete logarithm assumption, obtains a verifiable statement, and sends the statement to the verifier; and in a certificate verification process, the verifier verifies the user by using the chameleon signature algorithm based on the discrete logarithm assumption after receiving the verifiable statement. The application realizes the non-transferability of certificates for the Web3 scenario, reduces communication and storage overheads, and improves authentication efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to a distributed identity authentication method and device based on chameleon signature for Web3. BACKGROUND

[0002] The fifth generation mobile communication technology (5G) provides a stable, efficient network environment for blockchain applications with its high speed, large capacity and low latency, and improves the overall performance of the blockchain network, thus giving birth to Web3. Web3 aims to create an open, decentralized and user data sovereign Internet environment. However, the existing identity authentication system relies on a centralized authority, which is contrary to the decentralized characteristics of Web3. Therefore, decentralized identity (DID) is proposed. Decentralized identity is based on blockchain technology and is a more robust identity authentication scheme that protects user privacy and gives users the autonomy to manage their own identity and credentials. The present application has received widespread attention from academia and industry.

[0003] A typical distributed identity authentication structure is shown in Figure 1 In this system, there are three entities, namely a certificate issuer, a user and a certificate verifier.

[0004] 1) The certificate issuer is generally held by an authority. In the registration stage, the certificate issuer locally generates an identifier (id i ) and a pair of public and private keys (sk i , pk i ). The private key sk i is saved locally, and the mapping of id i and the public key pk i is published on the blockchain. In the certificate issuing stage, the certificate issuer signs the relevant attribute information using the private key, that is, generates a verifiable credential (VC). The VC is used to prove the attributes of the user, such as a VC proving that a user is older than 18 years old. After generation, the VC is issued to the corresponding user.

[0005] 2) The user is similar to the certificate issuer. In the registration stage, an identifier id u and a pair of public and private keys (sk u , pk u ) are generated, and the mapping of id u and pk uThe mapping is published on the blockchain. Users can then apply for verifiable credentials from the certificate issuer to prove their attributes. Upon successful application, the certificate is stored locally. During the certificate usage phase, the user uses sk... u Signing the Certificate Authority (VC) generates a Verifiable Presentation (VP) to obtain network resources. The signature proves ownership of the certificate and ensures that other entities that obtain the VC cannot use it for authentication.

[0006] 3) Validators are typically web applications (Web Services) that obtain the public keys of the certificate issuer and the user from the blockchain through a PK (player kill) process. i with PK u Verify the user's certificate, and after successful authentication, provide the user with the corresponding network resources.

[0007] Because the number of certificate issuers and verifiers in the system is small, and these two entities interact with users frequently, their public keys are known to the vast majority of entities.

[0008] The non-forwardability of Verified Personal Data (VP) certificates is a critical issue in Distributed Identity (DID) scenarios. It requires that even if an unauthorized entity obtains a user's VP, it cannot use the certificate for authentication. An unauthorized entity could use the VP to bypass third-party authentication, thereby impersonating the user. While the non-forwardability issue is prevalent in certificate-based authentication systems, it is particularly pronounced in distributed identity architectures. This is because DID grants users autonomy over their identity certificates, and user behavior is difficult to fully control, significantly increasing the risk of certificate misuse or transfer. This issue has attracted widespread attention from academia and industry.

[0009] Specifically, if an illegitimate entity can obtain a user's verifiable claim (VP) u Due to VP u It contains a legitimate signature, which an unauthorized user can claim to be the owner of the certificate for authentication purposes, thereby impersonating the user. Specifically, such as... Figure 2 As shown, user ID u Verifiable Declaration VP u Send to Validator 1, VP u This not only proves the user's attributes but also proves the user's ownership of the certificate. Validator 1 can then use the VP... u Impersonating user ID u The identity of Validator 1. Specifically, Validator 1 obtains the VP. u Afterwards, VP u Sent to verifier 2, due to VP uValid, Validator 2 passed VP u For authentication, verifier 1 uses ID u The identity of the person successfully passed the authentication of Validator 2, and illegally obtained the network resources provided by Validator 2.

[0010] Existing research on the non-transferability of VP (Verifiable Declaration) is mainly based on a challenge mechanism. The specific process is as follows:

[0011] 1) The user initiates an authentication request;

[0012] 2) The verifier generates a 128-bit random number c locally and sends the random number to the user;

[0013] 3) The user concatenates VC (verifiable credential) and c, and uses the user's private key sk. i Sign it, denoted as Sig I VP u ={VC,Sig I}, will VP u Send to the verifier;

[0014] 4) The verifier verifies c against the signature Sig. I The authentication result will then be returned to the user.

[0015] This scheme guarantees the non-transferability of the VP because the probability of validators generating the same random number as the challenge is negligible. Therefore, even if the VP can be obtained... u However, incorrect challenges can also lead to certification failure.

[0016] Although existing methods can achieve non-transferability of VP, they suffer from high overhead and low efficiency.

