User voucher verification method based on revisable signature and anonymous voucher system

Abstract

The invention discloses a user credential verification method based on a revisable signature and a distributed anonymous credential system, which realize an authentication scheme considering privacy protection and identity supervision by designing an anonymous credential supporting selective disclosure and strategy limitation in a distributed order transaction scene. Therefore, a safe and efficient order identity verification protocol is constructed. Specifically, a revisable signature scheme is designed, and selective hiding aiming at sensitive attributes is realized; and designing a permission strategy scheme fusing Epoch and K-time use limitation, and realizing effective supervision on the voucher use behavior of the user on the premise of ensuring anonymity. Compared with a traditional scheme taking zero-knowledge proof as a core, the method has the advantages that the calculation and communication overhead is further reduced while the privacy security is ensured, and the lightweight and supervisible capability of the system is remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and more particularly to a user credential verification method based on a revisable signature and an anonymous credential system. BACKGROUND

[0002] With the continuous development of network technology, network commodity shopping has become a main way of material purchase. In the ordering transaction, the supply, distribution, ordering and delivery of materials are extremely important links, and any link breakage will cause the transaction to fail. In special periods, the ordering party often over-orders, which can easily lead to uneven resource allocation and even polarization. At the same time, different ordering service providers have data silos, and the identity information of the ordering party is neither intercommunicated nor portable, and the ordering party over-orders in multiple ordering service providers, which makes the ordering transaction differentiation more serious.

[0003] The existing distributed digital identity technology can well solve the problem of data silos, and through the change of ownership of identity data, the ordering party can manage the identity data by itself. However, due to the self-sovereign identity management of the ordering party, the supervision of the distributed identity is more difficult, and the problems of identity abuse and punishment failure are prone to occur. When the mainstream distributed digital identity implements the selective disclosure mechanism, zero-knowledge proof is often used to protect the privacy of user attributes, which increases the computational complexity and communication overhead. SUMMARY

[0004] The purpose of the present application is to build an anonymous credential system, support users to select attributes for selective disclosure, and realize lightweight and efficient anonymous authentication. At the same time, combined with the permission policy of use period and use times, flexible supervision in the credential use process is realized, and the privacy protection ability and controllability of the distributed identity system in ordering transactions and other scenarios are improved.

[0005] In order to achieve the above purpose, the first aspect of the present application provides a user credential verification method based on a revisable signature, comprising: A system initialization step, a trusted certificate authority generates secret parameters and public parameters, saves the secret parameters, and publishes the public parameters; A certificate issuing step, the trusted certificate authority interacts with the ordering party, generates the certificate of the ordering party based on the public parameters, sends it to the ordering party, and saves the message signature to the bulletin board, wherein the certificate of the ordering party includes the certificate content and the message signature; A credential issuing step, the trusted certificate authority interacts with the ordering party, generates the credential of the ordering party based on the secret parameters and the public parameters, and the credential contains restrictions on the ordering party; A certificate revision step, the ordering party edits the certificate of the ordering party; Certificate verification step, in the process of interaction between the subscriber and the subscription service provider, the subscription service provider verifies the certificate and the credential of the subscriber to determine the legitimacy of the identity of the subscriber and the compliance of the subscription behavior.

[0006] In an embodiment, the trusted certificate authority interacts with the subscriber, generates the certificate of the subscriber based on the public parameter, and sends it to the subscriber, including: Receiving the certificate registration application and the certificate content sent by the subscriber; Integrating the registration application and the certificate content into a message , The first subscriber message is represented by The total number of subscriber messages is represented by , The subscriber identifier is selected as a cyclic group The signature of the message is generated , , The hash function is represented by The identity information of the trusted certificate authority is represented by The base for message signature is represented by Send to the subscriber.

