A personnel data verification method and system based on zero-knowledge proof

Abstract

The application discloses a personnel data verification method and system based on zero-knowledge proof, and relates to the technical field of data verification.The method specifically comprises the following steps: obtaining user credit data and work information, calculating the initial credentials of the user based on the user credit data and the work information, calculating the randomized pseudonym according to the initial credentials of the user, and calculating the randomized signature, the binding commitment and the proof digest of the randomized pseudonym through zero-knowledge proof, combining the randomized signature, the binding commitment and the proof digest to construct a verifiable assertion, verifying the norm boundedness, the linear relationship consistency and the equivalent relationship of the verifiable assertion respectively, and judging whether the personnel data verification passes or not.The application improves the verification efficiency and the accuracy of personnel data verification.

Description

Technical Field

[0001] This invention relates to a method and system for verifying personnel data based on zero-knowledge proofs, belonging to the field of data verification technology. Background Technology

[0002] In recent years, individuals and businesses have begun to pay more attention to information security issues, and the demand for verification of personal information, such as identity information, health certificates, credit records, and evaluation information, has increased dramatically in government affairs, recruitment, and other scenarios. Traditional data verification methods are carried out by each institution itself, requiring users to repeatedly submit and verify the same data every time they go to a new institution, which is a cumbersome and inefficient process.

[0003] In existing technologies, zero-knowledge proofs can ensure the validity of proofs by two untrusted parties without revealing the information itself or any other additional information. However, current verification processes require a trusted setup phase to generate a common reference string for the computational circuit. This phase increases the verification time overhead and is not conducive to verification management, resulting in low verification efficiency and poor verification results. Summary of the Invention

[0004] The purpose of this invention is to provide a personnel data verification method and system based on zero-knowledge proof, so as to solve the problems of low verification efficiency and poor verification effect in the prior art.

[0005] To solve the above-mentioned technical problems, the present invention is implemented using the following technical solution.

[0006] A method for verifying personnel data based on zero-knowledge proofs, comprising:

[0007] Obtain user credit data and employment information;

[0008] Calculate the user's initial credentials based on user credit data and employment information;

[0009] Randomized pseudo-names are generated based on the initial credentials, and verifiable assertions are constructed on the randomized pseudo-names using zero-knowledge proofs.

[0010] Verifiable assertions are used to determine whether personnel data verification passes. If the verifiable assertion is successful, the personnel data verification passes; if the verifiable assertion fails, the personnel data verification fails.

[0011] Specifically, the user's initial credentials are calculated based on user credit data and employment information, including:

[0012] Extract the credit attributes from the user credit data and work information, and generate a credit attribute vector by combining it with preset attribute selection rules;

[0013] Randomly select prime numbers and finite fields of prime order. Within the finite field, use the prime numbers as the modulus to determine the elliptic curve and its base points. Use the prime numbers and 1 as upper and lower bounds to uniformly and randomly generate private keys. Multiply the private key by the base points by a scalar to obtain the public key.

[0014] Based on the base point and prime number, the elliptic curve points are obtained by scalar multiplication. The x-axis coordinates of the elliptic curve points are extracted and combined with the hash commitment of the credit attribute vector and the private key to obtain the signature value.

[0015] Obtain the current timestamp and the identifier of the computer, serialize the signature value, public / private key pair, current timestamp and the identifier of the computer into a byte stream, and encode the hash value of the byte stream into the initial credential.

[0016] Specifically, randomized pseudo-names are generated based on the initial credentials, and verifiable assertions are constructed on the randomized pseudo-names using zero-knowledge proofs, including:

[0017] The initial voucher is mapped to a polynomial ring, a message polynomial is constructed based on the polynomial ring, the message polynomial is blinded and an error term is added to obtain a randomized pseudo-name.

[0018] Based on randomized pseudonyms and initial credentials, an arithmetic circuit is constructed by combining logic gates, and linear constraint transformations are used to generate satisfiability constraints on the lattice basis.

[0019] Based on the satisfiability constraint, a public matrix and a composite vector are constructed, and a lattice basis reduction operation is performed on the public matrix and the composite vector to obtain the target vector.