[0017] 1) High communication overhead. This is because challenge-based authentication schemes require users to interact with validators multiple times, which leads to unnecessary communication overhead, especially when the network distance between users and validators is far.

[0018] 2) High storage overhead, because the verifier needs to store the mapping relationship between user identifiers and random numbers until the authentication process is over.

[0019] 3) Low authentication efficiency. This is because the interaction between the user and the verifier to exchange random numbers leads to a longer authentication time when the number of authentication requests increases, reducing overall efficiency and affecting the scalability of the system. Summary of the Invention

[0020] To address the technical problems existing in the prior art, this invention provides a distributed identity authentication method and apparatus based on chameleon signatures for Web3, which achieves certificate non-transferability while reducing communication and storage overhead and improving authentication efficiency.

[0021] This invention provides a distributed identity authentication method based on chameleon signatures for Web3, comprising the following steps:

[0022] In the entity registration process, the entity uses a local device to generate a public-private key pair based on the discrete logarithm assumption; the entity includes a certificate issuer, a user, and a verifier.

[0023] In the certificate issuance process, the verifier uses the Chameleon signature algorithm based on the discrete logarithm hypothesis to issue verifiable credentials to the user;

[0024] During the certificate usage process, the user uses the Chameleon signature algorithm based on the discrete logarithm hypothesis to sign the received verifiable credential, obtain a verifiable declaration, and send it to the verifier.

[0025] In the certificate verification process, after receiving the verifiable declaration, the verifier uses the Chameleon signature algorithm based on the discrete logarithm hypothesis to verify the user.

[0026] Preferably, the entity registration process includes the following steps:

[0027] The entity uses a local device to generate public-private key pairs based on the discrete logarithm assumption.

[0028] The mapping relationship between an entity's identifier and its public key is uploaded to the blockchain. The process of an entity managing its private key and identifier does not require the participation of a trusted third party.

[0029] Preferably, the entity registration process specifically includes the following steps:

[0030] The entity uses local equipment in Randomly select an element as the private key sk, and calculate the corresponding public key pk = g. sk modp;

[0031] Entities upload the mapping between ID and PK to the blockchain by publishing transactions;

[0032] Where p and q are both prime numbers greater than a preset value, and satisfy p mod q = 1, g is The elements in the table represent generators. It represents the multiplication group modulo q. It represents the multiplication group modulo p.

[0033] Preferably, the certificate issuance process includes the following steps:

[0034] The certificate issuer uses a private key to sign the relevant authentication information using a signature algorithm based on the discrete logarithm hard problem assumption, thus generating the verifiable credential (VC). u Issued to users, the relevant authentication information includes the certificate issuer's identifier ID. i User ID u The attr attribute verifies that the certificate includes relevant authentication information and is used for identity verification and user authorization.

[0035] Preferably, the certificate issuance process includes the following steps:

[0036] The certificate issuer uses the ElGamal signature algorithm based on the discrete logarithm hardness assumption, employing a hash function to link the relevant authentication information with the certificate issuer's signature Sig. i Together they form a verifiable credential (VC) u , Vc u ={id i ,id u ,attr,Sig i After receiving the certificate, the user stores it on a local device.

[0037] Preferably, the hash function is SHA256.

[0038] Preferably, the certificate usage process includes the following steps:

[0039] When a user wants to use a certificate, they use the Chameleon hash function and input the received verifiable credential (VC). u PK of the verifier's public key v The hash value h is obtained from the random number r, where h = Ch_Hash(VC) u ,pk v Then, the user uses their private key to sign the hash value h using a signature function, obtaining a verifiable declaration VP. u and will verify the VP statement u Send it to the verifier.

[0040] Preferably, the certificate usage process includes the following steps:

[0041] Users retrieve the validator's public key from the blockchain. v ;

[0042] Users will verify credentials VC u Encoding to From the group, we get m1, from Randomly select a random number r;

[0043] Using m1 and the verifier's public key pk vWith the random number r as the input of the chameleon hash function, the hash value h is calculated by the following formula:

[0044]

[0045] The user sends the hash value h and the private key sk u to the verifier as the input, and uses a signature algorithm based on the discrete logarithm assumption to complete the signature operation, with the formula as follows:

[0046] Sig u = sign(sk u ,h)

[0047] The user sends the verifiable statement VP u to the verifier in an encrypted manner, and the verifiable statement VP u includes the verifier's public key, verifiable credential VC u , random number r and signature Sig u , i.e. VP u = {VC u , r, pk v , Sig u};

[0048] Wherein, p and q are both prime numbers greater than a preset value, and satisfy p mod q = 1, g is an element in the group, representing the generator, represents the multiplicative group modulo q, represents the multiplicative group modulo p.