[0007] In an embodiment, the trusted certificate authority interacts with the subscriber, generates the credential of the subscriber based on the secret parameter and the public parameter, including: The trusted certificate authority generates the credential of the subscriber according to the subscriber identifier, the current epoch and the corresponding usage limit, wherein the credential of the subscriber includes identity binding, policy-related permission structure and ticket information corresponding to a certain usage behavior; The trusted certificate authority generates the obfuscated usage aggregation value according to the ticket information in a certain epoch; The credential of the subscriber, the information obtained based on the obfuscated usage aggregation value and the random number are packaged to the subscriber, and the permission public key based on the identity hash is saved.

[0008] In an embodiment, the subscriber edits the certificate of the subscriber, including: The subscriber determines the certificate content , the set and the set , wherein The first subscriber message is represented by The total number of subscriber messages is represented by The subscript index set of the information required by the SSP is represented by , a subscript index set representing the information to be hidden; editing the certificate of the subscriber to generate :

[0009]

[0010] wherein, represents a group element aggregate constructed for each attribute in the set of hidden attributes to obfuscate the hidden attribute, represents a base in the public parameters for the th attribute, represents the plaintext value of the th attribute, belonging to the part of the complete attribute set of the subscriber that is hidden, is a part modeling the interaction between the disclosed attributes and the hidden attributes, represents a double exponential base used to establish a combined mapping between the disclosed attributes and the hidden attributes .

[0011] In an embodiment, during the interaction between the subscriber and the subscription service provider, the subscription service provider verifies the certificate and the credential of the subscriber to determine the legitimacy of the identity of the subscriber and the compliance of the subscription behavior, including: the subscriber sends a message containing the credential, a group element aggregate constructed for each attribute in the set of hidden attributes , a part modeling the interaction between the disclosed attributes and the hidden attributes, and ticket information to the subscription service provider; computing the permission evidence of the subscriber according to the ticket information; verifying whether the credential of the subscriber contains the ticket presented this time, and verifying whether the subscriber revises the certificate correctly.

[0012] In an embodiment, the method further includes: when the misbehavior of the subscriber is reported, the trusted certificate authority identifies the identity of the subscriber through the current subscription commodity exchange process.

[0013] In an embodiment, when the misbehavior of the subscriber is reported, the trusted certificate authority identifies the identity of the subscriber through the current subscription commodity exchange process, including: computing the permission public key according to the identity binding in the current subscription commodity exchange process, the policy-related permission structure, the permission key, and the maximum number of allowed uses of the subscriber in the subscription credential; The subscriber identity is identified according to whether the calculated permission public key is equal to the saved identity hash-based permission public key.

[0014] Based on the same inventive concept, the second aspect of the present application provides a distributed anonymous credential system based on revisable signature, comprising: A system initialization module is configured to perform a system initialization step, including that a trusted certificate authority generates secret parameters and public parameters, saves the secret parameters, and publishes the public parameters. A certificate issuing module is configured to perform a certificate issuing step, including that the trusted certificate authority interacts with a subscriber, generates a certificate of the subscriber based on the public parameters, sends the certificate to the subscriber, and saves a message signature to a bulletin board, wherein the certificate of the subscriber includes certificate content and the message signature. A credential issuing module is configured to perform a credential issuing step, including that the trusted certificate authority interacts with the subscriber, generates a credential of the subscriber based on the secret parameters and the public parameters, and the credential contains restrictions on the subscriber. A certificate revising module is configured to perform a certificate revising step, including that the subscriber edits the certificate of the subscriber. A certificate verifying module is configured to perform a certificate verifying step, including that, in the process of interaction between the subscriber and a subscription service provider, the subscription service provider verifies the certificate and the credential of the subscriber to determine the legality of the identity of the subscriber and the compliance of the subscription behavior.

[0015] Based on the same inventive concept, the third aspect of the present application provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to implement the user credential verifying method based on revisable signature according to the first aspect.

[0016] Based on the same inventive concept, the fourth aspect of the present application provides a computer device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the user credential verifying method based on revisable signature according to the first aspect when executing the program.

