Anonymous authentication and key negotiation method for communication network

Abstract

The invention relates to an anonymous authentication and key negotiation method for a communication network, relates to the technical field of mobile communication networks, and aims to solve the problems that user identity tracking and revocation are difficult and privacy protection and effective supervision cannot be effectively balanced in a mobile communication system of the communication network. Comprising the following steps: establishing a system and generating system parameters; generating an HN key; generating a tracker key; generating an SN key; distributing certificates, enabling a user to interact with the HN, and requesting the certificate of the attribute of the user; verifying the certificate; a user interacts with the SN to negotiate a session key; displaying the anonymous voucher; verifying the anonymous credential; tracking and tracing; and performing local revocation. According to the method, the role of the tracker is set, the certificate is used for the mobile communication system, and when some malicious behaviors occur, the identity of the user is tracked by the tracker, so that a verifier can perform local revocation, anonymous authentication, identity tracking and revocation oriented to the communication network are effectively realized, and meanwhile, the privacy of other legal users is ensured.

Description

Technical Field

[0001] This invention relates to the field of mobile communication network technology, and in particular to an anonymous authentication and key negotiation method for communication networks. Background Technology

[0002] Currently, mobile communication systems have become an indispensable part of people's daily lives. However, while mobile network operators provide strong connectivity and mobile communication services, their mobile tracking capabilities have become a serious privacy issue for users. Furthermore, considering the issue of monitoring malicious user identities, the contradiction between user privacy and responsibility further complicates the mobile tracking problem. In 5G and future scenarios, most work focuses on protecting user identity and location privacy from external attackers. For example, in the paper "The 5G-aka authentication protocol privacy," Koutsos et al. proposed the AKA+ protocol to resist linkability attacks by rearranging the 5G-AKA message flow. However, implementation under standardized SIM cards is impractical because this protocol requires all users to replace their SIM cards. In the paper "Fine-grained trackability in protocol executions," Du et al. explored privacy threats beyond 5G and cellular networks, arguing that to protect the user privacy of mobile network operators, a new method must be designed to break the linkability breach and consider user anonymity. In the existing technology, Schmitt et al. proposed the PGPP scheme in the paper "Pretty goodphone privacy". It can authenticate and charge users without identifying them, while using tokens (blind signatures) to defend against malicious mobile operators.

[0003] However, although anonymous authentication provides a certain level of privacy protection for legitimate users, it is difficult to hold dishonest users accountable while promptly revoking their identities. This allows unauthorized users to continue engaging in illegal activities online.

[0004] In other words, existing mobile communication systems face difficulties in tracking and revoking user identities, and cannot effectively balance privacy protection and regulation. Summary of the Invention

[0005] This invention provides an anonymous authentication and key negotiation method for communication networks, which addresses the difficulties in tracking and revoking user identities in mobile communication network systems, and the inability to effectively balance privacy protection and supervision.

[0006] This invention provides an anonymous authentication and key negotiation method for communication networks, comprising the following steps:

[0007] Step 100: System setup, generating system parameters;

[0008] Step 200: HN (HomeNetwork) key generation;

[0009] Step 300, Tracker key generation;

[0010] Step 400: SN (Serving Network) negotiation key generation;

[0011] Step 500: Certificate Issuance. The user interacts with HN and requests a certificate for their attributes. There is a unique mapping between the user's unique identity and the private attribute pm. The user requests a certificate for the public attribute m and the private attribute pm.

[0012] Step 600: Verify credentials;

[0013] Step 700: The user interacts with the SN to negotiate the key;

[0014] Step 800: Display anonymous credentials;

[0015] Step 900: Verify anonymous credentials;

[0016] Step 1000: Tracing and Source Tracking;

[0017] Step 1100, Local Cancellation.

[0018] In one implementation, step 100 specifically includes the following steps:

[0019] Step S101, given the security parameter λ, generate a q-order cyclic group (G1, G2, G... T );

[0020] Step S102, set the bilinear mapping e: G1×G2→G T Let g1∈G1 be a generator of G1, and g2∈G2 be a generator of G2, denoted as Φ=(q,G1,G2,G T ,g1,g2,e);

[0021] Step S103: Select a collision-resistant hash function H1:{0,1} * →{0,1} λ ,

[0022] Step S104, output the public parameters (Φ,H0,H1,H2,H) zk ).