[0020] Pre-set an error vector, and combine the target vector and the error vector into an initial proof tuple;

[0021] The initial proof tuple is serialized and combined with its probability density to obtain the proof tuple.

[0022] The proof tuple and its hash are combined into an initial verifiable assertion. Based on the initial verifiable assertion, the binding commitment and randomized signature are calculated to generate the final verifiable assertion.

[0023] Specifically, the proof tuple and its hash are combined into an initial verifiable assertion. Based on the initial verifiable assertion, the binding commitment and randomized signature are calculated to generate the final verifiable assertion, including:

[0024] Based on the initial verifiable assertion, preset security parameters and random blinding factor, homomorphic mapping calculation is performed to obtain the binding commitment;

[0025] The first challenge value is obtained by calculating the hash of the binding commitment by embedding a preset first random source;

[0026] Based on the first challenge value and the initial verifiable assertion, perform lattice proxy signing to generate a randomized signature;

[0027] The hash value of the target vector and error vector after being converted into a byte sequence is used as the proof digest. The randomized signature, binding commitment and proof digest are combined to obtain the verifiable assertion.

[0028] Specifically, based on the first challenge value and the initial verifiable assertion, a lattice-based proxy signature is performed to generate a randomized signature, including:

[0029] The first challenge value and the initial verifiable assertion are serialized and mapped to a polynomial ring to construct the message to be signed;

[0030] Calculate the proxy signature based on the message to be signed and the temporary signature key generated through GLONASS authorization;

[0031] A statistical test is performed on the distribution of proxy signatures and the ideal distribution to obtain the statistical distance. The statistical distance and the tolerance of the statistical distance are then sampled by inverse transformation to generate the initial randomized signature.

[0032] The statistical state of the initial randomized signature is transformed into a uniform distribution by probability integral transformation. The initial randomized signature in the uniform distribution is then reorganized to obtain the randomized signature.

[0033] Specifically, based on the message to be signed and the temporary signing key generated through Gridbase authorization, the proxy signature is calculated, including:

[0034] Select a random number and convert it into a byte sequence. Adjust the byte sequence according to its average entropy and frequency. Use the adjusted byte sequence as the proxy key seed.

[0035] Set the dimension as The integer lattice is used, with prime numbers as the order. The base field is determined within the integer lattice, and a temporary signature key is obtained by base expansion based on the proxy key seed and the base field.

[0036] Based on the message hash of the message to be signed, it is mapped to an integer sequence through modulo operation and then expanded into a normalized input vector;

[0037] The signature is calculated by performing a signature calculation on the normalized input vector based on the temporary signature key, and then combined with norm control operations to obtain the proxy signature.

[0038] Specifically, verifiable assertions are used to determine whether personnel data validation passes. If the verifiable assertion succeeds, the personnel data validation passes; if the verifiable assertion fails, the personnel data validation fails. This includes:

[0039] Based on the verifiable assertion and the preset second random source, a second challenge value is constructed through hash calculation;

[0040] Verify the verifiable assertions and the second challenge value to determine whether the personnel data verification passes.

[0041] If the verifiable assertion passes, the personnel data verification passes; if the verifiable assertion fails, the personnel data verification fails.

[0042] Specifically, the verifiable assertions and the second challenge value are validated to determine whether the personnel data validation passes, including:

[0043] Extract the randomized signature from the verifiable assertion, and compute the randomized signature. Norm and The norm is used to determine whether it meets the preset error bound. If it does, the verification continues; otherwise, the verification fails.

[0044] The product of the public matrix and the randomized signature is reduced by the prime factor to obtain the residual vector. Based on the consistency of the linear relationship of the residual vector, it is determined whether to continue verification.

[0045] Extract the binding commitment and proof digest from the verifiable assertion. Based on the proof digest and the second challenge value, construct the first binding commitment using the same homomorphic mapping method as that used to generate the binding commitment. Determine the equivalence relation between the binding commitment and the first binding commitment's bilinear pair value. If the equivalence relation holds, the verification passes; otherwise, the verification fails.

