Group user anonymous identity authentication method based on multi-key homomorphic encryption

Abstract

The present application relates to a kind of group user anonymous identity authentication method based on multi-key homomorphic cipher, belong to computer application technical field, it is suitable for the anonymous identity authentication of group user quantity greater than 2.The method includes: using BFV type (Brakerski-Fan-Vercauteren) ciphertext expansion-free multi-key homomorphic encryption algorithm as basic algorithm, determine legitimate user group in advance and produce the joint public key required by algorithm, the user to be authenticated will select and random binary string with joint public key encryption, then the interaction process between the user to be authenticated and authentication gateway, finally by authentication gateway to legitimate group sends final ciphertext, subsequently through the joint decryption feedback authentication information of legitimate user group, to complete the anonymous authentication of user.The present application considers the relationship between determining group user authentication and distributed decryption, so that authentication gateway cannot know the identity of the user authentication, can realize the anonymous authentication of group user.

Description

Technical Field

[0001] This invention relates to the field of identity authentication technology, and specifically to a method for anonymous identity authentication of group users based on multi-key homomorphic cryptography. Background Technology

[0002] With the rapid development of 5G, the Internet of Things (IoT), and edge computing, the core network, as the hub connecting massive numbers of terminals and cloud services, bears the responsibility of transmitting and processing sensitive data such as user identity, location, and behavior. Traditional identity authentication methods typically require a strong binding between user identity and authentication information, posing a significant risk of privacy leaks. Attackers can eavesdrop on or infiltrate core network nodes to directly link a user's real identity with communication content, thereby enabling precise tracking, data tampering, or commercial abuse. Existing anonymous identity authentication technologies mainly include temporary identifier mechanisms, zero-knowledge proofs, and ring signatures. Temporary identifier mechanisms require the pre-allocation of a large number of identifier lists, resulting in a heavy storage burden; while zero-knowledge proofs offer good privacy, they require a large amount of encryption computation, leading to significant latency and making it difficult to meet the needs of real-time systems; ring signature schemes rely on a trusted center to distribute private keys, posing a single point of leakage risk, and most cannot support dynamic groups or efficient decryption of information.

[0003] In recent years, the development of multi-key fully homomorphic encryption (MKFHE) technology has provided new possibilities for privacy-preserving computation. MKFHE allows different users to directly perform computations on data encrypted with their own keys without decryption, making it particularly suitable for secure multi-party computation scenarios. In 2022, Daza et al. proposed a multi-key fully homomorphic encryption scheme without ciphertext expansion based on the BFV algorithm, significantly improving the efficiency of multi-user ciphertext computation. However, existing MKFHE schemes mainly focus on the encrypted computation of data and the problem of dynamic user joining (multi-hop), without addressing identity authentication, especially for anonymous identity authentication applications. In addition, traditional group authentication schemes typically require a central database to store a large number of user credentials, posing single points of failure and privacy leakage risks.

[0004] Therefore, existing technologies lack a group authentication method that can combine the distributed characteristics of multi-key homomorphic encryption to achieve high efficiency, low storage, and anonymity support. Summary of the Invention

[0005] In view of the above-mentioned technical problems, this invention proposes a group user anonymous identity authentication method based on multi-key homomorphic cryptography. By combining the identity authentication process and the group user distributed decryption process, the identity authentication credential can be decomposed into partial results of all group users, thereby ensuring that the authentication gateway cannot know the specific identity of the user being authenticated, and realizing anonymous authentication of group user identity.

[0006] The technical solution to the technical problem of this invention is: a group user anonymous authentication method based on multi-key homomorphic cryptography, comprising the following steps:

[0007] Step S1: In the preprocessing stage, the system determines the group of users, the number of users is N, and N>2;

[0008] Step S2: The authentication gateway selects the public string 'a' as the public parameter for the group users and sends it to all group users;

[0009] Step S3: Each user i generates a private key sk. i PK with public key i and the first component b of the public key i The message is sent to the authentication gateway, which calculates the federated public key pk.

[0010] Step S4: In the identity anonymization process, the user to be authenticated uses the joint public key pk to encrypt the identity feature id, and obtains the first identity ciphertext ct1.