[0023] In one implementation, step 200 specifically includes the following steps:

[0024] Step S201, randomly select calculate x0, x1, x2 are the issuer keys;

[0025] Step S202, let isk = x0, x1, x2, and ipk = (X0, X1, X2).

[0026] In one implementation, step 300 specifically includes the following steps:

[0027] Step S301, randomly select calculate z is the tracker's key;

[0028] In step S302, the tracker generates a cancellation list CRL and sets it to an empty set.

[0029] In one implementation, step 400 specifically includes the following steps:

[0030] Step S401, randomly select calculate y is the negotiation key.

[0031] In one implementation, step 500 specifically includes the following steps:

[0032] Step S501, Request: The user pays the fee to HN and requests the issuance of a certificate;

[0033] Step S502, Sign: Given user attributes (m, pm), HN inputs the issuance keys x0, x1, x2, and calls the BB signature algorithm to generate a signature.

[0034] Step S503, calculate Then generate zero-knowledge proofs: Send (m, pm) and (σ, σ0, σ1, σ2, π0) to the user; the specific process of zero-knowledge proof of π0 is as follows:

[0035] Given i = 0, 1, 2, randomly select ρ i ∈Z q ,calculate Further calculations s i ={ρ i +x i ·ch}i＝0,1,2 ,make

[0036] In one implementation, step 600 specifically includes the following steps:

[0037] Step S601: The user verifies the credential (σ,σ0,σ1,σ2,π0). The user verifies the validity of π0 using the issuer's public key, and then verifies... The specific verification process of zero-knowledge proof π0 is as follows:

[0038] In step S602, if the verification is valid, output 1; otherwise, output 0.

[0039] In one implementation, step 700 specifically includes the following steps:

[0040] Step S701, given the negotiated public key Y, the user selects... Will Send to SN;

[0041] Step S702, SN selection calculate and K=A b+δ·y Let τ = H1(K,0), k s =H1(K,1), sets the session key to k. s Send (B,τ) to the user;

[0042] Step S703, the user calculates δ=H0(Y,A,B) and K=(B·Y δ ) a ,verify If the verification passes, set the session key to k. s =H1(K,1), and all subsequent communication is conducted using session key k. s The procedure will be carried out through the designated safe passage.

[0043] In one implementation, step 800 specifically includes the following steps:

[0044] Step S801, the user randomly selects calculate

[0045] C5 = h pm ∈G1;

[0046] Step S802, generate zero-knowledge proof: make The user sends (m, pf) to the SN; the specific process of zero-knowledge proof π1 is as follows:

[0047] The user randomly selects ρ1, ρ2, ρ3, ρ4 ∈ Z. q ,calculate Further calculation of ch = H zk (cmt1,cmt2,cmt3,cmt4,cmt5,(A,B,τ)), s1=ρ1+ch·pm, s2=ρ2+ch·t, s3=ρ3+ch·r, s4=ρ4+ch·u, let π1=({cmt i} i＝1,2,3,4,5 ,{s i} i＝1,2,3,4 ).

[0048] In one implementation, step 900 specifically includes the following steps:

[0049] Step S901: The verifier verifies whether (m, pf) is valid. The specific verification process is as follows: Check the validity of the user subscription based on attribute m, and verify... Then verify the validity of π1; the specific verification process of zero-knowledge proof of π1 is as follows: calculate ch = H zk (cmt1,cmt2,cmt3,cmt4,cmt5,(A,B,τ)), verify the equation. If the above equation holds true, then the verification of π1 is successful;

[0050] In step S902, if the verification is valid, output 1; otherwise, output 0.

[0051] In one implementation, step 1000 specifically includes the following steps:

[0052] Step S1001: Given the anonymous credential pf, in order to track the user, the tracker uses the tracking key z to calculate...

[0053] Step S1002, update CRL, i.e.