[0046] Specifically, the product of the public matrix and the randomized signature is reduced by the prime factor to obtain the residual vector. Based on the consistency of the linear relationship of the residual vector, it is determined whether to continue verification, including:

[0047] The residual vector is obtained by reducing the product of the public matrix and the randomized signature by the prime factor.

[0048] Normalize each component of the residual vector to obtain the normalized residual vector;

[0049] Using the public matrix as coefficients and the normalized residual vector as the objective value, a linear modular equation is constructed.

[0050] The linear modular equations are subjected to vector reduction, and the reduced basis vectors in the vector reduction result are used as candidate solution vectors.

[0051] Determine the candidate solution vector Norm and If the norm satisfies the error bound, the linear relationship consistency verification passes and continues; otherwise, the verification fails.

[0052] A personnel data verification system based on zero-knowledge proofs includes:

[0053] The data acquisition module is used to acquire user credit data and employment information;

[0054] The proof generation module is used to calculate the user's initial credentials based on the user's credit data and employment information; generate randomized pseudo-names based on the initial credentials; and construct verifiable assertions on the randomized pseudo-names using zero-knowledge proofs.

[0055] The verification module is used to determine whether the personnel data verification is successful by verifying verifiable assertions. If the verifiable assertion verification is successful, the personnel data verification is successful; if the verifiable assertion verification fails, the personnel data verification is unsuccessful.

[0056] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: The present invention generates randomized pseudonyms by calculating the user's initial credentials, performs zero-knowledge proof calculations on the randomized pseudonyms, generates randomized signatures, binding commitments and proof digests, and constructs verifiable assertions, and determines whether the personnel data verification is successful by verifying the verifiable assertions; it solves the problem that the verification process in the prior art requires an additional trusted setup stage, which leads to increased verification time overhead and complex and redundant verification management processes, and improves the verification efficiency and accuracy of personnel data.

[0057] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of this disclosure. Attached Figure Description

[0058] Figure 1 A flowchart of a personnel data verification method based on zero-knowledge proof provided by the present invention;

[0059] Figure 2 A flowchart for generating verifiable assertions provided by this invention;

[0060] Figure 3 The user and organization interaction diagram provided by this invention;

[0061] Figure 4 This invention provides a structural diagram of a personnel data verification system based on zero-knowledge proof. Detailed Implementation

[0062] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations thereof. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0063] The term "and / or" simply describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Additionally, the character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0064] Example 1

[0065] Please see Figures 1-3 This invention provides an embodiment of a personnel data verification method based on zero-knowledge proof, comprising the following specific steps:

[0066] Step S1: Obtain user credit data and employment information.

[0067] It should be noted that the user credit data includes, but is not limited to, identity, social credit score, and historical performance records, while the work information includes, but is not limited to, income, occupation, and professional skills certification. Some of the user credit data and work information may be made public. For example, after a user registers and files with an industry credit alliance, they may receive various evaluation information during their work, and different companies or institutions may access the user's evaluation information.

[0068] Step S2: Calculate the user's initial credentials based on the user's credit data and employment information.

[0069] The specific steps of step S2 are as follows:

[0070] Step S201: Extract the credit attributes of the user credit data and work information, and generate a credit attribute vector by combining the preset attribute selection rules.

[0071] In this embodiment, based on preset attribute selection rules, such as attribute type whitelists and weight allocation tables, the acquired original user credit data and work information are traversed. The attribute name and data source of each piece of original user credit data and work information are extracted. The extracted attribute name and data source are used as composite keys to match the attribute selection rules. When the attribute name and data source match the attribute selection rules, the attribute name and data source are filtered. The data value type and logical conflicts of the matched attribute names and data sources are checked. Invalid, expired, or logically conflicting attribute names and data sources are removed to obtain the filtering results. The filtering results are weighted and normalized to ensure that the semantics of the attributes are clear and the dimensions are consistent. All processed credit attributes are concatenated into a fixed-dimensional credit attribute vector.

[0072] The attribute selection rules shall be set by those skilled in the art based on the actual situation.

[0073] Step S202: Randomly select prime numbers and finite fields of prime order. Within the finite field, use the prime numbers as the modulus to determine the elliptic curve and its base points. Use the prime numbers and 1 as upper and lower bounds to uniformly and randomly generate a private key. Multiply the private key by the base points using a scalar to obtain the public key.

