A distributed anonymous credential authentication method supporting multi-ca

Abstract

The application discloses a kind of distributed anonymous credential authentication methods, devices, media and equipment supporting multi-CA, by sending the identity attribute of user to each certificate issuing agency, receiving the identity attribute of user not belonging to revocation list is signed by each distributed certificate issuing agency, to generate corresponding each anonymous credential;Send the identity identifier of user to supervisory agency, determine identity hosting ciphertext according to the encryption of identity identifier using public key of supervisory agency;Send each anonymous credential to verifier, complete the batch legality verification of each anonymous credential in zero-knowledge proof environment with verifier, obtain each anonymous credential message verification result;Send identity hosting ciphertext to supervisory agency, determine the decryption plaintext of identity hosting ciphertext of supervisory agency;Finally determine whether verification passes, the application is designed without trusted initialization distributed issuing mechanism, supports multi-CA collaborative work, avoids single point failure, improves system decentralization degree and robustness.

Description

TECHNICAL FIELD

[0001] The application relates to the field of multi-CA authentication, and particularly relates to a multi-CA supporting distributed anonymous credential authentication method, device, medium and equipment. BACKGROUND

[0002] Web3.0 is the next iteration of the Internet, and its core features include decentralization, user sovereignty and data privacy protection. It has a more extensive application in more industries. Under this background, the identity attributes of users often depend on the credentials of multiple authorities. In many countries, e-government platforms require citizens to use digital certificates for identity verification. For example, the e-Residency project in Estonia, the digital identity of citizens is managed by multiple certificate authorities, and different CA certificates correspond to different government services (such as tax, social security, driver's license, etc.). Since a centralized identity authority is not required, users can flow between different platforms through digital credentials. This kind of distributed identity authentication system is attracting more and more attention.

[0003] The multi-CA authentication mechanism brings great convenience to users, but the increase in participants will exacerbate the risk of user privacy leakage. Especially in the e-government and medical health scenarios, the identity information of users often involves a large amount of sensitive information, and privacy leakage will cause serious consequences.

[0004] The prior art has the following core shortcomings in the field of distributed anonymous credentials:

[0005] (1) Low verification efficiency: Traditional schemes use one-by-one verification in the multi-credential scenario, and the time complexity increases exponentially with the number of credentials. For example, early distributed schemes based on group signature need to verify each credential one by one, while batch verification schemes reduce the number of verifications, but the computational resource overhead is large, making it difficult to deploy in large-scale environments. In addition, some schemes rely on bilinear pairing operations, which significantly increases the verification time.

[0006] (2) Incomplete privacy protection: User attribute privacy and issuer identity are easily leaked. In existing schemes, users need to disclose the issuer's public key when submitting credentials, and the verifier can infer the user's associated information. At the same time, centralized CA schemes have single point of failure, and if the credential issuer is attacked, the user's identity attribute may be leaked.

[0007] (3) Inefficient revocation mechanism: Existing revocation schemes such as Dynamic Universal Accumulator (DUA) need to update all remaining member proofs when deleting elements, which has a large computational overhead in large-scale scenarios. For example, some schemes only support Boolean attributes, have limited support for complex numerical attributes, and have low efficiency in generating non-member proofs.

[0008] (4) Lack of supervision: Most schemes do not achieve a balance between privacy protection and compliance supervision. For example, the Coconut scheme lacks a user identity supervision mechanism and cannot trace malicious users; some schemes rely on trusted entity initialization, reducing the system's practicability in complex scenarios and not providing penetration supervision capabilities.

[0009] (5) Limitations of distributed architecture: Some schemes rely on a single trusted center or inefficient decentralized mechanisms. For example, decentralized schemes rely on distributed ledger security, and the proof time and number of credentials are linearly related; the Zebra scheme does not support distributed credential issuance and relies on a single trusted center. SUMMARY

[0010] The main purpose of the present application is to provide a distributed anonymous credential authentication method supporting multi-CA, device, medium and equipment, aiming at solving the technical problems of distributed anonymous credential authentication method supporting multi-CA.

[0011] To achieve the above purpose, the present application provides a distributed anonymous credential authentication method supporting multi-CA, comprising:

[0012] Optionally, the identity attribute of the user is sent to each certificate authority, and the corresponding anonymous credential is received after the identity attribute of the user not belonging to the revocation list is signed by each distributed certificate authority; wherein the identity attribute of the user is checked by using a two-layer hybrid accumulator to obtain a revocation list;

[0013] The identity identifier of the user is sent to the supervisory agency, and the identity hosting ciphertext is determined according to the encryption of the identity identifier by the supervisory agency using a public key;

[0014] Each anonymous credential is sent to the verifier, and the batch legality verification of each anonymous credential is completed in a zero-knowledge proof environment with the verifier to obtain a message verification result of each anonymous credential;

[0015] The identity hosting ciphertext is sent to the supervisory agency, and the decryption plaintext of the identity hosting ciphertext by the supervisory agency is determined;

[0016] According to the identity check result obtained by the verifier and the supervisory agency, and the message verification result of each anonymous credential, it is determined whether the verification is passed.

[0017] To achieve the above purpose, the present application also provides a distributed anonymous credential authentication method supporting multi-CA, applied to each distributed issuing agency, comprising: obtaining a Π CLsystem parameters obtained by the SymSetup algorithm; determining a credential validity period control parameter and the first to third hash functions according to the system parameters; processing the credential validity period control parameter based on the first to second hash functions to obtain a first parameter and a second parameter, and processing the credential validity period control parameter, the identity attributes, and the temporary identity identifier based on the third hash function to obtain third parameters; and bringing the first parameter, the second parameter, and the third parameters into a signature formula to obtain the anonymous credentials of the user.

[0018] Optionally, the obtaining the identity identifier based on the third-party institution running the Π CL After obtaining the system parameters obtained by the SymSetup algorithm, and the identity attributes of the user and the temporary identity identifier of the user in each distributed issuing institution, the method further includes: constructing a two-layer hybrid accumulator based on a combination of a polynomial accumulator and an AND operation accumulator to prove that the user is not in the revocation list of the issuing institution.

[0019] Optionally, the revocation list of the issuing institution includes a current issuing institution revocation list and an all-institution revocation list; and the two-layer hybrid accumulator constructed based on the combination of the polynomial accumulator and the AND operation accumulator to prove that the user is not in the revocation list of the issuing institution includes: proving that the identity attributes of the user are not in the current issuing institution revocation list based on the polynomial accumulator; and proving that the identity attributes of the user are not in the all-institution revocation list based on the AND operation accumulator.