[0054] In one implementation, step 1100 specifically includes the following steps:

[0055] Step S1101: The verifier verifies whether (m,pf) satisfies the revocation condition: if there exists W∈CRL satisfying e(h,W)=e(C5,g2), then local revocation is performed.

[0056] Compared with existing technologies, the advantages of this invention lie in its ability to achieve user identity verification and revocation by setting the role of a tracker, while simultaneously ensuring network communication security through key negotiation. During the method's operation, system parameters are first generated; secondly, HN, tracker, and SN keys are generated respectively; then, the user interacts with the HN to request its attribute certificate; after receiving the attribute certificate, the user verifies its legitimacy; when a network connection is needed, the user and SN negotiate a key, sharing a session key. This process establishes a secure channel for subsequent communication, ensuring confidentiality while providing a secure communication method; when credentials need to be displayed, the user generates anonymous credentials. This process requires computation of the tracker's public key, protecting user privacy while providing a method for the tracker to trace user identity; the verifier verifies the legitimacy of the user's credentials; in the event of malicious behavior, the tracker uses the tracking key to compute the anonymous credentials, tracing the user's identity; finally, the verifier performs local revocation based on the revocation list, effectively achieving anonymous authentication, identity tracking, and revocation for communication networks while ensuring the privacy of other legitimate users. This solves the problems of difficulty in user identity tracking and revocation in mobile communication systems, and the inability to effectively balance privacy protection and supervision. Attached Figure Description

[0057] The invention will now be described in more detail with reference to embodiments and the accompanying drawings.

[0058] Figure 1 This is a model diagram of an anonymous authentication and key negotiation method for communication networks in an embodiment of the present invention.

[0059] Figure 2 This is a flowchart of an anonymous authentication and key negotiation method for communication networks in an embodiment of the present invention; Detailed Implementation

[0060] The invention will now be further described with reference to the accompanying drawings.

[0061] It's important to note that mobile cellular technology has experienced rapid development and widespread application. From 2G to 5G, mobile networks are providing voice, text, and general data services, with enhanced coverage, connectivity, and data rates. Mobile users can make calls and connect to the internet anytime, anywhere using their phones. 5G, the fifth generation of wireless cellular technology, offers higher upload and download speeds, more consistent connectivity, and greater capacity compared to previous networks. 5G networks are faster and more reliable than the currently popular 4G networks. A crucial component of 5G technology is Orthogonal Frequency Division Multiplexing (OFDM). OFDM is a modulation format that encodes high-frequency radio waves incompatible with 4G, offering lower latency and greater flexibility. Simultaneously, recent advancements in millimeter-wave positioning and location technologies enable mobile network operators to locate user devices with sub-meter accuracy; 5G networks will achieve more precise positioning with a wider frequency range, broader bandwidth, and increasingly dense antenna arrays. While providing users with greater availability and accessibility, this finer-grained positioning amplifies privacy risks. Accurate, real-time location information of user devices will be completely transparent to mobile network operators, sufficient to characterize specific users through pattern analysis. However, mobile operators' mobile tracking capabilities have long been used by law enforcement agencies to provide evidence for criminal investigations; therefore, balancing the conflict between user privacy and responsibility is a pressing issue that needs to be addressed.

[0062] Key negotiation refers to the process by which two communicating parties negotiate a shared key over an insecure channel, which is used for the encryption and decryption of subsequent data transmission. Key negotiation methods ensure secure communication over insecure channels, providing reliable encryption for data transmission. In mobile communication systems, when a user requests a network connection, they first perform a key negotiation protocol with the serving network to obtain a shared session key. This ensures that subsequent communication is transmitted over a secure channel under the session key, effectively preventing data from being eavesdropped on or tampered with by third parties.

[0063] Anonymous authentication technology has wide applications in preventing mobile tracking by mobile operators. It's a technique that ensures user authentication while protecting user privacy. This technology allows users to prove they possess a legitimate identity or privilege without revealing their true identity. It ensures the security of both communicating parties while preventing the exposure or misuse of user identity information. In 2024, Yu et al. proposed a specific method to prevent mobile tracking in cellular networks. This method transforms the anonymous certificate scheme proposed by Camenisch et al. into a certificate scheme that does not specify a verifier; however, it lacks a formal definition and also poses a security risk of exposing user privacy.