[0074] In this embodiment, a prime number is randomly selected, and a finite field of order raised to the power of the prime number is constructed based on the prime number. The finite field provides an algebraic structure for point operations on the elliptic curve. The selected prime number is used as the modulus in the finite field to determine the equation of the elliptic curve, and a base point on the elliptic curve is selected. The base point is also the generator of the cyclic subgroup of the elliptic curve, and its order is a prime number. The prime number and 1 are used as the upper and lower bounds, respectively. A private key is generated uniformly and randomly within this range. The generated private key is multiplied by the base point using a scalar multiplication operation, that is, by point addition and point doubling operations, another point is calculated on the elliptic curve, and this point is the corresponding public key.

[0075] Step S203: Based on the base point and prime number, obtain the elliptic curve point by scalar multiplication, extract the x-axis coordinate value of the elliptic curve point, and combine it with the hash commitment of the credit attribute vector and the private key to obtain the signature value.

[0076] In this embodiment, a temporary random number is generated based on prime numbers. The temporary random number and the base point are multiplied by a scalar multiplication operation to obtain a temporary elliptic curve point on the curve. The x-axis coordinate value of the temporary elliptic curve point is extracted. The x-axis coordinate value is an integer in a finite field and is used as the randomness commitment and public challenge value in the signature operation. The x-axis coordinate value, the hash commitment of the credit attribute vector, and the private key are used as inputs. The signature value is calculated through modulo operation and hash function. The signature value is used to prove that the credit attribute vector was generated by the holder of the legitimate private key, ensuring the integrity of the attribute data.

[0077] Step S204: Obtain the current timestamp and the identifier of the computer, serialize the signature value, public / private key pair, current timestamp and the identifier of the computer into a byte stream, and encode the hash value of the byte stream into the initial credential.

[0078] In this embodiment, the current timestamp and the identifier of the computing party are obtained. The timestamp is used to identify the exact time when the credential is generated, and the identifier of the computing party is used to identify the entity that performs the calculation and generates the credential. The signature value is converted into an unsigned, big-endian byte array, and the corresponding byte array and its length value are written into a byte stream. The public / private key pair, the current timestamp, and the identifier of the computing party are converted into big-endian byte arrays, and the corresponding byte arrays and their length values ​​are written into a byte stream. Serialization allows participants to parse and reconstruct its content. A hash calculation is performed on the serialized byte stream to generate a fixed-length hash value. The hash value is encoded to obtain the initial credential. By binding various types of information, replay, forgery, or tampering of the initial credential is prevented.

[0079] Step S3: Generate randomized pseudo-names based on the initial credentials, and construct verifiable assertions on the randomized pseudo-names using zero-knowledge proofs.

[0080] The specific steps of step S3 are as follows:

[0081] Step S301: Map the initial voucher to a polynomial ring, construct a message polynomial based on the polynomial ring, blind the message polynomial and add an error term to obtain a randomized pseudo-name.

[0082] In this embodiment, the initial voucher is divided into multiple blocks by bytes, with each block serving as an integer coefficient. Based on these integer coefficients, the highest-order term is generated on the irreducible polynomial quotient ring. The message polynomial is given by N, where N represents the dimension of the polynomial quotient ring. A blinding polynomial is randomly generated based on the irreducible polynomial quotient ring. A ring-based addition operation is performed on the message polynomial and the blinding polynomial to obtain the blinded message polynomial. An error polynomial is randomly generated based on the irreducible polynomial quotient ring. The coefficients of the error polynomial are sampled from a specific distribution with zero mean and small variance, so that its norm is controlled within a bounded range. A ring-based addition operation is performed on the error polynomial and the blinded message polynomial to obtain a randomized pseudonym. Through blinding, the value of the original message polynomial is randomized, making it impossible to directly infer the initial credential information from the blinded result. By adding an error term, the resistance of the randomized pseudonym to cryptanalysis is enhanced.

[0083] Step S302: Based on the randomized pseudonym and initial voucher, construct an arithmetic circuit by combining logic gates, and generate satisfiability constraints on the lattice basis by combining linear constraint transformation.