[0020] To achieve the above object, the application further provides a distributed anonymous credential authentication method supporting multi-CA, applied to a supervision institution, including: obtaining an identity identifier determined based on a set of temporary identity identifiers; running the Π CL KeyGen algorithm to obtain a public key and a private key pair; and the supervision institution encrypts each element in the set of temporary identity identifiers based on the public key in the public key and private key pair to obtain identity management ciphertext of the identity identifier.

[0021] To achieve the above object, the application further provides a distributed anonymous credential authentication method supporting multi-CA, applied to a verifier, comprising: obtaining each anonymous credential and system parameters; calculating the first parameter, the second parameter and each third parameter according to the system parameters; constructing a bilinear expression and substituting the identity escrow ciphertext into the bilinear expression; after the bilinear expression substituted with the identity escrow ciphertext is decomposed, a first decomposition term with the first parameter and a second decomposition term with the second parameter and the third parameter are obtained; constructing the decomposition term with the first single factor and the second single factor decomposition term according to the first decomposition term and the second decomposition term; obtaining the first single factor decomposition term and the multiplied second single factor decomposition term, the multiplied first single factor decomposition term and the multiplied second single factor decomposition term, and the first factor and the second factor based on the multiplied bilinear expression; verifying the third parameter, the first factor and the second factor under the zero-knowledge proof environment to obtain the third parameter, the first factor and the second factor of verification success; and checking whether the multiplied bilinear expression is established under the plaintext, if yes, outputting a flag of establishment, otherwise, outputting a flag of non-establishment.

[0022] To achieve the above object, the application further provides a distributed anonymous credential authentication system supporting multi-CA, comprising: a user device, each distributed issuing authority, a supervisory authority and a verifier; wherein the user device is used for executing the distributed anonymous credential authentication method; each distributed issuing authority is used for executing the distributed anonymous credential authentication method supporting multi-CA; the supervisory authority is used for executing the distributed anonymous credential authentication method supporting multi-CA; and the verifier is used for executing the distributed anonymous credential authentication method supporting multi-CA.

[0023] To achieve the above object, the application further provides a computer readable storage medium, comprising instructions, when the instructions are executed on a computer, causing the computer to execute the distributed anonymous credential authentication method supporting multi-CA provided by the foregoing embodiments.

[0024] To achieve the above object, the application further provides an electronic device, comprising: at least one processor, a memory and an input-output unit; wherein the memory is used for storing a computer program, and the processor is used for calling the computer program stored in the memory to execute the distributed anonymous credential authentication method supporting multi-CA provided by the foregoing embodiments.

[0025] This application proposes a distributed anonymous credential authentication method, apparatus, medium, and device supporting multiple CAs. The method involves sending user identity attributes to each credential authority and receiving signatures from each distributed certificate authority on the identity attributes of users not on the revocation list, generating corresponding anonymous credentials. The revocation list is obtained by checking user identity attributes using a two-layer hybrid accumulator. The user's identity identifier is sent to the regulatory agency, which encrypts the identifier using its public key to determine the escrow ciphertext. Each anonymous credential is sent to the verifier, and the two agencies work together to complete the authentication of each anonymous credential in a zero-knowledge proof environment. Batch legality verification yields message verification results for each anonymous credential. By designing an efficient batch verification algorithm, combining zero-knowledge proofs and exponential term random number techniques, the exponential time complexity of traditional credential-by-credential verification is optimized to linear or constant time complexity, reducing the number of bilinear pairings and lowering computational overhead. Identity escrow ciphertext is sent to the regulatory agency to determine the decryption plaintext. Based on the identity check results obtained from the interaction between the verifier and the regulatory agency, and the message verification results for each anonymous credential, the verification pass or fail is determined. This application designs a distributed issuance mechanism that does not require trusted initialization, supports multi-CA collaborative work, avoids single points of failure, and improves the system's decentralization and robustness. Attached Figure Description

[0026] Figure 1 A flowchart illustrating an embodiment of the distributed anonymous credential authentication method supporting multiple CAs provided in this application;

[0027] Figure 2 This is a schematic diagram of an embodiment of the distributed anonymous credential authentication method supporting multiple CAs in this application.

[0028] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0029] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0030] The main solution in this application embodiment is:

[0031] Although the multi-CA authentication mechanism in the prior art brings great convenience to users, the increase in the number of participants exacerbates the risk of user privacy leakage. In particular, in e-government and medical health scenarios, user identity information often involves a large amount of sensitive information, and privacy leakage can cause serious consequences. Prior art II points out that the European health sector has experienced a large number of cyber security incidents, 42% of which were reported by hospitals, and 46% of cyber security incidents were aimed at stealing or leaking data of health organizations, including electronic health records (accounting for 30% of leaked data). Prior art I points out that the frequency of data leakage in the medical care industry has been rising, and lists several data leakage cases of medical institutions in multiple countries and regions. With the continuous occurrence of identity data leakage incidents, users hope to remain anonymous when using services to protect personal privacy. European privacy standards and the National Strategy for Trusted Identities in Cyberspace (NSTIC) of the US government both emphasize the importance of user privacy in authentication systems. And the introduction of global data privacy protection regulations, such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

[0032] The prior art in the field of distributed anonymous credentials has the following core shortcomings:

[0033] (1) Low verification efficiency: Traditional schemes use one-by-one verification in the multi-certificate scenario, and the time complexity increases exponentially with the number of certificates. For example, early distributed schemes based on group signatures require individual verification of certificates, while batch verification schemes reduce the number of verifications but have high computational resource overhead, making it difficult to deploy in large-scale environments. In addition, some schemes rely on bilinear pairing operations, resulting in a significant increase in verification time.

[0034] (2) Incomplete privacy protection: User attribute privacy and issuer identity are easily leaked. In existing schemes, users need to disclose the issuer's public key when submitting credentials, and the verifier can infer the user's associated information. At the same time, centralized CA schemes have single points of failure, and if the certificate issuer is attacked, it may lead to user identity attribute leakage (such as the centralized anonymous credential scheme of Camenisch et al. [8, 9]).

[0035] (3) Inefficient revocation mechanism: Existing revocation schemes such as Dynamic Universal Accumulator (DUA) require updating all remaining member proofs when deleting elements, which has high computational overhead in large-scale scenarios. DUA only supports Boolean attributes, has limited support for complex numerical attributes, and has low efficiency in generating non-member proofs.