[0064] It should be noted that the anonymous authentication and key negotiation method for communication networks in this invention is primarily used for anonymous communication in mobile networks. Besides its application in anonymous communication, this method has a wide range of other applications. For example, in the field of intelligent transportation, systems need to identify and authenticate vehicle identities to provide personalized services and security. Through the anonymous authentication and key negotiation method for communication networks, vehicles can prove their legitimacy to traffic infrastructure (such as toll booths, traffic lights, parking lots, etc.) without revealing their true identity. For instance, when vehicles authenticate their identities and pay tolls, transaction privacy can be ensured; vehicles can anonymously authenticate and reserve parking spaces, allowing parking management systems to confirm their legitimate identity without knowing the specific owner's information; in criminal cases such as hit-and-run accidents, trackers can locate the perpetrator and revoke their legal status. The anonymous authentication and key negotiation method for communication networks ensures that intelligent transportation systems can guarantee the anonymity of legitimate users while monitoring violations of traffic rules.

[0065] like Figure 1 As shown, this invention provides a model for anonymity authentication and key negotiation methods for communication networks. This invention includes an HN local network, an SN service network, a tracker (law enforcement agency), arrows indicating sent information, and bidirectional arrows indicating mutual information exchange.

[0066] First, the system is initialized to obtain public parameters. Based on these parameters, an HN issuing key, a tracker key, and an SN negotiation key are generated. After the user pays the fee, the HN distributes a certificate with the user's attributes. The user verifies the certificate's validity and writes it to the SIM card. When a network connection is needed, the user and the SN execute a key negotiation protocol, ensuring that subsequent communication takes place on a secure channel under the session key. Second, the user generates anonymous credentials, using the tracker's public key as input for accountability when necessary. The SN verifies the anonymous certificate's validity and provides services to the user. Notably, the tracker uses the tracker's private key to track user identities and maintains a revocation list, enabling the SN to promptly revoke the identities of unauthorized users when verifying credentials.

[0067] like Figure 2 As shown, this invention provides an anonymous authentication and key negotiation method for communication networks, comprising the following steps:

[0068] Step 100: System setup, generating system parameters;

[0069] Step 200: HN (Home Network) key generation;

[0070] Step 300, Tracker key generation;

[0071] Step 400: SN (Serving Network) negotiates and generates the key;

[0072] Step 500: Certificate Issuance. The user interacts with HN and requests a certificate for their attributes. There is a unique mapping between the user's unique identity and the private attribute pm. The user requests a certificate for the public attribute m and the private attribute pm.

[0073] Step 600: Verify credentials;

[0074] Step 700: The user interacts with the SN to negotiate the key;

[0075] Step 800: Display anonymous credentials;

[0076] Step 900: Verify anonymous credentials;

[0077] Step 1000: Tracing and Source Tracking;

[0078] Step 1100, Local Cancellation.

[0079] Based on the above steps, user identity verification and revocation are achieved by setting the role of the tracker, while network communication security is ensured through key negotiation. During the method's operation, system parameters are first generated; secondly, HN, tracker, and SN keys are generated respectively; then, the user interacts with the HN to request its attribute certificate; after receiving the attribute certificate, the user verifies its legitimacy; when a network connection is needed, the user and SN negotiate a key, sharing a session key. This process establishes a secure channel for subsequent communication, providing a secure communication method while ensuring confidentiality; when credentials need to be displayed, the user generates anonymous credentials. This process requires computation of the tracker's public key, protecting user privacy while providing a method for the tracker to trace user identity; the verifier verifies the legitimacy of the user's credentials; when malicious behavior occurs, the tracker uses the tracking key to compute the anonymous credentials, tracing the user's identity; finally, the verifier performs local revocation according to the revocation list, effectively achieving anonymous authentication, identity tracking, and revocation for communication networks while ensuring the privacy of other legitimate users. This solves the problems of difficult user identity tracking and revocation, and the inability to effectively balance privacy protection and supervision in mobile communication systems.