[0049] Preferably, after receiving the verifiable statement, the verifier uses the chameleon signature algorithm based on the discrete logarithm assumption to verify the user, which includes the following four aspects of verification:

[0050] 1) Verify whether the proof of the attribute in the verifiable credential VC u meets the requirements of the verifier;

[0051] 2) The verifier checks the trapdoor information: input the verifiable credential, the verifier's public key and the random number r, and calculates the hash value h' = Ch_Hash(VC u , pk v , r) by using the chameleon hash function, and compares whether the hash value h' is equal to the hash value h;

[0052] 3) Verify the consistency of the public key: the verifier retrieves the public key pk u of the user and the public key pk i of the verifier from the block chain;

[0053] 4) Verify whether the signatures of the certificate issuer and the user are consistent;

[0054] ​If all four aspects pass verification, the verifier considers the user to be authenticated.

[0055] Preferably, the verifier's inspection of the trapdoor information specifically includes:

[0056] The validator checks the validator public key PK provided by the user. v Does it match the verifier's own public key?

[0057] If a match is found, the trapdoor information is considered correct, and the hash value is calculated using the trapdoor information.

[0058] If they do not match, then perform a PK on the validator's public key provided by the user. v Further verification is needed.

[0059] If the user provides the validator public key pk v If the key is another verifier's public key, the verification fails, and the verifiable claim VP is deemed invalid. u It lacks credibility;

[0060] If the user provides a validator (PK) v If the public key is not from another verifier, the correct public key of the verifier will be sent to the user. The user will then use the correct public key to recalculate the hash value and perform a signing operation to generate a new verifiable claim and re-authenticate.

[0061] If the trapdoor information check passes, the verifier will be able to verify the credential VC. u Random number r, validator public key pk v The hash value h is input into the hash verification function Ch_Ver();

[0062] The hash verification function Ch_Ver() calculates the verifiable credential VC. u The hash value h′ is obtained, and the hash value h′ is compared with the hash value h. If the comparison is successful, the verifiable declaration VP is considered to be valid. u If the data is not tampered with during transmission, output 1 to indicate successful verification; otherwise, output 0 to indicate failed verification.

[0063] Preferably, the hash verification function Ch_Ver() performs the following operations:

[0064] Verifiable Declaration VP u Verifiable credentials VC u Encoding to In the group, m2 is obtained, and then the verifier's public key is used to perform a pk based on m2. v The hash value h′ is calculated using the following formula with the random number r:

[0065]

[0066] Compare the hash value h' with the hash value h, if the comparison is successful, output 1, consider that the verification is successful, otherwise output 0, consider that the verification fails.

[0067] The application also provides a Web3-oriented distributed identity authentication device based on chameleon signature, comprising a processor capable of executing the steps of the above-mentioned Web3-oriented distributed identity authentication method based on chameleon signature.

[0068] Compared with the prior art, the application has the following beneficial effects:

[0069] 1. The application realizes efficient identity authentication and user authorization in the Web3 scenario. On the one hand, in the application, the certificate can be used not only to prove the identity of the user, but also to prove the attributes of the user. On the other hand, in the application, the process of managing the identity and the certificate of the user does not require the participation of a trusted third party, and the authentication process conforms to the main purpose of Web3 decentralization.

[0070] 2. The application realizes efficient verifiable claim non-transferability. The application uses the non-transmission characteristic of the chameleon signature to give the verifier the ability to modify the certificate, thereby reducing the risk of the verifier illegally impersonating the user and then illegally stealing network resources.

[0071] 3. Compared with the traditional scheme, the application reduces communication overhead. In the traditional scheme, the user needs to interact with the verifier multiple times, resulting in large communication overhead. In the application, the user only needs to interact with the adjacent full node and the verifier once, reducing the communication overhead.

[0072] 4. Compared with the traditional scheme, the application reduces storage overhead. In the traditional scheme, the verifier needs to store not only the verifiable claim being authenticated, but also the mapping of the user identifier and the challenge value until the authentication is completed. In the application, the verifier only needs to store the verifiable claim of the user being authenticated, greatly reducing the storage overhead of the verifier.

[0073] 5. Compared with the traditional scheme, the application improves the authentication efficiency of the Web3 scenario and reduces the time overhead caused by authentication. This is because in the traditional scheme, the user needs to generate a verifiable claim based on the random number of the verifier, and the generation and transmission of the random number may cause large time overhead, especially when the verifier needs to handle a large number of authentication requests. In the application, the user generates a signature based on the public key of the verifier, which has smaller time overhead than obtaining a random number from the verifier, effectively reducing the authentication time and improving the overall authentication efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0074] In order to make the technical solutions in the embodiments of the present application or the prior art clearer, the accompanying drawings needed in the embodiments or prior art description will be briefly introduced. Obviously, the accompanying drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained according to the structures shown in the drawings without creative labor.

[0075] Figure 1 is a schematic diagram of a typical framework of distributed identity authentication in the prior art.

[0076] Figure 2 is a schematic diagram of an example of destroying the non-transferability of a certificate in the prior art.

[0077] Figure 3 is a schematic diagram of a technical route of a Web3-oriented distributed identity authentication method based on chameleon signature of the present application.