[0036] (4) Lack of supervision: Most schemes do not achieve a balance between privacy protection and regulatory compliance. Relying on trusted entity initialization reduces the system's practicality in complex scenarios and does not provide penetration supervision capabilities.

[0037] (5) Limitations of distributed architecture: Some schemes rely on a single trusted center or inefficient decentralized mechanism. Decentralized schemes rely on distributed ledger security, and the proof time and number of credentials are linearly related; Zebra scheme does not support distributed credential issuance and relies on a single trusted center.

[0038] To address the above shortcomings, the present application aims to optimize verification efficiency, privacy protection, revocation mechanism and supervision capability through systematic optimization, solve the core bottleneck of existing technology in distributed multi-CA scenarios, and promote the application of anonymous credentials in large-scale privacy-sensitive fields. The summary is as follows:

[0039] (1) Improve batch verification efficiency: Design an efficient batch verification algorithm, combine zero-knowledge proof and exponential term random number technology, optimize the traditional per-credential verification exponential time complexity to linear or constant level, reduce the number of bilinear pairings, and reduce the computational overhead. For example, by adding random number κ to reconstruct the verification equation, multiple credential verification is converted into single bilinear pairing check, and attribute details are hidden through zero-knowledge proof.

[0040] (2) Strengthen privacy protection: Design a double-layer privacy protection mechanism to hide user attributes (such as proving that the attribute satisfies the relationship through zero-knowledge proof without exposing the specific value) and hide the identity of the issuing authority (such as through indistinguishable accumulators or structure-preserving signature). For example, in batch verification, users do not need to disclose the issuer's public key, and the verifier cannot associate the credential source.

[0041] (3) Optimize revocation checking mechanism: Introduce a double-layer hybrid accumulator structure, the lower layer is based on a polynomial accumulator to implement single-issuer revocation proof, and the upper layer aggregates multiple-issuer revocation status through "and" operation to support efficient non-member proof generation and batch verification, avoiding global update overhead. For example, users prove that they have not been revoked by a single authority through a polynomial remainder proof, and then prove that they have not been revoked by any authority through the upper-layer accumulator.

[0042] (4) Implement penetration supervision: Encrypt user identity information with the supervisor's public key, only the supervisor can decrypt it, ensuring that malicious behavior can be traced, while preventing the verifier or issuing authority from obtaining user identity. For example, user identity ciphertext CU can only be decrypted by the supervisor through private key sk S , balancing privacy protection and compliance requirements.

[0043] (5) Enhance the utility of distributed architecture: design a distributed issuance mechanism without trusted initialization, support multi-CA collaborative work, and avoid single point of failure. For example, through distributed key generation and threshold signature technology, multiple issuing agencies are allowed to collaborate to issue certificates, improving the degree of decentralization and robustness of the system.

[0044] Next, the application introduces related knowledge:

[0045] 1. Bilinear pairing

[0046] Bilinear pairing is a mapping from a pair of group elements to a group element. Specifically, there are and is a cyclic group of prime order q ∈ Θ(2 l ), and h is the generator of There is a bilinear mapping satisfying the following properties:

[0047] (1) Unique representation, each element in G has a unique binary representation.

[0048] (2) Bilinearity, for all and e(h a ,g b ) = e(h,g) ab holds.

[0049] (3) Non-degeneracy, if h generates g generates then e(h,g)≠1.

[0050] (4) Computability, for all there is at least one efficient algorithm (i.e. in polynomial time) that can compute e(X,Y).

[0051] Secure signature scheme Π CL based on CL

[0052] A new secure signature scheme Π CL is described here, which is proposed by Camenisch et al. and is implemented based on CL signature under the LRSW assumption. Specifically as follows:

[0053] (1) System establishment

[0054] After inputting the security parameter , a prime number q ∈ Θ(2 l ) is randomly selected to generate the generator g of the cyclic group of order q, and the bilinear mapping is randomly selected To control the validity period of the certificate, the message space is M = {0, 1} * , three hash functions are generated. Output system parameters

[0055] (2) Key generation Π CL .KeyGen(θ)→(sk,pk)

[0056] Using system parameters θ, randomly select Let X = g x . Output private key sk = x, public key pk = X.

[0057] (3) Signature Π CL .Sign(m, θ, sk)→σ

[0058] For the message to be signed m ∈ M, calculate a = H1(φ), b = H2(φ), w = H3(m‖φ), get the signature σ = a x b xw .

[0059] (4) Verification Π CL .Verify(m, θ, σ)→1 / 0

[0060] The verifier v verifies the signature σ on the message m, first calculates a = H1(φ), b = H2(φ), w = H3(m‖φ), and then checks the equation e(σ, g) = e(a, X)·e(b, X) w . If the equation is true, the verification is successful and outputs 1; otherwise, it fails and outputs 0.

[0061] 2. Zero-knowledge proof

[0062] Zero-knowledge proof is proposed by Goldwasser, Micali and Rackoff, which is a two-party cryptographic protocol running between the prover and the verifier. The verifier confirms the validity of a statement x through zero-knowledge proof, but does not obtain any specific information about the content of the statement in the process.

[0063] Non-interactive zero-knowledge proof (NIZK) allows the prover to prove that a statement x belongs to the language L defined by the relation R in zero-knowledge, i.e. So that R(x, w) = 1}. Where:

[0064] x is a statement, i.e. a candidate language member;

[0065] w is a witness, which is the secret information that the prover possesses to prove that x ∈ L;

[0066] R(x, w) is a NP relation, i.e. a decision relation function, if R(x, w) = 1 means w proves x e L.

[0067] NIZK allows a prover to prove x e L to a verifier without revealing w. For NIZK consists of three algorithms:

[0068] (1) KeyGen(R e R λ ) → crs = (ek, vk): outputs a common reference string, containing evaluation and verification keys.

[0069] (2) Prove(ek, x, w) → π: returns a proof that R(x, w) is true.

[0070] (3) VerProo(vk, x, π) → b e {0, 1}: verifies the proof, outputs 0 for rejection, 1 for acceptance.

[0071] NIZK satisfies the following key properties:

[0072] a. Completeness: for any pair of x and w satisfying relation R(x, w), an effective proof can always be generated, making an honest verifier accept.

[0073] b. Soundness: any computationally limited prover cannot construct a false proof of a cheating verifier, i.e. cannot fake a proof of x e L, without an effective witness w.

[0074] c. Zero-Knowledge: the proof does not reveal any information about the witness w, the verifier only knows x e L, and cannot derive other information. Formally, there exists a simulator S that can generate a proof S(x) ≈ NIZK.Prove(ek, x, w) without relying on w.