[0080] Specifically, in one embodiment, step 100 initializes the algorithm and generates publicly available system parameters. This includes the following steps:

[0081] Step S101, given the security parameter λ, generate a q-order cyclic group (G1, G2, G... T );

[0082] Step S102, set the bilinear mapping e: G1×G2→G T Let g1∈G1 be a generator of G1, and g2∈G2 be a generator of G2, denoted as Φ=(q,G1,G2,G T ,g1,g2,e);

[0083] Step S103: Select a collision-resistant hash function H1:{0,1} * →{0,1} λ ,

[0084] Step S104, output the public parameters (Φ,H0,H1,H2,H) zk ).

[0085] Specifically, in one embodiment, step 200 generates the public and private keys for HN, which includes the following steps:

[0086] Step S201, Select a random number calculate

[0087] x0, x1, x2 are the issuer keys;

[0088] Step S202: Let isk = x0, x1, x2 represent the issuer key and ipk = (X0, X1, X2) represent the issuer public key.

[0089] Specifically, in one embodiment, step 300 generates the tracker's public and private keys and a revocation list, which includes the following steps:

[0090] Step S301, randomly select calculate z is the tracker's key, and Z is the tracker's public key;

[0091] In step S302, the tracker generates a cancellation list CRL and sets it to an empty set.

[0092] Specifically, in one embodiment, step 400 generates the public and private keys for the SN, which includes the following steps:

[0093] Step S401, randomly select calculate y is the negotiation key, and Y is the negotiation public key.

[0094] Specifically, in one embodiment, step 500, where the user interacts with HN to request an attribute certificate, includes the following steps:

[0095] Step S501, Request: The user pays the fee to HN and requests the issuance of a certificate;

[0096] Step S502, Sign: Given user attributes (m, pm), HN inputs the issuance keys x0, x1, x2, and calls the BB signature algorithm to generate a signature.

[0097] Step S503, calculate x0, x1, and x2 are the issuing keys. Then, the corresponding zero-knowledge proof is generated: Send user attributes (m, pm) and attribute certificates (σ, σ0, σ1, σ2, π0) to the user; the specific process of zero-knowledge proof π0 is as follows:

[0098] Given i = 0, 1, 2, randomly select ρ i ∈Z q ,calculate Further calculations s i ={ρ i +x i ·ch} i＝0,1,2 ,make

[0099] Specifically, in one embodiment, step 600, user verification of the attribute certificate, includes the following steps:

[0100] Step S601: User verifies credential (σ,σ0,σ1,σ2,π0). The user verifies the validity of π0 using the issuer's public key ipk, and then verifies... The specific verification process of zero-knowledge proof π0 is as follows:

[0101]

[0102] In step S602, if the verification is valid, output 1; otherwise, output 0.

[0103] Specifically, in one embodiment, step 700 involves the user negotiating a key with the SN, which includes the following steps:

[0104] Step S701, given the negotiated public key Y, the user selects... Will Send to SN;

[0105] Step S702, SN selection calculate and K=A b+δ·y Let τ = H1(K,0), k s =H1(K,1), sets the session key to k. s Send (B,τ) to the user;

[0106] Step S703, the user calculates δ=H0(Y,A,B) and K=(B·Y δ ) a ,verify If the verification passes, set the session key to k. s =H1(K,1), and all subsequent communication is conducted using session key k. s The procedure will be carried out through the safety passage below.

[0107] Specifically, in one embodiment, step 800, where the user generates their own anonymous credentials, includes the following steps:

[0108] Step S801: The user randomly selects r,t,u∈G1 and calculates... C5 = h pm ∈G1, where (m,pm) are user attributes;

[0109] Step S802, generate zero-knowledge proof: Let the anonymous credentials be The user sends (m, pf) to the SN; the specific process of zero-knowledge proof π1 is as follows:

[0110] The user randomly selects ρ1, ρ2, ρ3, ρ4 ∈ Z. q ,calculate Further calculation of ch = H zk (cmt1,cmt2,cmt3,cmt4,cmt5,(A,B,τ)), s1=ρ1+ch·pm, s2=ρ2+ch·t, s3=ρ3+ch·r, s4=ρ4+ch·u, let zero knowledge prove π1=({cmt i} i＝1,2,3,4,5 ,{s i} i＝1,2,3,4 ).