[0078] Figure 4 is a schematic diagram of a hash generation algorithm using a verifiable credential VC to generate a hash value h using a chameleon signature of the present application.

[0079] Figure 5 is a schematic diagram of a hash verification algorithm for verifying gate information in a chameleon signature of the present application.

[0080] Figure 6 is a schematic diagram of a hash collision algorithm for modifying a certificate in a chameleon signature of the present application.

[0081] Figure 7 is a flowchart of a Web3-oriented distributed identity authentication method based on chameleon signature of the present application. DETAILED DESCRIPTION

[0082] The specific embodiments of the present application will be described in detail below.

[0083] As shown in Figures 3-7 , the present application provides a Web3-oriented distributed identity authentication method based on chameleon signature, comprising the following steps:

[0084] The entity registration process, since the Web3 scenario requires the user to have the sovereignty of managing his own certificate and identity, in the registration stage, the entity generates a public-private key pair based on the discrete logarithm assumption; the entity includes a certificate issuer, a user and a verifier;

[0085] The certificate issuing process, the verifier uses a chameleon signature algorithm based on the discrete logarithm assumption to issue a verifiable credential to the user;

[0086] Certificate using process, the user uses the chameleon signature algorithm based on the discrete logarithm assumption to sign the received verifiable credential to obtain a verifiable statement and send it to the verifier;

[0087] Certificate verification process, after the verifier receives the verifiable statement, the verifier uses the chameleon signature algorithm based on the discrete logarithm assumption to verify the user.

[0088] According to one specific embodiment of the present application, the entity registration process comprises the following steps:

[0089] The entity uses a local device to locally generate a public-private key pair based on the discrete logarithm assumption;

[0090] The mapping relationship between the identity of the entity and the public key is uploaded to the blockchain. The process of the entity managing the private key and the identity does not require the participation of a trusted third party.

[0091] According to one specific embodiment of the present application, the entity registration process specifically comprises the following steps:

[0092] The entity uses a local device to locally generate a public-private key pair based on the discrete logarithm assumption; select an element as a private key sk and calculate the corresponding public key pk = g sk modp;

[0093] The entity uploads the mapping of id and pk to the blockchain by publishing a transaction;

[0094] Wherein p and q are prime numbers greater than a preset value, and satisfy p mod q = 1, g is an element in , representing the generator, represents the multiplicative group modulo q, represents the multiplicative group modulo p.

[0095] According to one specific embodiment of the present application, the certificate issuing process comprises the following steps:

[0096] The certificate issuer uses a signature algorithm based on the discrete logarithm problem assumption to sign the related authentication information, and issues a verifiable credential VC u to the user, the related authentication information includes the certificate issuer identity id i , the user identity id u and the attribute attr, the verifiable credential includes the proof of each related authentication information, and the certificate is used for identity authentication and user authorization.

[0097] According to one specific embodiment of the present application, the certificate issuing process specifically comprises the following steps:

[0098] The certificate issuer uses the ElGamal signature algorithm based on the discrete logarithm hardness assumption, employing a hash function to link the relevant authentication information with the certificate issuer's signature Sig. i Together they form a verifiable credential (VC) u VC u ={id i ,id u ,attr,Sig i After receiving the certificate, the user stores it on a local device.

[0099] According to one specific embodiment of the present invention, the hash function is SHA256.

[0100] According to a specific embodiment of the present invention, the certificate usage process includes the following steps:

[0101] When a user wants to use a certificate, they use the Chameleon hash function and input the received verifiable credential (VC). u PK of the verifier's public key v The hash value h is obtained from the random number r, where h = Ch_Hash(VC) u ,pk v Then, the user uses their private key to sign the hash value h using a signature function, obtaining a verifiable declaration VP. u and will verify the VP statement u Send it to the verifier.

[0102] According to a specific embodiment of the present invention, the certificate usage process includes the following steps:

[0103] Users retrieve the validator's public key from the blockchain. v ;

[0104] Users will verify credentials VC u Encoding to From the group, we get m1, from Randomly select a random number r;

[0105] Using m1 and the verifier's public key pk v Using a random number r as input to the chameleon hash function, the hash value h is calculated using the following formula:

[0106]

[0107] The user uses hash value h and private key sk u As input, a signature operation is performed using a signature algorithm based on the discrete logarithm hypothesis, as shown in the following formula:

[0108] Sig u =sign(sku h)

[0109] The user sends the verifiable claim VP u to the verifier in an encrypted manner. u The verifiable claim VP u includes the verifier public key, verifiable credential VC u , random number r and signature Sig u , i.e. VP u = {VC v , r, pk u , Sig u};

[0110] Wherein, p and q are both prime numbers greater than a preset value, and satisfy p mod q = 1, g is an element in Zq , representing a generator, represents a multiplicative group modulo q, and represents a multiplicative group modulo p.