[0011] Step S5: The authentication gateway uses the federated public key pk to encrypt the random number nonce, obtaining the ciphertext authentication random number ct. non ;

[0012] Step S6: The authentication gateway authenticates ct1 and ct. non Perform ciphertext addition to obtain the ciphertext ct to be broadcast. add And send it to group users;

[0013] Step S7: The user to be authenticated re-encrypts their identity feature ID to obtain a second ciphertext ct2. Then, the ct2 is used to... add Perform a ciphertext subtraction operation with ct2 to obtain the judgment ciphertext ct, and send it to the authentication gateway;

[0014] Step S8: The authentication gateway sends the determined ciphertext ct to all group users for distributed decryption, and each user i calculates part of the decryption result p. i The authentication gateway decrypts the plaintext nonce′ and if nonce = nonce′, then the authentication is successful.

[0015] According to one technical solution of the present invention, the public string 'a' is represented as:

[0016] a∈R q

[0017]

[0018] Where q represents the modulus;

[0019] Represents the set of integers modulo q;

[0020] R q Represents a polynomial ring with modulus q;

[0021] n represents the polynomial ring R. q dimensionality;

[0022] Any a = a0 + a1x + ... + a n-1 x n-1 ∈R q Represent a polynomial; all coefficients in, Represents the real number Rounding down.

[0023] According to one technical solution of the present invention, the private key sk i Represented as:

[0024] sk i =s i ∈R2

[0025]

[0026] In the formula, R2 represents a polynomial ring with a modulus of 2;

[0027] Represent the set {0,1};

[0028] Any a = a0 + a1x + ... + a n-1 x n-1 ∈R2 represents a polynomial; all coefficients a i ∈{0,1};i=0,1,…,n-1;

[0029] First component b i Represented as:

[0030] b i =[-a·s i +e i ] q

[0031] In the formula, [a] q This means that the polynomial a = a0 + a1x + ... + a n-1 x n-1 Each coefficient a i Perform a modulo q operation to make [a] q Each coefficient is in the set middle;

[0032] From the n-ary discrete Gaussian distribution χ n Select error polynomial e i ←χn Calculate the first component b of the public key i Using the public string 'a' as the second component of the public key, we obtain the public key 'pk'. i The public key pk i Represented as:

[0033] pk i =(b i ,a)=([-as i +e i ] q ,a).

[0034] According to one technical solution of the present invention, the authentication gateway uses public key pk i All b i Adding them together, we get the joint public key pk, which is represented as:

[0035]

[0036] The identity feature ID is represented as follows:

[0037] id∈R2

[0038]

[0039] According to one technical solution of the present invention, the first identity ciphertext ct1 is represented as:

[0040] ct1 = (ct1[0], ct1[1])

[0041] Where ct1[0] is represented as:

[0042] ct1[0]=[pk[0]·u+e1+Δ·id] q

[0043] In the formula, Δ represents the scaling factor, denoted as Represents the real number Rounding down; u∈R2;

[0044] Wherein, ct1[1] is represented as:

[0045] ct1[1]=[a·u+e2] q ;

[0046] The random string nonce is represented as:

[0047]

[0048] According to a technical solution of the present invention, the authentication random number ciphertext ct non for:

[0049] ct non =(ct non [0],ct non [1])

[0050] Among them, ct non [0] indicates:

[0051]

[0052] In the formula, u′∈R2;

[0053] Among them, ct non [1] is represented as:

[0054]

[0055] According to a technical solution of the present invention, the ciphertext to be broadcast, ct add The calculation method is as follows:

[0056] ct add =([ct1[0]+ct) non [0]] q ,[ct1[1]+ct non [1] q ).

[0057] According to a technical solution of the present invention, from an n-ary discrete Gaussian distribution χ n The error polynomials e3,e4←χ are selected. n e3 is the third error polynomial chosen by the user to be authenticated, and e4 is the fourth error polynomial chosen by the user to be authenticated. The second identity ciphertext ct2 is calculated using the joint public key pk to encrypt the id. The second identity ciphertext ct2 is represented as:

[0058] ct2 = (ct2[0], ct2[1])

[0059] Where t2[0] is represented as:

[0060] t2[0]=[pk[0]·u″+e3+Δ·id] q

[0061] In the formula, u″∈R2;

[0062] Wherein, ct2[1] is represented as:

[0063] ct1[1]=[a·u″+e4] q .