[0017] Compared with the prior art, the present application has the following advantages and beneficial technical effects: (1) The present application proposes a selective disclosure mechanism based on revisable signature, which avoids high calculation and communication overhead compared with the traditional zero-knowledge proof-based scheme, significantly reduces the resource consumption of the credential generation and verification process, improves the overall operation efficiency of the system, and is suitable for distributed subscription transaction environments with high performance requirements.

[0018] (2) The application proposes to combine the epoch and K-time fine-grained permission strategy, which can flexibly depict the long-term stable transaction relationship of the subscriber, realize the accurate supervision of the voucher use behavior, protect the user privacy, and improve the prevention ability of the excessive subscription and identity abuse.

[0019] (3) The application designs an anonymous voucher system with unlinkability and verifiability, the user can hide the certificate attribute for conditional anonymity, and the verification process does not need the online participation of the certificate issuer, which guarantees the user privacy and enhances the independence and scalability of the system, and is suitable for the distributed identity environment of multiple service providers. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0021] Figure 1 The flow chart of the user voucher verification method based on the revisable signature in the embodiments of the application; Figure 2 The model architecture diagram of the distributed anonymous voucher system based on the revisable signature in the embodiments of the application. DETAILED DESCRIPTION

[0022] The revisable signature is a special signature mechanism, which allows the signature holder to modify or update part of the information in the signature without exposing the original signature content, so as to maintain the legality and verifiability of the signature. The anonymous voucher based on this mechanism has the user-controllable selective disclosure ability, which can protect the privacy and support the flexible management of the voucher content, and is suitable for multi-party cooperation and identity authentication scenarios.

[0023] Based on this, the application proposes a user voucher verification method and a distributed anonymous voucher system based on the revisable signature, designs a revisable signature distributed anonymous voucher system supporting Type3 type bilinear pair to be compatible with the national secret curve, uses the revisable signature technology to construct the distributed identity voucher, the subscriber can revise the voucher to realize the selective disclosure, avoids the use of zero-knowledge proof, and reduces the calculation and communication overhead. In view of the problem that the distributed identity supervision is difficult, the system uses the permission strategy combining the epoch and K-time (K-time). In the user voucher issuing process, the strategy is written into the identity voucher, the verification process of the voucher use includes the verification of the strategy compliance, and the supervision of the user voucher is realized.

[0024] Embodiment one The embodiment provides a user credential verification method based on a revisable signature, and refers to Figure 1 , comprising: S1: a system initialization step, a trusted certificate authority generates secret parameters and public parameters, saves the secret parameters, and publishes the public parameters; S2: a certificate issuing step, the trusted certificate authority interacts with a subscriber, generates a certificate of the subscriber based on the public parameters, sends the certificate to the subscriber, and saves a message signature to a bulletin board, wherein the certificate of the subscriber comprises certificate content and the message signature; S3: a credential issuing step, the trusted certificate authority interacts with the subscriber, generates a credential of the subscriber based on the secret parameters and the public parameters, and the credential contains restrictions on the subscriber; S4: a certificate revising step, the subscriber edits the certificate of the subscriber; S5: a certificate verification step, in the process that the subscriber interacts with a subscription service provider, the subscription service provider verifies the certificate and the credential of the subscriber, to determine the legitimacy of the identity of the subscriber and the compliance of a subscription behavior.

[0025] First, the characters involved in the application are explained and described: , : a group, the order is , and the generators are ; a cyclic group, the order is ; a cyclic group, the order is ; a bilinear pair; a hash function; a main key (signature key) of the CA; a public key on a group ; a random number used for generating an authentication base; : a base used for message signature, on a group ; : a base used for message signature, on a group ; : a base used for hiding part of a message; : license key (generated by CA); : corresponding license public key; : the th epoch; : used to construct credential restriction information; : the th subscriber message; : subscriber identifier; : certificate signature; : subscriber credential, wherein , ; : random number; : evidence (ticket) of the th subscription in the epoch ; : permission vector, used to generate credential; : parameter used to verify credential; : current ticket number in use; : current epoch number.

[0026] In one embodiment, S1 can be implemented in the following way: (a) generate a bilinear pair , where the order of group is , and the generator is .