[0111] According to one specific embodiment of the present application, after receiving the verifiable claim, the verifier verifies the user by using a chameleon signature algorithm based on the discrete logarithm assumption, which specifically includes the following four aspects of verification:

[0112] 1) Verify whether the proof of the attribute in the verifiable credential VC u meets the requirements of the verifier;

[0113] 2) The verifier checks the trapdoor information: input the verifiable credential, the verifier public key and the random number r, and calculates the hash value h' = Ch_Hash(VC u , pk v , r) by using the chameleon hash function, and compares whether the hash value h' is equal to the hash value h;

[0114] 3) Verify the public key consistency: the verifier retrieves the public key pk u of the user and the public key pk i of the verifier from the block chain;

[0115] 4) Verify whether the signatures of the certificate issuer and the user are consistent;

[0116] If all four aspects pass the verification, the verifier considers that the user passes the authentication.

[0117] According to one specific embodiment of the present application, the verification of the trapdoor information specifically includes:

[0118] The verifier checks whether the verifier public key pk v provided by the user matches the public key of the verifier itself,

[0119] If a match is found, the trapdoor information is considered correct, and the hash value is calculated using the trapdoor information.

[0120] If they do not match, then perform a PK on the validator's public key provided by the user. v Further verification is needed.

[0121] If the user provides the validator public key pk v If the key is another verifier's public key, the verification fails, and the verifiable claim VP is deemed invalid. u It lacks credibility;

[0122] If the user provides a validator (PK) v If the public key is not from another verifier, the correct public key of the verifier will be sent to the user. The user will then use the correct public key to recalculate the hash value and perform a signing operation to generate a new verifiable claim and re-authenticate.

[0123] If the trapdoor information check passes, the verifier will be able to verify the credential VC. u Random number r, validator public key pk v The hash value h is input into the hash verification function Ch_Ver();

[0124] The hash verification function Ch_Ver() calculates the verifiable credential VC. u The hash value h′ is obtained, and the hash value h′ is compared with the hash value h. If the comparison is successful, the verifiable declaration VP is considered to be valid. u If the data is not tampered with during transmission, output 1 to indicate successful verification; otherwise, output 0 to indicate failed verification.

[0125] According to a specific embodiment of the present invention, the hash verification function Ch_Ver() performs the following operations:

[0126] Verifiable Declaration VP u Verifiable credentials VC u Encoding to In the group, m2 is obtained, and then the verifier's public key is used to perform a pk based on m2. v The hash value h′ is calculated using the following formula with the random number r:

[0127]

[0128] Compare whether the hash value h′ is equal to the hash value h. If the comparison is successful, output 1 to indicate that the verification was successful; otherwise, output 0 to indicate that the verification failed.

[0129] The present invention also provides a distributed identity authentication device based on chameleon signatures, including a processor, the processor being capable of executing the steps of the above-described distributed identity authentication method based on chameleon signatures for Web3.

[0130] Embodiment 1

[0131] As Figures 3-7 shown, the present application provides a Web3-oriented distributed identity authentication method based on chameleon signature, comprising the following steps:

[0132] Entity registration process, entities generate public-private key pairs based on discrete logarithm assumption; the entities include certificate issuers, users and verifiers;

[0133] Certificate issuance process, the verifier issues verifiable credentials to the user using the chameleon signature algorithm based on the discrete logarithm assumption;

[0134] Certificate use process, the user uses the chameleon signature algorithm based on the discrete logarithm assumption to sign the received verifiable credentials to obtain verifiable statements and send them to the verifier;

[0135] Certificate verification process, the verifier receives the verifiable statement and uses the chameleon signature algorithm based on the discrete logarithm assumption to verify the user.

[0136] Embodiment 2

[0137] As Figures 3-7 shown, the present application provides a Web3-oriented distributed identity authentication method based on chameleon signature, comprising the following steps:

[0138] The present application provides a Web3-oriented distributed identity authentication method based on chameleon signature, comprising the following steps:

[0139] Entity registration process, entities generate public-private key pairs based on discrete logarithm assumption; the entities include certificate issuers, users and verifiers;

[0140] Unlike traditional solutions, in this embodiment, the entity of the present application generates a public-private key pair (sk, pk) based on the discrete logarithm assumption using a local device, and uploads the mapping of the identifier and the public key to the blockchain. The process of managing the private key and the identifier by the entity does not require the participation of a trusted third party. The entity here includes certificate issuers, users and verifiers.

[0141] The present application first defines some public parameters, p and q are both large prime numbers, greater than a preset value, and satisfy p mod q = 1, g is an element of , represents the multiplicative group modulo q, represents the multiplicative group modulo p.

[0142] The entity first generates an identifier id and a public-private key pair locally, and then uploads the mapping of id and public key pk to the blockchain.

[0143] Specifically, in the present embodiment, first, the entity uses the local device to randomly select an element as a private key sk in , and calculate the corresponding public key pk = g sk mod p, then the entity uploads the mapping of id and pk to the blockchain by publishing a transaction (Transaction). The present application records the user's identity and public-private key pair as (id u , sk u , pk u ), the verifier's identity public-private key pair as (id v , sk v , pk v ), and the certificate issuer's public-private key pair as (id i , sk i , pk i ).