[0064] According to one technical solution of the present invention, the ciphertext ct is represented as:

[0065] ct = ([ct add [0]-ct2[0]] q ,[ct add [1]-ct2[1]] q ).

[0066] According to a technical solution of the present invention, the partial decryption result p i Represented as:

[0067] p i =[ct[1]·sk i ] q ;

[0068] The plaintext nonce′ is:

[0069]

[0070] In the formula, t≥3;

[0071] The function for rounding the nearest integer is defined as follows: Represent the integer closest to the real number x, if the real number x has The format is given by y, where y is an integer. It represents the most recent odd number.

[0072] Compared with the prior art, the present invention has the following beneficial effects:

[0073] (1) This invention combines the authentication process of the user to be authenticated with the distributed decryption process. During the authentication process, the decryption of the authentication information is integrated into the group. The consistency of the random number string is used to verify whether the user to be authenticated is in the legitimate group, thereby realizing the anonymous authentication of the user to be authenticated.

[0074] (2) Due to the excessive resource consumption and time required for ciphertext expansion and multiplication operations in multi-key homomorphic encryption algorithms, they are not suitable for use in scenarios with frequent interactions. This invention only utilizes the addition (subtraction) operation of ciphertext in BFV-type (no ciphertext expansion) multi-key homomorphic cryptography, which has low time complexity. Under the same parameter selection, the key quantity can be reduced by 75% and the performance can be improved by more than 10 times, enabling fast authentication.

[0075] (3) Traditional group authentication methods require the use of a database to store a large number of legitimate user identity credentials. This invention completes the anonymization of the user identity information to be authenticated through one ciphertext addition and one ciphertext subtraction, ensuring that all authentication information is in a ciphertext state, thereby realizing a fully ciphertext authentication process, and eliminating the need to use a third-party database to store a large number of user authentication credentials in advance, which can reduce storage space.

[0076] (4) This invention can achieve fast anonymous authentication of fixed group users in scenarios such as core network through online interaction, meet the needs of low bandwidth and low storage scenarios, realize anonymous authentication of users to be authenticated, and ensure that identity information is not leaked. Attached Figure Description

[0077] Figure 1 This is a schematic diagram of the group user authentication method of the present invention;

[0078] Figure 2 This is a schematic diagram of the preprocessing stage of the present invention;

[0079] Figure 3 This is a schematic diagram of the identity anonymization process in this invention;

[0080] Figure 4 This is a schematic diagram of the distributed identity authentication stage of the present invention. Detailed Implementation

[0081] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the embodiments will be briefly described below. Obviously, the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any creative effort.

[0082] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. The embodiments cannot be described in detail here, but the embodiments of the present invention are not limited to the following embodiments.

[0083] like Figures 1 to 4 As shown, the present invention provides a method for anonymous authentication of group users based on multi-key homomorphic cryptography, comprising the following steps:

[0084] Step S1: In the preprocessing stage, the system determines the group of users, the number of users is N, and N>2;

[0085] To ensure the authentication scheme achieves 128-qubit security, n=2048 and q=2 can be chosen. 62 χ is here This represents a discrete Gaussian sample with a standard deviation of 2.8 and an expected value of 0. In this example, we assume that the number of users is N = 200.

[0086] Step S2: The authentication gateway selects the public string 'a' as the public parameter for the group users and sends it to all group users;

[0087] The authentication gateway calls a pseudo-random string generation algorithm (such as SHAKE-256) to randomly select a seed and generate n 62-bit random strings, denoted as a0, ..., a0. n-1 ,but Select the common string 'a' as the common parameter for group users; the authentication gateway sends the common parameter to all group users;

[0088] Step S3: Each user i generates a private key sk. i PK with public key i and the first component b of the public key i The message is sent to the authentication gateway, which calculates the federated public key pk.

[0089] For 1≤i≤N, each user i randomly selects a ternary private key after receiving a. That is, each coefficient of the private key is selected from 0, 1, -1. Then the public key pk is calculated. i =([-(a·sk) i +e i )] q a) Each user i will use the first component b i =[-(a·sk i +ei ) ] q The public key is sent to the authentication gateway; the authentication gateway sums the first components of all user public keys to obtain the combined public key. And Send to all users, where e i Sampling can be accomplished using CDT table construction;

[0090] The above steps can be seen as a preprocessing process, which is completed before the authentication process.