[0111] Specifically, in one embodiment, step 900, where the verifier verifies the user's anonymous credentials, includes the following steps:

[0112] Step S901: The verifier verifies whether (m, pf) is valid. The specific verification process is as follows: Check the validity of the user subscription based on attribute m, and verify... Then verify the validity of π1. The specific verification process of the zero-knowledge proof of π1 is as follows: Calculate ch = H zk (cmt1,cmt2,cmt3,cmt4,cmt5,(A,B,τ)), verify the equation. If the above equation holds true, then the verification of π1 is successful;

[0113] In step S902, if the verification is valid, output 1; otherwise, output 0.

[0114] Specifically, in one embodiment, step 1000, where the tracker traces and verifies the anonymous credentials, includes the following steps:

[0115] Step S1001: Given the anonymous credential pf, in order to track the user, the tracker uses the tracking key z to calculate the tracking value.

[0116] Step S1002, update CRL, i.e.

[0117] Specifically, in one embodiment, step 1100, where the verifier revokes the anonymous credential, includes the following steps:

[0118] Step S1101: The verifier verifies whether the credential (m,pf) meets the revocation condition: if there exists W∈CRL satisfying e(h,W)=e(C5,g2), then local revocation is performed.

[0119] As described in the above specific implementation method, user identity verification and revocation are achieved by setting the role of the tracker, while network communication security is ensured through key negotiation. During the method's operation, system parameters are first generated; secondly, HN, tracker, and SN keys are generated respectively; then, the user interacts with the HN to request its attribute certificate; after receiving the attribute certificate, the user verifies its legitimacy; when a network connection is needed, the user and SN negotiate a key, sharing a session key. This process establishes a secure channel for subsequent communication, ensuring confidentiality and providing a secure communication method; when credentials need to be displayed, the user generates anonymous credentials. This process requires computation of the tracker's public key, protecting user privacy while providing a method for the tracker to trace user identity; the verifier verifies the legitimacy of the user's credentials; when malicious behavior occurs, the tracker uses the tracking key to compute the anonymous credentials, tracing the user's identity; finally, the verifier performs local revocation according to the revocation list, effectively achieving anonymous authentication, identity tracking, and revocation for communication networks while ensuring the privacy of other legitimate users. This solves the problems of difficult user identity tracking and revocation in mobile communication systems, and the inability to effectively balance privacy protection and supervision.

[0120] Although the invention has been described with reference to preferred embodiments, various modifications can be made and components can be replaced with equivalents without departing from the scope of the invention. In particular, the technical features mentioned in the various embodiments can be combined in any manner as long as there is no structural conflict. The invention is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

[0121] Obviously, the embodiments described above are merely some, not all, embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort should fall within the scope of protection of the present invention.

[0122] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0123] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in sequences other than those illustrated or described herein.

[0124] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for anonymous authentication and key negotiation in communication networks, characterized in that, Includes the following steps: Step 100: System setup, generating system parameters; Step 200: Issuer key generation; Step 300, Tracker key generation; Step 400: Negotiate key generation; Step 500: Certificate Issuance. The user interacts with HN and requests a certificate for their attributes. There is a unique mapping between the user's unique identity and the private attribute pm. The user requests a certificate for the public attribute m and the private attribute pm. Step 600: Verify credentials; Step 700: The user interacts with the SN to negotiate the key; Step 800: Display anonymous credentials; Step 900: Verify anonymous credentials; Step 1000: Tracing and Source Tracking; Step 1100, Local Cancellation.

2. The anonymous authentication and key negotiation method according to claim 1, characterized in that, Step 100 specifically includes the following steps: Step S101, given the security parameter λ, generate a q-order cyclic group (G1, G2, G... T ); Step S102, set the bilinear mapping e: G1×G2→G T Let g1∈G1 be a generator of G1, and g2∈G2 be a generator of G2, denoted as Φ=(q,G1,G2,G T ,g1,g2,e); Step S103: Select a collision-resistant hash function H1:{0,1} * →{0,1} λ , Step S104, output the public parameters (Φ,H0,H1,H2,H) zk ).