[0144] In the certificate issuance process, the verifier issues a verifiable credential to the user using a chameleon signature algorithm based on the discrete logarithm assumption, which is used for identity authentication and user authorization.

[0145] Similar to the traditional scheme, the certificate issuer signs the relevant authentication information using the private key, including the certificate issuer's identity id i , the certificate holder's (i.e., the user's) identity id u , and the attribute attr.

[0146] Unlike the traditional scheme, in the present embodiment, only a signature algorithm based on the discrete logarithm assumption, such as the ElGamal signature algorithm, can be used in the certificate issuance process of the present application. In the certificate issuance stage, the certificate issuer can use any hash function, such as SHA256. The relevant authentication information and the certificate issuer's signature Sig i together constitute a verifiable credential VC u , VC u = {id i , id u , attr, Sig i}, and the user stores the certificate using the local device after receiving it.

[0147] In the certificate usage process, the user signs the received verifiable credential using a chameleon signature algorithm based on the discrete logarithm assumption to obtain a verifiable statement and send it to the verifier. The present application designs a certificate usage mechanism based on chameleon signature to achieve the non-transferability of the certificate, as shown in the certificate usage mechanism part of Algorithm 1.

[0148] In the present embodiment, the certificate signing operation mainly includes the following four steps.

[0149] 1) The user retrieves the validator's public key (pk) from the blockchain. v Note that this does not incur significant communication overhead because the blockchain is a distributed ledger maintained by many full nodes. Users can choose a neighboring full node to retrieve PK (player kill) data. v .

[0150] 2) The user will use the verifiable credential VC u Encoding to From the group, we get m1, from A random number r is randomly selected. Then, the verifier's public key pk is used as the input. v , and take a random number r as input, calculate the hash value, such as Figure 4 As shown.

[0151]

[0152] This embodiment uses a chameleon hash function. The trapdoor information of this chameleon hash is held by the verifier, meaning the certificate verifier can broadly find hash collisions. This ensures that after receiving a verifiable declaration (VP), the verifier cannot use the VP to authenticate with other verifiers because the verifier, holding the trapdoor information, can modify the certificate content to make the signature valid. For example, if `attr` originally represents an age of 12, the verifier can find a hash collision, change the `attr` part to an age of 19, and the hash value remains unchanged, so the signature is still valid. Therefore, even if the verifier sends the VP to other entities, the certificate is not trustworthy.

[0153] 3) The user uses the hash value h and the user's private key sk u As input, complete the signature operation. Note that a signature algorithm based on the discrete logarithm hypothesis, such as ElGamal, is required here.

[0154] Sig u =sign(sk u ,h)

[0155] 4) Users transmit verifiable VP statements via encrypted communication. u Send to the validator, VP u Including verifiable credentials (VC) u The random number r, the validator's public key, and the signature Sig u , i.e., VP u ={VC u ,r,pk v Sig u}

[0156] The certificate verification process, after the verifier receives the verifiable statement, uses the chameleon signature algorithm based on the discrete logarithm assumption to verify the user.

[0157] In order to realize the high efficiency of VP non-transferability, the certificate verification mechanism based on chameleon signature is designed in the application. When the verifier receives the verifiable statement VP u , the verification operation is performed on VP u , and the verification operation mainly includes the following four steps, as shown in the algorithm 1 certificate verification mechanism part.

[0158] 1) Check the attribute attr; 2) Check the trapdoor information and calculate the hash value; 3) Retrieve the public key of the certificate issuer and the user; 4) Verify the signature of the certificate issuer and the user.

[0159] In this embodiment, the following steps are specifically included:

[0160] 1) Verify whether the attribute attr proved in VP u complies with the rules of the verifier.

[0161] For example, if the verifier requires to provide a proof of age greater than 18 years old, the verifier needs to verify whether the age field in attr is greater than 18.

[0162] 2) Check the trapdoor information and calculate the hash value.

[0163] The verifier first checks whether the public key pk v provided by the user matches the public key of the verifier itself, if it matches, it is considered that the trapdoor information is correct, and then the hash value is calculated using the trapdoor information. If it does not match, the public key pk v provided by the user is further checked, if the public key pk v provided by the user is the public key of other verifiers, the verification fails, and it is considered that the verifiable statement VP u does not have credibility; if the public key pk v provided by the user is not the public key of other verifiers, the correct public key of the verifier is sent to the user, and the user re-performs the calculation of the hash value and the signature operation to generate a new verifiable statement and re-performs the authentication. Because in this case, the user may obtain the wrong pk v due to transmission errors or block chain update not in time, etc., resulting in authentication errors.