[0084] In this embodiment, the generation steps of the randomized pseudonym and the verification rules of the initial credential are decomposed into arithmetic operations, such as modular addition, modular multiplication, and hashing. These operations are simulated and combined using logic gates to construct an arithmetic circuit. The input lines of the arithmetic circuit are connected to the secret values ​​such as the original data, blinding polynomial, and error term of the initial credential. The output lines of the arithmetic circuit correspond to the generated randomized pseudonym. The logical relationship of the arithmetic circuit ensures that the output matches the randomized pseudonym only if all secret values ​​are correctly input. Based on the relationship represented by the arithmetic circuit, it is transformed into a set of linear constraint equations. That is, the input-output relationship of each logic gate is represented as one or more linear constraint equations. For example, the multiplication gate is transformed into a linear constraint equation about the multiplier, multiplicand, and product. A lattice related to the linear constraints is constructed based on the linear constraint equations transformed by the arithmetic circuit to generate satisfiability constraints. The satisfiability constraints include the existence of a vector. , Established, ,in, This represents the coefficient matrix determined by the arithmetic circuit structure. Represents the witness vector. This represents the modulo operator. Represents the modulus. Represents the zero vector. express Norm, express Norm, To represent the error boundary, it should be noted that a lattice is a set of points formed by the linear combination of all integer coefficients of a set of linearly independent vectors.

[0085] Step S303: Based on the satisfiability constraints, construct the public matrix and composite vector, and perform lattice basis reduction operation on the public matrix and composite vector to obtain the target vector.

[0086] In this embodiment, a public matrix is ​​constructed based on the coefficient matrix in the satisfiability constraint, and a composite vector is constructed based on the witness vector in the satisfiability constraint. The validity of the witness vector is proved by verifying the linear relationship. The public matrix is ​​reduced by basis reduction, which transforms it into a set of shorter and more orthogonal basis vectors, i.e., the reduced new basis matrix. The reduction process changes the basis properties while keeping the lattice set unchanged, and the composite vector is expressed as a linear combination of the new basis matrices. The target vector is obtained by projection calculation.

[0087] Step S304: Preset the error vector, and combine the target vector and the error vector into an initial proof tuple.

[0088] In this embodiment, by using a preset error vector, the target vector and the error vector are vector-added to generate an initial proof tuple containing valid proof information and noise obfuscation characteristics. The introduction of the error vector makes the final proof tuple mathematically indistinguishable from random noise, ensuring zero-knowledge proof. Through combination operations, it is ensured that the initial proof tuple, while masking information, retains the inherent logic that the original constraint relationship can be verified.

[0089] The error vector shall be set by those skilled in the art according to the actual situation.

[0090] Step S305: Serialize and combine the initial proof tuple with the probability density of the initial proof tuple to obtain the proof tuple.

[0091] In this embodiment, the log probability density of the initial proof tuple is calculated using a probability density function. The log probability density quantifies the likelihood that the current initial proof tuple is an honest generated sample. The initial proof tuple and its log probability density value are converted into byte representations and concatenated to obtain the proof tuple. The probability density function enables the verifier to statistically be certain that the proof tuple was generated by an honest prover according to a preset protocol, rather than being forged by a malicious party, without knowing any secret information.

[0092] Step S306: Combine the proof tuple and its hash into an initial verifiable assertion, calculate the binding commitment and randomized signature based on the initial verifiable assertion, and generate the final verifiable assertion.

[0093] The specific steps of step S306 are as follows:

[0094] Step S3061: Based on the initial verifiable assertion, the preset security parameters and the random blinding factor, perform homomorphic mapping calculation to obtain the binding commitment.