[0075] 3. Accumulator

[0076] An accumulator is a cryptographic data structure that allows a set of elements to be compressed into a fixed-size value, the accumulator value. Users can prove whether an element is in the accumulator by providing a proof without revealing the entire set. There are three types of accumulators:

[0077] (1) Static Accumulator: Once created, elements cannot be added or deleted (e.g. RSA-based accumulators).

[0078] (2) Dynamic Accumulator; supports dynamic addition and deletion of elements (such as the Camenisch-Lysyanskaya scheme).

[0079] (3) Universal Accumulator: It supports not only membership proofs but also non-member proofs, meaning it can prove that an element is not in the accumulator.

[0080] It should be noted that this application employs a Dynamic Universal Accumulator (DUA) based on exponential polynomials. This DUA combines the advantages of dynamic and universal accumulators, enabling both dynamic element management and membership / non-membership verification. The accumulator is constructed using polynomials from the exponent, thereby enhancing privacy protection. Its core idea is to embed the polynomial expression of the element into the exponent to prevent verifiers from directly retrieving the original element.

[0081] 1. Accumulator system parameter settings:

[0082] The accumulator operates on a bilinear group inside: It is a cyclic group of order q with generator g. Bilinear mapping. private key This is the system's master key (a randomly selected integer). The public key h = g. x That is the corresponding public key.

[0083] 2. Accumulator initialization is handled by issuing authority I. i Initialize the accumulator by selecting an initial accumulator value A0 = g and a set of elements to be added, S = {e1, e2, ..., e...}. n}

[0084] 3. Accumulation process (incorporating the exponent into the polynomial);

[0085] For the set of elements to be added, S = {e1, e2, ..., e...} n Define a polynomial;

[0086]

[0087] The roots of the polynomial are all the accumulated elements, and then the accumulator value is calculated as follows:

[0088] A = g P(x)

[0089] 4. Proof of Non-Membership;

[0090] For an element not in the accumulator The system can find integers a, b, satisfying

[0091] ae' + bP(x) = 1

[0092] Then generate non-member proof

[0093] w' = g a

[0094] The verifier v checks

[0095] e(A, g e′ )≠ e(w', g)

[0096] If true, it means that e' is not in the accumulator.

[0097] 5. Dynamic update mechanism of DUA

[0098] 1) Element addition If a new element e n+1 is to be added, the accumulator value is updated to

[0099]

[0100] 2) Element deletion If element e i is to be deleted, it is necessary to calculate

[0101]

[0102] A' is the value of the accumulator after deletion.

[0103] The scheme in this paper consists of four main participants: users u, multiple issuing agencies I i , regulatory agencies S and verifiers v. The interactions between the participants are shown in the system model. Figure 2

[0104] The scheme in this paper consists of four main participants: users u, multiple issuing agencies I i , regulatory agencies S and verifiers v. The interactions between the participants are shown in the system model. Figure 1

[0105] Users u Users have multiple attributes m i that need to be protected, and interact with multiple issuing agencies I i to obtain anonymous credentials about the attributes. The user's identity identifier ID U is encrypted by the public key pk S of the regulatory agency to generate identity escrow ciphertext C U = Enc(pk S , ID U ​​). When performing credential authentication, the user first submits an anonymous credential to the verifier v, proving the validity of the credential through zero-knowledge proof; then the identity escrow information C U is sent to the supervisory authority for identity authentication. The verifier interacts with the supervisory authority to confirm the identity verification result, and if it passes, the credential is accepted.

[0106] The issuing authority I i has a public-private key pair, responsible for signing the user's attributes and issuing corresponding anonymous credentials, while managing the revocation list, regularly checking the revocation status of the credentials and providing information to the system.

[0107] The supervisory authority S is the authoritative entity in the system, ensuring that the user's identity ID U is not directly obtained by the verifier, protecting the user's anonymity. The supervisory authority has a public-private key pair (pk S , sk S ), the public key is used for user identity escrow encryption, and the private key is used to decrypt the identity ciphertext C U to reveal the identity of malicious users.

[0108] The verifier v's main task is to verify the validity of the anonymous credential submitted by the user, checking multiple credentials through batch verification mechanism, and querying the revocation list to ensure that the credential has not been revoked. The verifier interacts with the supervisory authority to verify the identity legality through the user's identity ciphertext C U , but cannot analyze the user's real identity.

[0109] In this scheme, the issuing authority I i and the supervisory authority S are strictly bound by law and have no malicious behavior motivation; the verifier v is honest but curious, and may try to obtain sensitive information; the user u may be malicious and try to violate the agreement or steal privacy. The specific assumptions are as follows:

[0110] Honest issuing authority I i and supervisory authority S: strictly follow the agreement, the issuing authority issues legal credentials cred i , and the supervisory authority verifies the identity escrow information and reveals malicious users.

[0111] Honest and curious verifier v: correctly implements the protocol, but may try to infer the user's identity, attributes or activity habits from the credentials, or even store / share user information.

[0112] Malicious user u: may modify the credential attributes, fake the credentials for identity fraud or evade supervision.

[0113] This scheme aims to design a distributed anonymous credential scheme with efficient batch verification mechanism, balancing privacy protection and verification efficiency, and achieving the following goals:

[0114] (1) Identity privacy protection: Protect user attributes and issuer identity information through distributed anonymous credential mechanism to avoid disclosure.

[0115] (2) Penetrating supervision: Supervisory authorities have the right to reveal the identity of malicious users, and identity information cannot be obtained by verifiers and issuers, with strict access control.

[0116] (3) Efficient batch verification: Design batch processing mechanism for validity verification and revocation check, optimize the calculation overhead of bilinear pair through random number, and realize efficient revocation check combined with two-layer hybrid accumulator.

[0117] (4) Unlinkability: Multiple authentications of a user cannot be tracked or linked, and zero-knowledge proof is used to ensure that the verifier cannot link multiple credentials.

[0118] (5) Unforgeability: Based on encryption primitives, ensure that the credential cannot be forged, and the attribute value cannot be modified at will.

[0119] The present scheme proposes a distributed anonymous credential scheme with efficient batch verification under different privacy requirements, which includes two kinds of privacy requirements: protecting the attribute privacy of users, and protecting the privacy of user attributes and credential issuing agencies. On this basis, efficient revocation check is realized through a two-layer hybrid accumulator structure.