[0164] If the trapdoor information check passes, the verifier needs to input the VC u , the random number r, the verifier's public key pk v and the hash value h into the Ch_Ver() function, Ch_Ver() is a hash verification function, which will first calculate the VC uThe hash value h′ is obtained, and h′ is compared with h. If the comparison is successful, then VP is considered to be true. u If the data has not been tampered with during transmission, output 1; otherwise, output 0. Figure 5 As shown. Specifically, the verifier first verifies the VP statement. u Verifiable credentials VC u Encoding to In the group, we obtain m2, and then calculate the hash value h′. The inputs for calculating the hash value h′ are m2 and the verifier's public key pk. v With random number r, i.e.

[0165]

[0166] Next, compare whether h is equal to h′. If they are not equal, the verification is considered to have failed.

[0167] 3) The verifier retrieves the public keys of the certificate issuer and the user from the blockchain.

[0168] The verifier will identify the user and the certificate issuer by ID. i ,id u Get the corresponding PK from the nearest full node. I with PK u .

[0169] 4) Verify that the signatures of the user and the certificate issuer are correct and valid.

[0170] The verifier then performs a PK based on the retrieved public key. u with PK i Verify the user's signature sig respectively u With the validator's signature sig i Its formula is expressed as follows:

[0171] result u =vrfy1(pk u ,sig u ,h)

[0172] result i =vrfy2(pk i ,sig i ,id i ,id u ,attr)

[0173] result = result u ∧result i

[0174] Here, vrfy1() and vrfy2() represent the corresponding signature verification functions. uWith result i These are the results of verifying the signatures of the user and the certificate issuer, respectively. They are boolean values, taking the value True or False. True indicates successful verification, while False indicates verification failure. The ∧ symbol represents a AND logical operation; if the result... u With result i If both results equal True, then the signature authentication is considered successful. u With result i If any one of the values ​​is False or both are False, the signature verification is considered to have failed, and the verifier refuses to provide the user with the corresponding network resources.

[0175] If all four steps above are successfully verified, the verifier considers the user to have provided the correct certificate, meaning the user has passed authentication and the verifier can provide the user with the corresponding network resources.

[0176] In this invention, even if a verifier knows that they possess a valid verifiable claim, they cannot use that verifiable claim VP to other verifiers. u This is to impersonate a user and obtain illegal network resources. This is because the validator possesses trapdoor information and can broadly find hash collisions, meaning that while ensuring the hash value and signature value are valid, the validator can also modify the data stored on the VP. u For example, if `attr` originally represents an age of 12, the verifier can find a hash collision and change the `attr` part to an age of 19, while the hash value remains unchanged and the signature is still valid. Figure 6 As shown, if the validator wants to change m1 to m3, the validator can use their private key sk. v Random numbers r, m1, and m3 are input into the function Ch_Cld(), which is a hash collision function. This function will output a new random number r′, such that Ch_Hash(m1, pk...)... v ;r)=Ch_Hash(m3,pk v ;r′). As can be seen from the chameleon hash function,

[0177]

[0178]

[0179] If the two are equal, then we can obtain Therefore, a validator who possesses information about a trapdoor can arbitrarily change the VP. u This reduces the risk of identity theft by accessing the content within the app.

[0180] Below is the pseudocode for the authentication mechanism in this embodiment:

[0181]

[0182]

[0183] The present application aims at the problem that the risk of certificate abuse or transfer under the DID architecture is significantly increased compared with the traditional authentication scheme, and proposes a Web3-oriented distributed identity authentication method based on chameleon signature, which uses chameleon signature to enable the verifier in DID to find hash collision in a broad sense, thereby realizing efficient certificate non-transferability with small communication and storage overhead.

[0184] The present application designs a certificate use process based on chameleon signature, and in the use process of the certificate, the user of the DID uses the chameleon signature, which takes the verifiable credential, the private key of the user and the public key of the DID verifier as input, proves the ownership of the verifiable statement and gives the verifier the right to modify the certificate. In addition, the present application modifies the certificate verification mechanism, and in the certificate verification process, the verifier can correctly and efficiently verify the legality of the verifiable statement, and the verifier of the DID has the trapdoor information and the ability to modify the verifiable statement, which effectively avoids the illegal use of the identity of the user and the illegal acquisition of network resources by the verifier.

[0185] The above only describes the preferred embodiments of the present application and is not used to limit the present application. For those skilled in the art, the present application can have various changes and variations. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application is included in the protection scope of the present application.