[0095] In this embodiment, the proof tuple is hashed to obtain a hash value. The proof tuple and hash value are combined to form an initial verifiable assertion. A security parameter and a randomization factor are preset. The security parameter defines the security parameter configuration during the calculation, and the randomization factor is used to enhance randomness during the calculation process, ensuring that even for the same initial verifiable assertion, the generated binding commitments are completely different each time. The initial verifiable assertion is converted into a polynomial on an irreducible polynomial quotient ring. The hash value of the initial verifiable assertion is mapped to polynomial coefficients, ensuring that the degree of the polynomial does not exceed the ring dimension specified by the security parameter. The polynomial corresponding to the initial verifiable assertion is added to the randomization factor modulo polynomial and modulo prime to obtain the initial binding commitment. The coefficients of the initial binding commitment are expanded into a vector and multiplied by matrix-vector multiplication with the lattice basis matrix determined by the security parameter to obtain the binding commitment. Through the homomorphic property of homomorphic mapping, the binding commitment can be mapped to another mathematical domain, so that the binding commitment can uniquely correspond to the original verifiable assertion and hide the specific content of the verifiable assertion.

[0096] Safety parameters and random blinding factors are set by those skilled in the art through simulation experiments or according to actual conditions.

[0097] Step S3062: Calculate the hash of the binding commitment by embedding a preset first random source to obtain the first challenge value.

[0098] In this embodiment, the binding commitment is converted to big-endian order to obtain a binding commitment byte stream, which is then divided into binding commitment data blocks. A preset first random source is divided into random blocks. The binding commitment data blocks and random blocks are alternately concatenated to form an embedded mixed byte stream. The hash value of the mixed byte stream is calculated, and the hash value of the mixed byte stream is split into multiple integers. Modulo operations are performed on the integers, and the results of the modulo operations are combined to form the final first challenge value.

[0099] The first random source was set up by those skilled in the art through simulation experiments.

[0100] Step S3063: Perform lattice proxy signing based on the first challenge value and the initial verifiable assertion to generate a randomized signature.

[0101] The specific steps of step S3063 are as follows:

[0102] Step S30631: Serialize the first challenge value and the initial verifiable assertion, and map them to a polynomial ring to construct the message to be signed.

[0103] In this embodiment, the first challenge value and the initial verifiable assertion are serialized into a continuous byte stream. The byte stream is then combined according to the order of the initial verifiable assertion and the first challenge value. The combined byte stream is divided into multiple byte stream blocks, each of which can be represented as an integer less than a prime number. The byte stream blocks are sequentially assigned to the coefficients of a polynomial to generate a polynomial until all byte stream blocks are assigned or the polynomial degree reaches its upper limit. If a byte stream block is too long, it is compressed to a fixed length using a hash function before mapping. If there are not enough byte stream blocks, the remaining coefficients are padded with zeros. The polynomial is used as the message to be signed, and the byte stream is mapped to a polynomial ring. By utilizing the algebraic structure characteristics of operations on the ring, the computational efficiency of the signature operation is improved.

[0104] Step S30632: Calculate the proxy signature based on the message to be signed and the temporary signature key generated through Gridbase authorization.

[0105] The specific steps of step S30632 are as follows:

[0106] Step S30632-1: Select a random number and convert it into a byte sequence. Adjust the byte sequence according to its average entropy and frequency. Use the adjusted byte sequence as the proxy key seed.

[0107] In this embodiment, a sufficiently long random number is selected and converted into an original byte sequence while ensuring its binary representation is complete and consistent. Statistical analysis is performed on the byte sequence to evaluate its average entropy value and the frequency of occurrence of each byte value. The average entropy value is calculated based on the probability of each byte value appearing in the byte sequence. The average entropy value quantifies the overall uncertainty and randomness of the byte sequence. By statistically analyzing the frequency of occurrence of each byte value, the uniformity of the byte sequence distribution can be checked. If the average entropy value or the frequency of occurrence of some byte values ​​is found to deviate significantly from the theoretical expectation, the original byte sequence is adjusted. For byte segments with low average entropy values ​​or abnormal frequencies, randomization operations are used to rewrite and obfuscate them, thereby improving the randomness and uniformity of the original byte sequence. The adjusted byte sequence is used as a proxy key seed. The adjustment operation based on average entropy value and frequency analysis can improve the random quality of the byte sequence, eliminate possible statistical biases or patterns, and make it effectively resistant to key recovery attacks based on statistical analysis.

[0108] Step S30632-2: Set the dimension as Using an integer lattice, prime numbers are used as the order. The base field is determined within the integer lattice. A temporary signature key is obtained by base expansion based on the proxy key seed and the base field.