[0027] (b) generate a hash function .

[0028] (c) randomly select , and then calculate , , and . Hereinafter, , and will be abbreviated as , and , respectively.

[0029] (d) randomly select As the license key, then calculate .

[0030] (e) assume denotes the th epoch, the CA keeps secret and calculates .

[0031] The CA keeps the secret parameter and publishes the public parameter .

[0032] In an embodiment, S2 can be implemented in the following way: Receive the certificate registration application and the certificate content sent by the subscriber; Integrate the registration application and the certificate content into a message , denotes the th subscriber message, denotes the total number of subscriber messages, , is a cyclic group, select a subscriber identifier , generate a signature for the message , , denotes a hash function, denotes the identity information of the trusted certificate authority center, denotes the base for message signature; Send to the subscriber.

[0033] In the implementation process, the CA will also save to the bulletin board.

[0034] In an embodiment, S3 can be implemented in the following way: The trusted certificate authority center generates the subscriber's credential according to the subscriber identifier, the current epoch and the corresponding usage limit, wherein the subscriber's credential includes identity binding, license structure related to the policy and ticket information corresponding to a usage behavior; The trusted certificate authority center generates the obfuscated usage aggregation value according to the ticket information in a certain epoch; Package the subscriber's credential, the information obtained based on the obfuscated usage aggregation value and the random number to the subscriber, and save the license public key based on identity hash.

[0035] In the implementation process, the generation method of the S3 subscriber's credential is specifically: (a) CA finds the subscriber and generates the subscriber's credential according to the current epoch and the corresponding usage limit , The three belong to the three parts of the subscriber's credential, among which , , represents the identity binding, represents the permission structure related to the policy, represents the ticket information corresponding to a certain use behavior.

[0036]

[0037]

[0038] The trusted certificate authority generates the obfuscated usage aggregation value according to the ticket information in a certain epoch, which is (b) Assuming that the credential contains , the usage limit corresponding to each is , calculate :

[0039] Among them are random numbers on , represents the obfuscated usage aggregation value in the th credential, represents the maximum usage limit allowed by the subscriber in the th subscription credential, is an index variable, is a disturbance factor randomly generated by the CA, represents the th subscription evidence (ticket) in epoch .

[0040] The subscriber's credential, information based on the obfuscated usage aggregation value, and random numbers are packaged to the subscriber, and the identity-based hash permission public key is saved, which is: (c) CA sends to the subscriber. The CA will also secretly save the identity-based hash permission public key as the basis for tracking users, where the hash function acts on the concatenated string of the CA identifier and the user identity identifier (ID) to generate a pseudo-random value, ensuring that the original identity information cannot be inferred, is the CA's main signature private key. ​

[0041] In one embodiment, S4 can be implemented in the following way: The subscriber determines the certificate content , the set and the set ; The subscriber edits the certificate to generate :

[0042]

[0043] wherein, represents the group element aggregation constructed for each attribute in the set of hidden attributes to obfuscate the hidden attribute, represents the base in the public parameter for the th attribute, represents the plaintext value of the th attribute, belonging to the hidden part of the complete attribute set of the subscriber, is the part modeling the interaction between the disclosed attribute and the hidden attribute, represents the double-exponential base used to establish a combined mapping between the disclosed attribute and the hidden attribute .

[0044] Generally, the certificate contains more information than what is required by the SSP (Subscription Service Provider). In order to avoid unnecessary information leakage, the subscriber will edit the certificate to hide part of the information. The certificate content is , wherein the subscript index set of the information required by the SSP is ; the corresponding complement, i.e. the subscript index set of the information to be hidden, is .

[0045] In one embodiment, S5 can be implemented in the following way: The subscriber sends a message containing the credential, the group element aggregation constructed for each attribute in the set of hidden attributes , the part modeling the interaction between the disclosed attribute and the hidden attribute, and the ticket information to the subscription service provider; According to the ticket information, the subscriber's right evidence is calculated; Verify whether the subscriber's credential contains the ticket presented this time, and verify whether the subscriber has correctly revised the certificate.