Claims

1. A Web3-oriented distributed identity authentication method based on chameleon signature, characterized in that, The method comprises the following steps: An entity registration process, in which an entity generates a public-private key pair based on a discrete logarithm assumption; the entity includes a certificate issuer, a user and a verifier; the entity registration process comprises the following steps: The entity uses a local device to locally generate a public-private key pair based on a discrete logarithm assumption; A mapping relationship between the identity of the entity and the public key is uploaded to a block chain; A certificate issuance process, in which the certificate issuer issues a verifiable credential to the user using a signature algorithm based on a discrete logarithm problem assumption; A certificate use process, in which the user uses a chameleon signature algorithm based on a discrete logarithm assumption to sign the received verifiable credential to obtain a verifiable statement and send it to the verifier; the certificate use process comprises the following steps: When the user wants to use the certificate, the user uses the chameleon hash function, inputs the received verifiable credential , the verifier's public key and a random number to obtain the corresponding hash value , Then the user uses his own private key to sign the hash value using a signature function based on the discrete logarithm assumption to obtain a verifiable statement and sends the verifiable statement to the verifier; A certificate verification process, in which the verifier verifies the user after receiving the verifiable statement using a chameleon signature algorithm based on a discrete logarithm assumption, and specifically comprises the following four aspects of verification: 1) verifying the verifiable credential whether the attestation of the attributes of the user meets the requirements of the verifier; 2) verifier checks trapdoor information, if trapdoor information check passes, input verifiable credential, verifier public key and random number r, calculate hash value using chameleon hash function , compare hash value whether equal to hash value ; 3) The verifier retrieves from the blockchain the user's public key with the certificate issuer With ; 4) verifying whether the signatures of the certificate issuer and the user are correct and valid; If the four aspects are all verified, the verifier considers that the user passes the authentication; The verifier checks the trapdoor information specifically comprises: The verifier checks whether the verifier public key provided by the user matches the verifier's own public key whether the verifier's own public key matches the verifier's own public key, If matched, it is considered that the trapdoor information is correct, and then a hash value is calculated using the trapdoor information; If not, the user is provided with a verifier public key for further vetting, If the user-provided verifier public key is the public key of another verifier, then the verification fails and the verifiable claim is deemed not to be trustworthy; If the user-provided verifier is not the public key of another verifier, the correct public key of the verifier is sent to the user, who re-computes the hash value and performs the signing operation using the correct public key, generating a new verifiable claim and re-authenticating. 2.The Web3-oriented distributed identity authentication method based on chameleon signature according to claim 1, wherein, The entity registration process specifically comprises the following steps: The entity utilizes the local device to randomly select an element as a private key in corresponding public key ;​ The entities upload the mapping of the transaction to the blockchain by means of publishing the transaction with the mapping wherein, and are both prime numbers greater than a preset value, and satisfy , is an element in represents a multiplicative group of modulo represents a multiplicative group of modulo represents a multiplicative group of modulo represents a multiplicative group of modulo 3. The web3 -facing chameleon signature based distributed identity authentication method of claim 2, wherein, The certificate issuance process comprises the following steps: The certificate issuer uses a private key to sign the relevant authentication information using a signature algorithm based on the discrete logarithm hard problem assumption, thus creating a verifiable credential. Issued to users, the relevant authentication information includes the certificate issuer's identifier. User ID With attributes This verifies that the certificate includes all relevant certification information.

4. The web3 -facing chameleon signature based distributed identity authentication method of claim 3, wherein, The certificate issuance process specifically comprises the following steps: The certificate issuer uses the ElGamal signature algorithm based on the discrete logarithm difficulty assumption, adopts a hash function to combine the relevant authentication information and the signature of the certificate issuer together to form a verifiable credential , After the user receives the certificate, the certificate is stored using a local device. 5.The Web3-oriented distributed identity authentication method based on chameleon signature according to claim 1, wherein, The certificate use process comprises the following steps: The user retrieves the public key of the validator from the blockchain ; A user will present a verifiable credential encoded to a group, resulting in from a random number is randomly selected ; With the verifier's public key and the random number As an input to the chameleon hash function, the hash value is calculated using the following formula : ； The user provides a hash value and a private key As input, a signature algorithm based on the discrete logarithm assumption is used to complete the signature operation, the formula is as follows: ； A user sends a verifiable claim to a verifier in an encrypted communication The verifiable claim includes a verifier public key, verifiable credentials , a random number r and a signature The verifier decrypts the encrypted communication ; in, and All are prime numbers greater than the preset value, and satisfy the following conditions: , yes The elements in the table represent generators. It represents the model multiplication group It represents the model The multiplication group.

6. The web3 -facing chameleon signature based distributed identity authentication method of claim 1, wherein, If the trapdoor information check passes, the verifier will be able to verify the credential , the random number , the verifier public key , and the hash value are input into the hash verification function . Hash verification function Computing a verifiable credential of a hash value and comparing the hash values whether the hash values are equal if the comparison is successful, the verifiable claim has not been tampered with during transmission, output 1, consider verification successful, otherwise output 0, consider verification failed; Hash verification function The operations are specifically performed as follows: Verifiable claims Verifiable credentials Encoding to On the group, I got And then according to The verifier's public key With random numbers Calculate the hash value using the following formula : Comparing hash values Equality with hash value If the comparison is successful, then output 1 is considered and the verification is considered successful, otherwise output 0 is considered and the verification is considered failed.

7. A Web3-oriented distributed identity authentication device based on chameleon signature, characterized in that, A processor capable of executing the steps of the Web3-oriented distributed identity authentication method based on the chameleon signature of claim 1-6.

Images