[0109] In this embodiment, the dimension is set to The integer lattice uses prime numbers as the order of the base field, i.e. the modulus used in lattice operations. The base field is generated within the integer lattice using a set of linearly independent vectors. Based on the proxy key seed and the base field, a basis expansion operation is performed to transform the base field and generate another set of basis vectors related to the proxy key seed. This set of basis vectors is used as a temporary signature key to ensure that only entities holding the same proxy key seed can generate the same temporary signature key. At the same time, it is computationally infeasible to deduce the proxy key seed or the original base field in reverse based on the temporary signature key.

[0110] Step S30632-3: Based on the message hash of the message to be signed, map it to an integer sequence through modulo operation, and expand it into a normalized input vector.

[0111] In this embodiment, the hash value of the message to be signed is calculated to generate a fixed-length message digest. The message digest is used as a high-order integer, and a modulo operation is performed on a prime number to obtain a main integer value in the range [0, prime number - 1]. The main integer value is used as input and expanded into a byte stream. The expanded byte stream is divided into bits so that each group of byte streams can be represented as an integer, and a modulo operation is performed on a prime number to ensure that it is greater than zero and less than a prime number. An integer sequence is generated based on all integers. The dimension of the normalized input vector is preset to n. If the length of the integer sequence is the same as the dimension of the normalized input vector, the integer sequence is used as the normalized input vector. If the length of the integer sequence is less than the dimension of the normalized input vector, the integer sequence is padded with a non-zero constant value 1 to obtain the normalized input vector. If the length of the integer sequence is greater than the dimension of the normalized input vector, the integer sequence is divided into multiple blocks, and the integers in each block are summed and moduloed on a prime number to obtain the normalized input vector.

[0112] The dimensions of the normalized input vector are set by those skilled in the art based on the actual situation.

[0113] Step S30632-4: Perform signature calculation on the normalized input vector based on the temporary signature key, and combine it with norm control operations to obtain the proxy signature.

[0114] In this embodiment, matrix-vector multiplication is performed on the temporary signature key and the normalized input vector, and the initial signature value is calculated using modular arithmetic. The temporary signature key and the initial signature value are then subjected to lattice-based signature verification to obtain a verification vector. A consistency check is performed on the verification vector and the normalized input vector. If each component of the verification vector is equal to the corresponding component of the normalized input vector modulo a prime number, the consistency verification passes, and the initial signature value is used as the proxy signature. If any component of the verification vector is not equal to the corresponding component of the normalized input vector modulo a prime number, the consistency verification fails. Based on the component deviation values ​​between the verification vector and the normalized input vector, an adjustment vector is calculated and mapped to the range [−prime number / 2, prime number / 2) to obtain the normalized adjustment vector. The normalized adjustment vector is calculated with the pseudo-inverse matrix of the temporary signature key to obtain the signature value adjustment amount. The initial signature value is adjusted using the signature value adjustment amount and rescaled to ensure that the norm of the initial signature value is within the effective range. The adjusted initial signature value is used as the proxy signature.

[0115] Step S30633: Perform a statistical test on the proxy signature distribution and the ideal distribution to obtain the statistical distance. Perform inverse transformation sampling on the statistical distance and the tolerance of the statistical distance to generate the initial randomized signature.

[0116] In this embodiment, based on all component values ​​of the proxy signature, a frequency histogram of its actual distribution is plotted, and the probability of occurrence of each value interval is calculated. The theoretical probability within the same value interval is calculated based on the probability density function of the ideal distribution. Based on the actual distribution probability and the ideal distribution probability, a statistical distance value is calculated using the statistical distance formula. If the statistical distance value is less than or equal to the tolerance, the actual distribution of the proxy signature is used as the input for inverse transformation sampling. If the statistical distance value is greater than the tolerance, the probability value is corrected based on the difference between the probability of occurrence of each value interval in the actual distribution and the probability of the corresponding interval in the ideal distribution, so that the actual distribution is close to the ideal distribution. The probability mass of each component of the proxy signature is calculated on the actual distribution and the ideal distribution. Based on the probability mass of the actual distribution and the ideal distribution, inverse cumulative distribution functions are constructed respectively. Probability mapping is performed according to the inverse cumulative distribution function to establish a transformation relationship from the actual distribution to the ideal distribution. The proxy signature is input into the inverse cumulative distribution function of the actual distribution to obtain sampled values. According to the transformation relationship, the sampled values ​​are mapped to the corresponding values ​​in the ideal distribution to generate an initial randomized signature. The division of value intervals is determined according to the numerical range of the proxy signature.