[0091] Step S4: In the identity anonymization process, the user to be authenticated uses the joint public key pk to encrypt the identity feature id, obtaining the first identity ciphertext ct1; specifically including:

[0092] In the anonymization phase, BFV-type multi-key homomorphic encryption is chosen as the underlying algorithm; the user to be authenticated selects a random string ID as their identity feature; a multinomial u is randomly selected, derived from an n-ary discrete Gaussian distribution χ. n Selecting the error polynomial e1,e2←χ n e1 is the first error polynomial selected by the user to be authenticated, and e2 is the second error polynomial selected by the user to be authenticated; the first identity ciphertext ct1 is calculated by encrypting the id using the joint public key pk;

[0093] Step S5: The authentication gateway uses the federated public key pk to encrypt the random number nonce, obtaining the ciphertext authentication random number ct. non Specifically, it includes:

[0094] The authentication gateway selects a random string "nonce" as the random number for determination; it randomly selects a multinomial u′ from an n-ary discrete Gaussian distribution χ. n Select error polynomial The first error polynomial chosen for the authentication gateway. The second error polynomial chosen for the authentication gateway is used to calculate the authentication random number ciphertext ct using the joint public key pk to encrypt the nonce. non ;

[0095] Step S6: The authentication gateway authenticates ct1 and ct. non Perform ciphertext addition to obtain the ciphertext ct to be broadcast. add And send it to group users;

[0096] Step S7: The user to be authenticated re-encrypts their identity feature ID to obtain a second ciphertext ct2. Then, the ct2 is used to... add Perform a ciphertext subtraction operation with ct2 to obtain the judgment ciphertext ct, and send it to the authentication gateway; specifically including:

[0097] The user to be authenticated receives ct add Then, a multinomial u″ is randomly selected from the n-variable discrete Gaussian distribution χ. n Selecting the error polynomial e3,e4←χ n e3 is the third error polynomial chosen by the user to be authenticated, and e4 is the fourth error polynomial chosen by the user to be authenticated; the second identity ciphertext ct2 is calculated again using the joint public key pk to encrypt the id. add Perform a ciphertext subtraction operation with ct2 to obtain the judgment ciphertext ct, and send it to the authentication gateway;

[0098] Step S8: In the distributed identity authentication phase, the authentication gateway sends the determined ciphertext ct to all group users for distributed decryption, and each user i calculates part of the decryption result p. i The authentication gateway decrypts the plaintext nonce′ and if nonce = nonce′, then the authentication is successful.

[0099] In some embodiments of the present invention, the public string 'a' is represented as:

[0100] a∈R q

[0101]

[0102] Where q represents the modulus;

[0103] Represents the set of integers modulo q;

[0104] R q Represents a polynomial ring with modulus q;

[0105] n represents the polynomial ring R. q dimensionality;

[0106] Any a = a0 + a1x + ... + a n-1 x n-1 ∈R q Represent a polynomial; all coefficients in, Represents the real number Rounding down.

[0107] In some embodiments of the present invention, the private key sk i Represented as:

[0108] sk i =s i ∈R2

[0109]

[0110] In the formula, R2 represents a polynomial ring with a modulus of 2;

[0111] Represent the set {0,1};

[0112] Any a = a0 + a1x + ... + a n-1 x n-1 ∈R2 represents a polynomial; all coefficients a i ∈{0,1};i=0,1,…,n-1;

[0113] First component b i for:

[0114] b i =[-a·s i +e i ] q

[0115] In the formula, [a] q This means that the polynomial a = a0 + a1x + ... + a n-1 x n-1 Each coefficient a i Perform a modulo q operation to make [a] q Each coefficient is in the set middle.

[0116] In some embodiments of the present invention, the public key pk i for:

[0117] pk i =(b i ,a)=([-as i +e i ] q ,a).