[0120] Specifically, the first algorithm proposed in the present application is:

[0121] Algorithm 1 initialization

[0122] Input: security parameter

[0123] Output: system parameter

[0124] 1. Randomly select a prime number

[0125] 2. Generate a factorial law cyclic group of order q and the generator g of

[0126] 3. Define the bilinear mapping

[0127] 4. Randomly select

[0128] 5. Generate three hash functions

[0129] (1) System initialization: by each issuer I i(i∈[1,n]), user u, regulatory body S, and validator v jointly agree that one party will execute the process to generate the public parameters needed in the scheme. These parameters do not contain any private information and can be handed over to a third party after all participating parties have reached an agreement. This is achieved by running Π. CL The SymSetup algorithm generates system parameters. Issuing Authority I i The order is chosen to be a prime number. Multiplication cyclic group Bilinear mapping and cyclic groups The generator g is used for subsequent signature calculation and verification. And for... and All have e(h) a ,g b )=e(h,g) ab Established. User u generates a message space M = {0, 1}. * Identity space D = {0,1} * Issuing Authority I i Select a parameter Used to control the validity period of credentials, and three hash functions. Used for subsequent signature calculations. Each user at the issuing authority I i The temporary identity at the location is ID i ∈D, used to distinguish different users with the same attribute value. User's ID. U ∈D represents all its temporary identity IDs. i The set. Meanwhile, the regulatory body S selects a secure elliptic curve (such as ECC) to generate its own public-private key pair (pk). S ,sk S Finally, the public key PK is released. S And the private key sk S Only the regulatory agency holds this information. User u needs to use the regulatory agency's public key to PK. S Encrypt your own identity information ID U To achieve identity supervision.

[0130] Specifically, the second algorithm proposed in this application is as follows:

[0131] (2) Key generation: each issuing authority I i By running Π CL The KeyGen algorithm generates respective public and private key pairs (pk). i ,sk i ) is used for subsequent signature calculations. Where sk i =x i ,

[0132] In particular, the third algorithm proposed in the present application is:

[0133] Algorithm 3 Distributed Signature DisSign(ID i ,m i ,θ,sk i )→σ i

[0134] Input: user identity ID i , message to be signed m i , system parameter θ, CA private key sk i

[0135] Output: signature σ i

[0136] 1. Calculate a = H1(φ)

[0137] 2. Calculate b = H2(φ)

[0138] 3. Calculate w i = H3(ID i || m i || φ)

[0139] 4. Signature is

[0140] (3) Distributed signature: each CA I i runs the Π CL .Sign algorithm to sign a certain attribute m i of the user u to generate a credential, and then the user u can hold the credential to access the corresponding service. For the message to be signed m i ∈ M, the CA I i generates a signature and sends it to the user u. At the same time, the user encrypts his identity ID S using the public key pk U of the supervisor S as C U .

[0141] In particular, the fourth algorithm proposed in the present application is:

[0142] Algorithm 4 Batch Legitimacy Verification BatchVer1(θ,σ i )→1 / 0

[0143] Input: system parameter θ, signature σ i

[0144] Output: verification success 1 or failure 0

[0145] 1. Calculate a = H1(φ), b = H2(φ)

[0146] 2; Choose a random vector Δ = (δ1, ..., δ) n ), for Random number

[0147] Steps 3 and 4 are completed in a zero-knowledge proof environment.

[0148] 3; Select random numbers Let κ = k1·k2

[0149] 4; Zero-knowledge proof verification w i =H3(ID) i ||m i ||φ) and

[0150] 5; Calculate A = a κ ,

[0151] 6; Plaintext verification of bilinear pairs If true, output 1; otherwise, output 0.

[0152] (4) Batch validity: The verifier v needs to verify each message m i Signature σ i For i∈[1,n], verifier v needs to run Π n times. CL The Verify algorithm requires n bilinear pairing operations, which incurs significant computational overhead and time complexity. Batch verification reduces this overhead by randomly selecting a vector Δ = (δ1,…,δ). n Each element is a A random number of bits, then check the bilinear pair formula.

[0153]

[0154] The verification process checks whether the formula is true or false. If the formula is true, the verification succeeds; otherwise, the verification fails. Additionally, user u provides a zero-knowledge proof to demonstrate their identity via encrypted text C. U It is a public key PK conducted by the regulatory agency. S Encrypted to ensure identity privacy. Regulatory agencies can decrypt the encrypted user identity information (C). U To check user identity information.

[0155] (5) Batch revocation checking: In distributed anonymous credential system, in order to ensure that the user can successfully authenticate only in the case of not being revoked, we propose an efficient revocation scheme based on two-layer hybrid accumulator. The scheme uses the combination of polynomial accumulator and "and" operation accumulator to provide efficient revocation checking while maintaining the anonymity of user identity and the scalability of the credential system: the lower layer polynomial accumulator proves that the current user is not in the revocation list of the current issuing authority. The upper layer "and" operation accumulator proves that the current user is not in the revocation list of all issuing authorities.

[0156] With reference to Figure 1 , the first embodiment of the present application provides a multi-CA supported distributed anonymous credential authentication method, which can include the following execution process:

[0157] S101, send the identity attribute of the user to each credential issuing authority, and receive the corresponding anonymous credential generated by signing the identity attribute of the user not belonging to the revocation list by each distributed certificate issuing authority, wherein the identity attribute of the user is checked by using a two-layer hybrid accumulator to obtain a revocation list;

[0158] Before that, the present application also needs to be initialized, Specifically:

[0159] Each participant generates system parameters by running algorithm 1 Contains prime number Multiplicative cyclic group of order And bilinear mapping Generator g of cyclic group G2, which is used to control the validity period of the credential And three hash functions At the same time, the user generates its message space M={0,1} * And identity space D={0,1} * The supervisor S selects an ECC elliptic curve to generate its public and private key pair (pk S ,sk S ): the private key Is a random number value, which is kept secret by the supervisor. The public key pk S =sk S ·G is generated and published by the supervisor, where q is the order of the elliptic curve, and G is the generator of the elliptic curve.

[0160] S102, send the identity identifier of the user to the supervisor, and determine the identity escrow ciphertext according to the encryption of the identity identifier by the supervisor using the public key;

[0161] The key generation process can be:

[0162] The algorithm of key generation is: KeyGen(θ)→(sk i ,pk i );

[0163] Input: system parameter θ;

[0164] Output: key pair (sk i ,pk i );

[0165] 1. Randomly select

[0166] 2. Let

[0167] 3. Private key sk i =x i , public key pk i =X i .