[0046] Specifically, the subscriber interacts with the SSP to obtain the subscribed commodity, in the process, the SSP verifies the certificate and the credential of the subscriber to determine the legitimacy of the identity of the subscriber and the compliance of the subscription behavior. In the embodiment, the interaction occurs epoch , using the first evidence (ticket) .

[0047] In the implementation process, the subscriber sends to the SSP, where is the ticket, is a random number.

[0048] The CA first calculates the permission evidence of the subscriber:

[0049] where is the t-th power of the public parameter g.

[0050] Verify whether the credential of the subscriber contains the ticket presented this time, and verify whether the subscriber correctly revises the certificate, specifically by verifying whether the following two equations are established:

[0051]

[0052] The first equation means verifying whether the credential of the subscriber contains the ticket presented this time; the left side means the value calculated by the certificate of the subscriber, and the right side means the value calculated by the ticket presented this time. If the two sides are equal, the verification is passed. The second equation means verifying whether the subscriber correctly revises the certificate; the left side is the revision target value, and the right side is the revision target value calculated by revising the certificate and the public parameter. If the two sides are equal, the verification is passed. If the above two equations are established at the same time, the verification is passed, and 1 is returned; otherwise, the verification fails.

[0053] In an embodiment, the method further comprises S6: when the malfeasance of the subscriber is reported, the trusted certificate authority center identifies the identity of the subscriber through the current subscription commodity exchange process.

[0054] Wherein, S6 comprises: According to the identity binding in the current subscription commodity exchange process, the permission structure related to the strategy, the permission key, and the maximum number of use times allowed by the subscriber in the subscription credential, the permission public key is calculated; According to whether the calculated permission public key is equal to the saved permission public key based on the identity hash, the identity of the subscriber is identified.

[0055] In the implementation, S6 is implemented by verifying whether the following equation is established:

[0056] wherein the left side of the equation is the saved identity-based hash permission public key, and the right side of the equation is the calculated permission public key, by which the CA can be from the previously saved The identity of the subscriber is identified.

[0057] Embodiment two Based on the same inventive concept, the embodiment discloses a distributed anonymous credential system based on a revisable signature, comprising: A system initialization module is configured to perform a system initialization step, including: a trusted certificate authority generating secret parameters and public parameters, saving the secret parameters, and publishing the public parameters; A certificate issuing module is configured to perform a certificate issuing step, including: the trusted certificate authority interacting with the subscriber, generating a certificate of the subscriber based on the public parameters, sending the certificate to the subscriber, and saving a message signature to a bulletin board, wherein the certificate of the subscriber includes certificate content and the message signature; A credential issuing module is configured to perform a credential issuing step, including: the trusted certificate authority interacting with the subscriber, generating a credential of the subscriber based on the secret parameters and the public parameters, the credential containing restrictions on the subscriber; A certificate revising module is configured to perform a certificate revising step, including: the subscriber editing the certificate of the subscriber; A certificate verifying module is configured to perform a certificate verifying step, including: in the process of the subscriber interacting with a subscription service provider, the subscription service provider verifying the certificate and the credential of the subscriber to determine the legality of the identity of the subscriber and the compliance of the subscription behavior.

[0058] In an embodiment, the system further comprises an identity identifying module configured to identify the identity of the subscriber by the trusted certificate authority through the current subscription commodity exchange process when the misbehavior of the subscriber is reported.

[0059] Specifically, please refer to Figure 2The participant structure of the scheme includes a trusted certificate authority (CA), a trusted bulletin board, a subscription service provider (SSP) and a subscriber. The CA is responsible for issuing certificates with attribute information for users and revealing the identity of the user when necessary; the bulletin board is used to publish public parameters and revocation information; the subscription service provider is responsible for providing specific subscription services; and the subscriber is an entity holding anonymous credentials and selectively discloses in the service process to meet business needs. In this scenario, the malicious behaviors that need to be considered by the application mainly come from the two directions of the subscription service provider and the subscriber. The subscription service provider is considered to be semi-honest, and they may try to guess the identity of the subscriber while performing the service process; the subscriber may be malicious and have the motivation of forging credentials, impersonating others, using credentials more than once, accessing services in unauthorized time periods, and even conspiring with other users.