[0118] In some embodiments of the present invention, the authentication gateway uses the public key pk i All b i Add them together to get the joint public key pk:

[0119]

[0120] The identity feature ID is:

[0121] id∈R2

[0122]

[0123] In some embodiments of the present invention, the first identity ciphertext ct1 is:

[0124] ct1 = (ct1[0], ct1[1])

[0125] Among them, ct1[0] is:

[0126] ct1[0]=[pk[0]·u+e1+Δ·id] q

[0127] In the formula, Δ represents the scaling factor, denoted as Represents the real number Rounding down; u∈R2;

[0128] Wherein, ct1[1] is represented as:

[0129] ct1[1]=[a·u+e2] q ;

[0130] The random string nonce is represented as:

[0131]

[0132] In some embodiments of the present invention, the authentication random number ciphertext ct non for:

[0133] ct non =(ct non [0],ct non [1])

[0134] Among them, ct non [0] is:

[0135]

[0136] In the formula, u′∈R2;

[0137] Among them, ct non [1] is:

[0138]

[0139] In some embodiments of the present invention, the ciphertext to be broadcast, ct add The calculation method is as follows:

[0140] ct add =([ct1[0]+ct) non [0]] q ,[ct1[1]+ct non [1] q ).

[0141] In some embodiments of the present invention, the second identity ciphertext ct2 is:

[0142] ct2 = (ct2[0], ct2[1])

[0143] Among them, ct2[0] is:

[0144] ct2[0]=[pk[0]·u″+e3+Δ·id] q

[0145] In the formula, u″∈R2;

[0146] Among them, ct2[1] is:

[0147] ct1[1]=[a·u″+e4] q .

[0148] In some embodiments of the present invention, the determination of the ciphertext ct is:

[0149] ct = ([ct add [0]-ct2[0]] q ,[ct add [1]-ct2[1]] q ).

[0150] In some embodiments of the present invention, the partial decryption result p i for:

[0151] p i =[ct[1]·sk i] q ;

[0152] The plaintext nonce′ is:

[0153]

[0154] In the formula, t≥3;

[0155] The function for rounding the nearest integer is defined as follows: Represent the integer closest to the real number x, if the real number x has The format is given by y, where y is an integer. It represents the most recent odd number.

[0156] According to one aspect of the present invention, a group user anonymous identity authentication system is provided to implement the group user anonymous identity authentication method based on multi-key homomorphic cryptography as described in any of the above technical solutions. The group user anonymous identity authentication system is suitable for anonymous authentication of online fixed groups. By combining distributed decryption and splitting of identity authentication information using multi-key homomorphic cryptography, the efficiency of anonymous identity can be effectively improved and resources reduced.

[0157] According to one aspect of the present invention, an electronic device is provided, comprising: one or more processors, one or more memories, and one or more computer programs; wherein the processor is connected to the memory, and the one or more computer programs are stored in the memory; when the electronic device is running, the processor executes the one or more computer programs stored in the memory to cause the electronic device to perform a group user anonymous authentication method based on multi-key homomorphic cryptography as described in any of the above technical solutions.

[0158] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0159] The memory can be an internal storage unit of the terminal device, such as a hard drive or RAM. Alternatively, it can be an external storage device, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card. Furthermore, the memory can include both internal and external storage units. The memory is used to store the computer program and other programs and data required by the terminal device. It can also be used to temporarily store data that has been output or will be output.

[0160] According to one aspect of the present invention, a computer-readable storage medium is provided for storing computer instructions, which, when executed by a processor, implement a group user anonymous authentication method based on multi-key homomorphic cryptography as described in any of the above technical solutions.

[0161] For example, computer-readable storage media can be read-only memory (ROM), random access memory (RAM), read-only optical disc (CD-ROM), magnetic tape, floppy disk, and optical data storage devices. They can be implemented using computer-executable program code, thus allowing them to be stored in a storage device for execution by a computing device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Therefore, this invention is not limited to any particular hardware and software combination.

[0162] In summary, the group user anonymous authentication method based on multi-key homomorphic cryptography of the present invention performs a mixed operation on the identity information of the user to be authenticated and a random challenge value in ciphertext, making it impossible for the authentication gateway to obtain or infer the user's true identity. During the authentication process, the identity information remains encrypted throughout, and verification is completed jointly by the group users through distributed decryption, completely avoiding the risk of identity information leakage and achieving true anonymous authentication.

[0163] Traditional group authentication schemes require a central database to store the identity credentials or public key certificates of all legitimate users, and the storage overhead increases linearly with the number of users. This invention eliminates the need to pre-store any user identity credentials; it only requires maintaining the federated public key and authentication information in encrypted form, resulting in significantly improved storage efficiency. It is particularly suitable for large-scale groups or environments with limited storage resources.