3. The anonymous authentication and key negotiation method according to claim 1, characterized in that, Step 200 specifically includes the following steps: Step S201, randomly select calculate x0, x1, x2 are the issuer keys; Step S202, let isk = x0, x1, x2, and ipk = (X0, X1, X2).

4. The anonymous authentication and key negotiation method according to claim 1, characterized in that, Step 500 specifically includes the following steps: Step S501, Request: The user pays the fee to HN and requests the issuance of a certificate; Step S502, Sign: Given user attributes (m, pm), HN inputs the issuance keys x0, x1, x2, and calls the BB signature algorithm to generate a signature. Step S503, calculate Then generate zero-knowledge proofs: Send (m, pm) and (σ, σ0, σ1, σ2, π0) to the user; the specific process of zero-knowledge proof of π0 is as follows: Given i = 0, 1, 2, randomly select ρ i ∈Z q ,calculate Further calculations s i ={ρ i +x i ·ch} i＝0,1,2 ,make 5. The anonymous authentication and key negotiation method according to claim 1, characterized in that, Step 600 specifically includes the following steps: Step S601: The user verifies the credential (σ,σ0,σ1,σ2,π0). The user verifies the validity of π0 using the issuer's public key, and then verifies... The specific verification process of zero-knowledge proof π0 is as follows: In step S602, if the verification is valid, output 1; otherwise, output 0.

6. The anonymous authentication and key negotiation method according to claim 1, characterized in that, Step 700 specifically includes the following steps: Step S701: Given the negotiated public key Y, the user selects a∈Z. q ,Will Send to SN; Step S702, SN selection calculate and K=A b+δ·y Let τ = H1(K,0), k s =H1(K,1), sets the session key to k. s Send (B,τ) to the user; Step S703, the user calculates δ=H0(Y,A,B) and K=(B·Y δ ) a ,verify If the verification passes, set the session key to k. s =H1(K,1), and all subsequent communication is conducted using session key k. s The procedure will be carried out through the designated safe passage.

7. The anonymous authentication and key negotiation method according to claim 1, characterized in that, Step 800 specifically includes the following steps: Step S801: The user randomly selects r,t,u∈Z q ,calculate C5=h pm ∈G1; Step S802, generate zero-knowledge proof: make The user sends (m, pf) to the SN; the specific process of zero-knowledge proof π1 is as follows: The user randomly selects ρ1, ρ2, ρ3, ρ4 ∈ Z. q ,calculate Further calculation of ch = H zk (cmt1,cmt2,cmt3,cmt4,cmt5,(A,B,τ)), s1=ρ1+ch·pm, s2=ρ2+ch·t, s3=ρ3+ch·r, s4=ρ4+ch·u, let π1=({cmt i } i＝1,2,3,4,5 ,{s i } i＝1,2,3,4 ).

8. The anonymous authentication and key negotiation method according to claim 1, characterized in that, Step 900 specifically includes the following steps: Step S901: The verifier verifies whether (m, pf) is valid. The specific verification process is as follows: Check the validity of the user subscription based on attribute m, and verify... Then verify the validity of π1; the specific verification process of zero-knowledge proof of π1 is as follows: calculate ch = H zk (cmt1,cmt2,cmt3,cmt4,cmt5,(A,B,τ)), verify the equation. If the above equation holds true, then the verification of π1 is successful; In step S902, if the verification is valid, output 1; otherwise, output 0.

9. The anonymous authentication and key negotiation method according to claim 1, characterized in that, Step 1000 specifically includes the following steps: Step S1001: Given the anonymous credential pf, in order to track the user, the tracker uses the tracking key z to calculate... Step S1002, update CRL, i.e.

10. The anonymous authentication and key negotiation method according to claim 1, characterized in that, Step 1100 specifically includes the following steps: Step S1101: The verifier verifies whether (m,pf) satisfies the revocation condition: if there exists W∈CRL satisfying e(h,W)=e(C5,g2), then local revocation is performed.

Images