[0168] The process can also be performed by a third party. After obtaining the public key, the supervisory authority can encrypt the identity identifier using the public key to obtain the identity escrow ciphertext.

[0169] S103, send each anonymous credential to the verifier, and jointly complete the batch legality verification of each anonymous credential in the zero-knowledge proof environment to obtain the message verification result of each anonymous credential;

[0170] S104, send the identity escrow ciphertext to the supervisory authority, and determine the decryption plaintext of the identity escrow ciphertext by the supervisory authority;

[0171] S105, according to the identity check result obtained by the verifier and the supervisory authority, and the message verification result of each anonymous credential, determine whether the verification is passed.

[0172] Specifically, the user u has multiple attributes m i that need to be protected, and interacts with multiple issuing authorities I i to obtain anonymous credentials about the attributes. The user encrypts the identity identifier ID U through the public key pk S of the supervisory authority to generate the identity escrow ciphertext C U =Enc(pk S ,ID U ). When performing credential authentication, the user first submits the anonymous credential to the verifier v, and proves the validity of the credential through zero-knowledge proof; then sends the identity escrow information C U to the supervisory authority for identity authentication. The verifier and the supervisory authority interact to confirm the identity inspection result, and if it passes, the credential is accepted.

[0173] On the basis of the above-mentioned embodiments, the application further provides a distributed anonymous credential authentication method supporting multi-CA, which is applied to each distributed issuing authority and can include the following execution process:

[0174] S201, obtaining system parameters obtained by running Π CL .SymSetup algorithm, and each identity attribute of the user and the temporary identity identifier of the user in each distributed issuing authority;

[0175] S202, determining a credential validity period control parameter and first to third hash functions according to the system parameters.

[0176] S203, processing the credential validity period control parameter based on the first to second hash functions to obtain a first parameter and a second parameter, and processing the credential validity period control parameter, each identity attribute and the temporary identity identifier based on the third hash function to obtain each third parameter;

[0177] S204, bringing the first parameter, the second parameter and each third parameter into a signature formula to obtain each anonymous credential of the user.

[0178] S205, in an embodiment of the application, after obtaining the system parameters obtained by running Π CL .SymSetup algorithm, and the identity attribute of the user and the temporary identity identifier of the user in each distributed issuing authority, the method further includes:

[0179] S206, proving that the user is not in the revocation list of the issuing authority based on a two-layer hybrid accumulator constructed based on the combination of a polynomial accumulator and an "and" operation accumulator.

[0180] Each issuing authority has a public-private key pair, is responsible for signing the attributes of the user and issuing the corresponding anonymous credential, manages the revocation list, regularly checks the revocation state of the credential and provides information to the system.

[0181] Each issuing authority I i runs Π CL .Sign algorithm on a certain attribute m i of the user u to generate a signature to generate a credential, and then the user u can hold the credential to access the corresponding service. For a message to be signed m i ∈M, the issuing authority I i generates a signature and sends it to the user u. At the same time, the user encrypts the identity ID S of the user u using the public key pk U of the supervision authority S as C U .

[0182] For example, the issuing authority I iFor a certain attribute m of user U i Sign and issue credentials. For the message m to be signed. i ∈M, calculate a=H1(φ), b=H2(φ), w i =H3(ID) i ||m j ||φ), generate its signature Send to user U. At the same time, user U selects a random value. And use the public key of the regulatory agency S to PK S Encrypted Identity ID U C U = (C1, C2), where C1 = r U ·G,C2=r U ·pk S +ID U .

[0183] Specifically, the revocation list of the issuing authority includes the revocation list of the current issuing authority and the revocation list of all issuing authorities.

[0184] S301, The two-layer hybrid accumulator constructed based on the combination of a polynomial accumulator and an AND operation accumulator, proving that the user is not on the issuing authority's revocation list may include the following execution process:

[0185] S302. Prove that the user's identity attributes are not in the current issuing authority's revocation list based on a polynomial accumulator;

[0186] S303. Based on the AND operation accumulator, prove that the user's identity attributes are not in the revocation list of all issuing authorities.

[0187] The accumulator operates in a bilinear group (G, G) T In the bilinear mapping e: G × G → G T Private key This is the system's master key (a randomly selected integer). The public key h = g. x That is the corresponding public key.

[0188] Accumulator initialization is handled by issuing authority I i Initialize the accumulator by selecting an initial accumulator value A0 = g and a set of elements to be added, S = {e1, e2, ..., e...}. n}

[0189] The accumulation process (incorporating the exponent into the polynomial):

[0190] For the set of elements to be added, S = {e1, e2, ..., e...} n Define a polynomial:

[0191]

[0192] The roots of the polynomial are all the accumulated elements, and then the accumulator value is calculated as:

[0193] A=g P(x)

[0194] Non-Member Proof (ProofofNon-Membership):

[0195] For an element e that does not belong to the accumulator The system can use the Euclidean extension algorithm to find integers a, b, satisfying:

[0196] ae′+bP(x)=1

[0197] Then generate the non-member proof:

[0198] w′=g a

[0199] The verifier v checks:

[0200] e(A,g e′ )≠e(w′,g)

[0201] If it is true, it means that e' is not in the accumulator.

[0202] Wherein, the dynamic updating mechanism of the DUA of the accumulator can be:

[0203] 1) Element addition If a new element e n+1 is to be added, the accumulator value is updated as:

[0204]

[0205] 2) Element deletion If the element e i is to be deleted, it is necessary to calculate:

[0206]

[0207] A′ is the value of the accumulator after deletion.

[0208] On the basis of the above embodiment, the application further provides a distributed anonymous credential authentication method supporting multi-CA, applied to a regulatory authority, comprising:

[0209] S401, obtaining an identity identifier determined based on a set of temporary identity identifiers;

[0210] S402, running Π CL .KeyGen algorithm to obtain a respective public key and private key pair;

[0211] S403, encrypt each element in the temporary identity identifier set based on the public key in the public key and private key pair, to obtain identity identifier identity management ciphertext.

[0212] The regulatory authority is an authoritative entity in the system, ensuring that the user identity ID U is not directly obtained by the verifier, ensuring user anonymity. The regulatory authority has a public-private key pair (pk S , sk S ), the public key is used for user identity management encryption, and the private key is used to decrypt the identity ciphertext C U to reveal the identity of malicious users.