[0060] Among them, the system initialization module, the certificate issuing module, the credential issuing module and the identity recognition module belong to the trusted certificate authority center, the certificate revision module belongs to the subscriber, and the certificate verification module belongs to the subscription service provider.

[0061] In general, the application designs a revisable signature distributed anonymous credential system. In the distributed subscription transaction scenario, by designing anonymous credentials supporting selective disclosure and policy restriction, an authentication scheme that takes into account privacy protection and identity supervision is realized, thereby constructing a secure and efficient subscription identity verification protocol. Specifically, the application designs a revisable signature scheme to realize selective hiding of sensitive attributes; a permission policy scheme that integrates Epoch and K-time use restriction is designed to effectively supervise the use behavior of user credentials while ensuring anonymity. Compared with traditional schemes that take zero-knowledge proof as the core, the application further reduces the computational and communication overhead while ensuring privacy security, and significantly improves the lightweight and supervisory ability of the system Those skilled in the art will appreciate that embodiments of the application can be provided as methods, systems, or computer program products. Therefore, the application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage, etc.) containing computer-usable program code.

[0062] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other processing device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other processing device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more functions specified in the flowchart block or blocks and Figure 1 one or more functions specified in the flowchart block or blocks and

[0063] While the preferred embodiments of the application have been described, additional variations and modifications can be made to the embodiments by those skilled in the art once they learn of the basic inventive concepts. Such additional variations and modifications have been provided for by the above description of the preferred embodiments, which are intended to be illustrative only. Accordingly, it is not intended that the application be limited as described above but rather that it is intended to be limited only by the scope of the appended claims, including any later-filed claims. Obviously, many modifications and variations of the present embodiments are possible in light of this teaching. It is intended that the scope of the application be limited only by the claims appended hereto and their equivalents.

Claims

1. A user credential verification method based on a revisable signature, characterized by, The method comprises the following steps: a system initialization step, in which a trusted certificate authority generates secret parameters and public parameters, saves the secret parameters, and publishes the public parameters; a certificate issuance step, in which the trusted certificate authority interacts with a subscriber, generates a certificate of the subscriber based on the public parameters, sends the certificate to the subscriber, and saves a message signature to a bulletin board, wherein the certificate of the subscriber comprises certificate content and the message signature; a credential issuance step, in which the trusted certificate authority interacts with the subscriber, generates a credential of the subscriber based on the secret parameters and the public parameters, and the credential comprises a restriction on the subscriber; a certificate revision step, in which the subscriber edits the certificate of the subscriber; a certificate verification step, in which a subscribing service provider verifies the certificate and the credential of the subscriber to determine the legality of the identity of the subscriber and the compliance of a subscribing behavior of the subscriber in a process in which the subscriber interacts with the subscribing service provider.

2. The user credential verification method based on a revisable signature according to claim 1, wherein, The trusted certificate authority interacts with the subscriber, generates a certificate of the subscriber based on the public parameters, and sends the certificate to the subscriber, comprising the following steps: receiving a certificate registration application and certificate content sent by the subscriber; Integrating registration application with certificate contents into a message , denotes a th subscriber message, denotes the total number of subscriber messages, , is a cyclic group, the subscriber identifier is chosen , a signature is generated for the message , , denotes a hash function, denotes the identity information of a trusted certificate authority, denotes a base for the message signature; will be sent to the subscriber. the subscriber.

3. The user credential verification method based on a revisable signature according to claim 1, wherein, The trusted certificate authority interacts with the subscriber, generates a credential of the subscriber based on the secret parameters and the public parameters, comprising the following steps: The trusted certificate authority generates the credential of the subscriber according to a subscriber identifier, a current epoch and a corresponding use frequency limit, wherein the credential of the subscriber comprises identity binding, a permission structure related to a policy and ticket information corresponding to a use behavior in a certain time; The trusted certificate authority generates an obfuscated use frequency aggregation value according to the ticket information in a certain epoch; The credential of the subscriber, information obtained based on the obfuscated use frequency aggregation value and a random number are packaged to the subscriber, and a permission public key based on identity hash is saved.