[0164] This invention employs a BFV-type multi-key homomorphic encryption scheme without ciphertext expansion, using only ciphertext addition and subtraction operations, thus avoiding computationally complex ciphertext multiplication or relinearization operations.

[0165] By using a distributed decryption mechanism, decryption authority is distributed to all group users. The authentication gateway is only responsible for coordination and final verification and cannot complete decryption alone. This not only prevents the authentication gateway from becoming a single point of attack, but also improves the system's robustness and resistance to compromise.

[0166] From identity encryption and random number challenge to response verification, all sensitive operations are completed in encrypted state, achieving end-to-end fully encrypted authentication, which conforms to the best practices of privacy computing and is suitable for highly sensitive scenarios such as core network and edge computing.

[0167] Furthermore, it should be noted that the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code.

[0168] Embodiments of the present invention are described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0169] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing terminal equipment to cause a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0170] It should also be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0171] Finally, it should be noted that the above description represents a preferred embodiment of the present invention. It should be pointed out that although preferred embodiments have been described, those skilled in the art, once they understand the basic inventive concept of the present invention, can make various improvements and modifications without departing from the principles described herein. These improvements and modifications should also be considered within the scope of protection of the present invention. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the embodiments of the present invention.

Claims

1. A method for anonymous authentication of group users based on multi-key homomorphic cryptography, characterized in that, Includes the following steps: Step S1: In the preprocessing stage, the system determines the group of users, and the number of users is... ,and ; Step S2: Select a common string for the authentication gateway. This is a public parameter for group users and is sent to all group users; the public string Represented as: in, Represents the modulus; The modulus is The set of integers; The modulus is a polynomial ring; Represents a polynomial ring dimensionality; any Represent a polynomial; all coefficients ; ; Step S3, Each User Generate private key and public key and the first component of the public key Send to the authentication gateway, which calculates the federated public key. ; Step S4: During the identity anonymization process, the user to be authenticated uses the federated public key. Encrypted identity features Obtain the first identity cipher ; The first identity cipher Represented as: in, Represented as: In the formula, The scaling factor is denoted as . , Represents the real number Rounding down; The first error polynomial selected for the user to be authenticated; ; In the formula, The modulus is a polynomial ring; Represents a set ; in, Represented as: ； in, The second error polynomial selected for the user to be authenticated; random numbers Represented as: ； Step S5: The authentication gateway uses the federated public key. Encrypted random numbers Obtain the authentication random number ciphertext The authentication random number ciphertext for: in, express: In the formula, ; The first error polynomial selected for the authentication gateway; in, Represented as: ； in, The second error polynomial selected for the authentication gateway; Step S6, authentication gateway and Perform ciphertext addition to obtain the ciphertext to be broadcast. And send it to group users; the ciphertext to be broadcast ； Step S7: The user to be authenticated re-encrypts their identity features. Obtain the second identity cipher ,right and Perform a ciphertext subtraction operation to obtain the judgment ciphertext. And send it to the authentication gateway; from Elementary Discrete Gaussian Distribution Select error polynomial ; The third error polynomial selected for the user to be authenticated. The fourth error polynomial selected for the user to be authenticated utilizes the joint public key. encryption The second identity ciphertext is calculated. The second identity ciphertext Represented as: in, Represented as: In the formula, ; in, Represented as: ； The judgment ciphertext Represented as: ； Step S8: The authentication gateway will determine the ciphertext. Send to all group users for distributed decryption, each user Calculate the decryption results The authentication gateway decrypts the plaintext to obtain the judgment. ,like If so, the authentication is successful.

2. The method according to claim 1, characterized in that, The private key Represented as: Then any All coefficients ; ; from Elementary Discrete Gaussian Distribution Select error polynomial Calculate the first component of the public key , will public string As the second component of the public key, we obtain the public key. The public key Represented as: 。 3. The method according to claim 2, characterized in that, The authentication gateway uses the public key. All Add them together to obtain the joint public key. , represented as: ； The identity features Represented as: ； First component Represented as: In the formula, Indicates the polynomial Each coefficient Perform the model Operations, making Each coefficient is in the set middle.

4. The method according to claim 3, characterized in that, The decryption results Represented as: ； The judgment plaintext In the formula, ; The function for rounding the nearest integer is defined as follows: Represents distance from real numbers The most recent integer, if a real number have The format in which If it is an integer, then It represents the most recent odd number.

Images