[0213] On the basis of the above embodiment, the application also provides a distributed anonymous credential authentication method supporting multiple CAs, which can include the following execution process when applied to the verifier:

[0214] S501, obtaining each anonymous credential and system parameter;

[0215] S502, calculating the first parameter, the second parameter and each third parameter according to the system parameter as claimed in claim 2;

[0216] S503, constructing a bilinear expression, and substituting the identity management ciphertext into the bilinear expression, and after decomposing the bilinear expression substituted with the identity management ciphertext, obtaining a first decomposition term with the first parameter, and a second decomposition term with the second parameter and the third parameter;

[0217] S504, constructing a decomposition term with a first single factor and a second single factor decomposition term according to the first decomposition term and the second decomposition term;

[0218] S505, based on the multiplied bilinear expression, obtaining the first single factor decomposition term and the multiplied second single factor decomposition term, the multiplied first single factor decomposition term and the multiplied second single factor decomposition term, obtaining the first factor and the second factor;

[0219] S506, verifying the third parameter, the first factor and the second factor under the zero-knowledge proof environment, obtaining the third parameter, the first factor and the second factor verified successfully;

[0220] S507, and checking whether the multiplied bilinear expression is established under the plaintext, if yes, outputting a flag of establishment, otherwise, outputting a flag of non-establishment.

[0221] The main task of the verifier is to verify the validity of the anonymous credential submitted by the user, check multiple credentials through batch verification mechanism, and query the revocation list to ensure that the credential is not revoked. The verifier interacts with the regulatory authority, and the user identity ciphertext C UThe identity is verified to be legal, but the real identity of the user cannot be analyzed.

[0222] Specifically, a distributed anonymous credential scheme that protects the privacy of the credential issuer and the attribute privacy of the user at the same time and can be efficiently batch-verified. In order to hide X i and m i , it is necessary to prove w i = H3(ID i || m i || φ) under zero-knowledge proof, and formula 1 is established, however, due to the existence of a bilinear pair, more constraints will be generated, which will bring a large overhead. By adding a random number κ to transform the batch verification formula 1, the part with large overhead is verified in plaintext, thereby reducing the overhead. Specifically, a random number κ = k1·k2 is added to the exponential part to obtain:

[0223]

[0224] Let formula 4 can be transformed into:

[0225] e(σ,g) = e(A,X″)·e(B,X′) (5)

[0226] Then, under the zero-knowledge proof,

[0227] w i = H3(ID i || m i || φ) under zero-knowledge proof, It can be checked in the plaintext space that the bilinear pair, i.e. formula 5, is established. In this way, the privacy information m i of the user and the identity X i of the credential issuer are protected from being leaked, and the overhead of batch verification is reduced.

[0228] The verifier V verifies the signature σ i on each message m i , which is run by the user U and the verifier V together Algorithm 5.

[0229] The user U first randomly selects a vector Δ = (δ1,…, δ n ), where each element is a random number of l b bit. Then, a random number Let κ = k1·k2. And prove w i = H3(ID i || m i || φ) under zero-knowledge proof, respectively. And The verifier V verifies whether the bilinear pair e (σ, g) = e (A, X'') · e (B, X') is true under the plaintext, and outputs 1 if true, otherwise outputs 0. In this process, the verifier can request the supervisory authority to check the legitimacy of the user identity, and the supervisory authority uses the private key sk S decrypts the user identity ciphertext C U : calculates C1-sk S ·C1derives the corresponding plaintext identity for checking, and returns the checking result to the verifier.

[0230] On the basis of the above embodiment, the application further provides a distributed anonymous credential authentication system supporting multiple CAs, which can include the following execution processes: a user device, each distributed issuing authority, a supervisory authority and a verifier; wherein the user device, each distributed issuing authority, the supervisory authority and the verifier are used to execute the above distributed anonymous credential authentication method.

[0231] On the basis of the above embodiment, the application further provides a computer readable storage medium, which includes instructions that, when executed on a computer, cause the computer to execute the distributed anonymous credential authentication method supporting multiple CAs provided by any one of the method embodiments.

[0232] On the basis of the above embodiment, the application further provides an electronic device, which includes at least one processor, a memory and an input and output unit; wherein the memory is used to store a computer program, and the processor is used to call the computer program stored in the memory to execute the distributed anonymous credential authentication method supporting multiple CAs provided by any one of the method embodiments.

[0233] The application has the following beneficial effects:

[0234] 1. Efficient batch verification algorithm: combined with zero-knowledge proof and exponential term random number technology, compared with traditional certificate-by-certificate verification, the number of bilinear pairings is reduced, and the computing cost is reduced. The existing technology such as the early group signature-based distributed scheme needs to verify the certificate one by one, and the time complexity increases exponentially with the number of certificates. The batch verification scheme has large computing resource cost. The present application designs an efficient batch verification algorithm, combines zero-knowledge proof and exponential term random number technology, significantly reduces the time complexity, reduces the number of bilinear pairings, and greatly reduces the computing cost.

[0235] 2. Privacy protection mechanism: a double-layer privacy protection mechanism is designed to hide user attributes (such as proving attribute satisfaction relationship through zero-knowledge proof without exposing specific values) and issuer identity (such as through indistinguishable accumulators or structure-preserving signature). In existing schemes, the user needs to disclose the issuer public key when submitting the certificate, and the verifier can infer the user's associated information, and the centralized CA scheme has a single point of failure that can easily lead to identity attribute leakage. The double-layer privacy protection mechanism hides user attribute values through zero-knowledge proof and hides issuer identity through indistinguishable accumulators or structure-preserving signature, and the user does not need to disclose the issuer public key in batch verification, effectively avoiding user attribute privacy and issuer identity leakage, and improving the comprehensiveness of privacy protection. Existing revocation schemes such as dynamic universal accumulator (DUA) need to update all remaining member proofs when deleting elements, which has large computational overhead in large-scale scenarios and limited support for complex attributes. The invention introduces a double-layer hybrid accumulator structure, the lower layer polynomial accumulator implements single issuer revocation proof, and the upper layer aggregates multiple agency revocation states through "and" operation to support efficient non-member proof generation and batch verification, avoiding global update overhead and improving the efficiency of revocation checking and support for complex attributes.

[0236] 3. Revocation checking mechanism of double-layer hybrid accumulator structure: a double-layer hybrid accumulator structure is introduced, the lower layer is based on a polynomial accumulator to implement single issuer revocation proof, and the upper layer aggregates multiple agency revocation states through "and" operation to support efficient non-member proof generation and batch verification, avoiding global update overhead. Most existing schemes do not balance privacy protection and compliance supervision, lack user identity supervision mechanism or rely on trusted entity initialization.