4. The user credential verification method based on a revisable signature according to claim 1, wherein, The subscriber edits the certificate of the subscriber, comprising the following steps: Subscriber determines certificate contents , set , and set wherein, denotes the th subscriber message, denotes the total number of subscriber messages, denotes the set of subscript indices for which the SSP needs information is , denotes the set of subscript indices for which the information needs to be hidden; The subscriber edits the certificate, thereby generating : wherein, represents for each attribute in the set of hidden attributes a constructed group element aggregation for obfuscating the hidden attribute, represents a base in the public parameter for the attribute, represents a clear value of the attribute, belonging to the part of the complete attribute set of the subscriber that is hidden, is a part modeling the interaction between the revealed attributes and the hidden attributes, represents a dual exponent base for establishing a combined mapping between the revealed attributes and the hidden attributes .

5. The user credential verification method based on a revisable signature according to claim 4, wherein, The subscribing service provider verifies the certificate and the credential of the subscriber to determine the legality of the identity of the subscriber and the compliance of the subscribing behavior of the subscriber in the process in which the subscriber interacts with the subscribing service provider, comprising the following steps: The subscriber sends to the subscription service provider a message containing credentials, a request for a set of attributes to be revealed, and a set of attributes to be hidden The constructed group element aggregation, the portion modeling the interaction between the revealed attributes and the hidden attributes, and the ticket information message; calculating permission evidence of the subscriber according to the ticket information; verifying whether the credential of the subscriber contains the ticket presented this time, and verifying whether the subscriber revises the certificate correctly.

6. The user credential verification method based on a revisable signature according to claim 3, wherein, The method further comprises the following step:

7. The user credential verification method based on a revisable signature according to claim 6, wherein, When the subscriber is reported for misbehavior, the trusted certificate authority identifies the identity of the subscriber through a current subscribing commodity exchange process. When the subscriber is reported for misbehavior, the trusted certificate authority identifies the identity of the subscriber through a current subscribing commodity exchange process, comprising the following steps: calculating a permission public key according to identity binding, a permission structure related to a policy, a permission key and a maximum use frequency limit allowed by the subscriber in the credential of the subscriber in the current subscribing commodity exchange process; 8. A distributed anonymous credential system based on revisable signatures, characterized in that, identifying the identity of the subscriber according to whether the calculated permission public key is equal to a permission public key based on identity hash saved. The method comprises the following steps: a system initialization module, configured to perform a system initialization step, comprising the following steps: a trusted certificate authority generates secret parameters and public parameters, saves the secret parameters, and publishes the public parameters; The certificate issuing module is configured to perform a certificate issuing step, including: a trusted certificate authority interacting with the subscriber, generating a certificate of the subscriber based on the public parameter, sending the certificate to the subscriber, and saving a message signature to a bulletin board, wherein the certificate of the subscriber includes certificate content and the message signature. The credential issuing module is configured to perform a credential issuing step, including: a trusted certificate authority interacting with the subscriber, generating a credential of the subscriber based on the secret parameter and the public parameter, and the credential containing a restriction on the subscriber. The certificate revising module is configured to perform a certificate revising step, including: the subscriber revising the certificate of the subscriber. The certificate verifying module is configured to perform a certificate verifying step, including: in the process of the subscriber interacting with a subscription service provider, the subscription service provider verifying the certificate and the credential of the subscriber to determine the legality of the identity of the subscriber and the compliance of the subscription behavior.

9. A computer-readable storage medium, characterized in that, A computer program is stored thereon, which is executed by a processor to implement the user credential verification method based on revisable signature as claimed in any one of claims 1 to 7.

10. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the user credential verification method based on revisable signature as claimed in any one of claims 1 to 7.

Images