[0237] 4. Penetrating supervision mechanism: encrypt user identity information with supervisor public key, only supervisor can decrypt, ensure malicious behavior can be traced, at the same time prevent verifier or issuer from obtaining user identity. The invention encrypts user identity information with supervisor public key, only supervisor can decrypt, realizes penetrating supervision, ensures malicious behavior can be traced, at the same time strictly controls the access authority of verifier and issuer to user identity information, balances the demand of privacy protection and compliance supervision.

[0238] 5. Distributed issuance mechanism without trusted initialization: a distributed issuance mechanism without trusted initialization is designed to support multi-CA collaborative work. Some existing schemes rely on a single trusted center or inefficient decentralized mechanism, such as relying on the security of distributed ledger or a single trusted center. The invention designs a distributed issuance mechanism without trusted initialization, allows multiple issuers to work together to issue certificates through distributed key generation and threshold signature technology, improves the degree of decentralization and robustness of the system, avoids single point of failure, and enhances the practicality of distributed architecture in practical applications.

[0239] The above merely preferred embodiments of the present application and are not intended to limit the patent scope of the present application, any equivalent structure or equivalent process transformation using the content of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for supporting distributed anonymous credential authentication with multi-CA, characterized in that, The application is applied to a user equipment, and comprises the following steps: sending the identity attribute of the user to each certificate authority, and receiving the corresponding anonymous certificate of the user whose identity attribute is not in the revocation list and is signed by each distributed certificate authority; sending the identity identifier of the user to the supervisor, and determining the identity hosting ciphertext of the identity identifier according to the encryption of the identity identifier by the supervisor using the public key; sending the anonymous certificate to the verifier, and completing the batch legality verification of the anonymous certificate in the zero-knowledge proof environment together with the verifier to obtain the message verification result of the anonymous certificate; sending the identity hosting ciphertext to the supervisor, and determining the decryption plaintext of the identity hosting ciphertext by the supervisor; determining whether the verification is passed according to the identity check result obtained by the interaction between the verifier and the supervisor and the message verification result of the anonymous certificate.

2. A distributed anonymous credential authentication method supporting multi-CA, characterized by, The application is applied to each distributed authority, and comprises the following steps: obtaining based on a third party institution running the system parameters obtained by the SymSetup algorithm, and the identity attributes of the user and the temporary identity identifier of the user in each distributed issuing institution, the SymSetup algorithm represents a system initialization algorithm; determining the certificate validity period control parameter and the first to third hash functions according to the system parameter; processing the certificate validity period control parameter based on the first to second hash functions to obtain the first parameter and the second parameter, and processing the certificate validity period control parameter, the identity attribute and the temporary identity identifier based on the third hash function to obtain the third parameter; bringing the first parameter, the second parameter and the third parameter into the signature formula to obtain the anonymous certificate of the user. 3.The distributed anonymous credential authentication method with support of multi-CA according to claim 2, wherein, In the obtaining the system parameters based on the third-party authority running the SymSetup algorithm, and the identity attribute of the user and the temporary identity identifier of the user in each distributed issuing authority, the method further comprises: The two-layer hybrid accumulator based on the combination of the polynomial accumulator and the "and" operation accumulator proves that the user is not in the revocation list of the authority. 4.The method of claim 3, wherein, The revocation list of the authority comprises the revocation list of the current authority and the revocation list of all authorities. The two-layer hybrid accumulator based on the combination of the polynomial accumulator and the "and" operation accumulator proves that the user is not in the revocation list of the authority, and comprises: proving that the identity attribute of the user is not in the revocation list of the current authority based on the polynomial accumulator; proving that the identity attribute of the user is not in the revocation list of all authorities based on the "and" operation accumulator.

5. A method for distributed anonymous credential authentication supporting multi-CA, characterized in that, The application is applied to the supervisor, and comprises the following steps: obtaining the identity identifier determined based on the temporary identity identifier set in the multi-CA supporting distributed anonymous certificate authentication method according to any one of claims 2-3; Run The.KeyGen algorithm, which results in a respective pair of public and private keys, wherein, The.KeyGen algorithm denotes a key generation algorithm; encrypting each element in the temporary identity identifier set based on the public key in the public key and private key pair to obtain the identity hosting ciphertext of the identity identifier.

6. A distributed anonymous credential authentication method supporting multi-CA, characterized by, The application is applied to the verifier, and comprises the following steps: obtaining the anonymous certificate and the system parameter; calculating the first parameter, the second parameter and the third parameter according to claim 2 based on the system parameter; constructing a bilinear expression, and substituting the identity hosting ciphertext into the bilinear expression, and decomposing the bilinear expression substituted with the identity hosting ciphertext to obtain the first decomposition term with the first parameter and the second decomposition term with the second parameter and the third parameter; constructing the decomposition term with the first single factor and the second single factor decomposition term according to the first decomposition term and the second decomposition term; Based on the multiplied bilinear expression, a first single factor decomposition item and a multiplied second single factor decomposition item are obtained, and the multiplied first single factor decomposition item and the multiplied second single factor decomposition item are obtained, to obtain a first factor and a second factor; Based on the zero-knowledge proof environment, the third parameter, the first factor and the second factor are verified, and the third parameter, the first factor and the second factor that pass the verification are obtained; And, under the plaintext, it is checked whether the multiplied bilinear expression is established, if yes, an established flag is output, otherwise, an unestablished flag is output.

7. A distributed anonymous credential authentication system supporting multi-CA, characterized by, It comprises: A user device, each distributed issuing agency, a regulatory agency and a verifier; The user device is configured to perform the distributed anonymous certificate authentication method supporting multiple CAs according to claim 1; Each distributed issuing agency is configured to perform the distributed anonymous certificate authentication method supporting multiple CAs according to claim 2; The regulatory agency is configured to perform the distributed anonymous certificate authentication method supporting multiple CAs according to claim 3; The verifier is configured to perform the distributed anonymous certificate authentication method supporting multiple CAs according to claim 4.

8. A computer-readable storage medium, characterized in that, It comprises instructions that, when executed on a computer, cause the computer to perform the distributed anonymous certificate authentication method supporting multiple CAs according to any one of claims 1-6.

9. An electronic device, comprising: The electronic device comprises: At least one processor, a memory and an input-output unit; The memory is configured to store a computer program, and the processor is configured to call the computer program stored in the memory to perform the distributed anonymous certificate authentication method supporting multiple CAs according to any one of claims 1-6.

Images