[0117] The tolerance level shall be set by those skilled in the art based on the actual circumstances.

[0118] Step S30634: Transform the statistical state of the initial randomized signature into a uniform distribution through probability integral transformation, and perform bit rearrangement on the initial randomized signature in the uniform distribution to obtain the randomized signature.

[0119] In this embodiment, the cumulative distribution function value of the initial randomized signature is calculated based on the statistical distribution of the initial randomized signature. Based on the cumulative distribution function value, each component value of the initial randomized signature is mapped to a uniform distribution value in the interval [0,1]. The binary bit conversion is performed based on the uniform distribution value to obtain a binary bit sequence. The binary bit sequence is interleaved and reassembled. If the length of the binary bit sequence is insufficient during interleaving and reassembly, zeros are padded; if the binary bit sequence is too long during interleaving and reassembly, it is truncated. The reassembled binary bit sequence is converted into an integer value to obtain the randomized signature.

[0120] Step S3064: Convert the target vector and error vector into a byte sequence and use the resulting hash value as the proof digest. Combine the randomized signature, binding commitment, and proof digest to obtain a verifiable assertion.

[0121] In this embodiment, each component of the target vector and the error vector is converted into a fixed-length byte block according to big-endian representation. The byte blocks of all components are concatenated in order to form a complete byte sequence. Based on the byte sequences of the target vector and the error vector, the hash values ​​are calculated separately and then combined hash calculation is performed to finally obtain the proof digest. The randomized signature and the binding commitment are converted into byte sequences respectively. Combined with the proof digest, a verifiable assertion is generated.

[0122] exist Figure 2 In this process, a randomized pseudonym is calculated based on the initial voucher. Based on the randomized pseudonym and the initial voucher, a satisfiability constraint on the lattice basis is generated through logic gate combination and linear constraint transformation. The satisfiability constraint is subjected to lattice basis reduction operation to obtain the target vector. Using the target vector and a preset error vector, the binding commitment, randomized signature and proof digest are calculated respectively to obtain the verifiable assertion.

[0123] Step S4: Determine whether the personnel data verification passes by verifying the verifiable assertion. If the verifiable assertion is successful, the personnel data verification passes; if the verifiable assertion fails, the personnel data verification fails.

[0124] The specific steps of step S4 are as follows:

[0125] Step S401: Based on the verifiable assertion and the preset second random source, construct the second challenge value through hash calculation.

[0126] In this embodiment, the verifiable assertion and the preset second random source are concatenated, and the second challenge value is constructed using the same hash calculation method as that used to generate the first challenge value.

[0127] The second random source is set by those skilled in the art through simulation experiments or according to actual conditions.

[0128] Step S402: Verify the verifiable assertion and the second challenge value to determine whether the personnel data verification is successful.

[0129] The specific steps of step S402 are as follows:

[0130] Step S4021: Extract the randomized signature from the verifiable assertion and calculate the randomized signature. Norm and The norm is used to determine whether it meets the preset error bound. If it does, the verification continues; otherwise, the verification fails.

[0131] In this embodiment, a randomized signature field is extracted based on the data structure of the verifiable assertion. The randomized signature field is then deserialized to restore the original randomized signature. Based on the restored randomized signature, calculations are performed... Norm and Norm, calculation When calculating the norm, first calculate the square of each component, then sum the squares of all components and calculate the square root to obtain the result. Norm value, calculation When determining the norm, iterate through the absolute values ​​of all components and find the largest absolute value as the norm. Norm value, Norm and The norm is compared with a preset error bound, where the preset error bound includes... Norm error bound and Norm error bound ,like Norm value less than or equal to and Norm value less than or equal to Then continue to verify, if Norm value greater than and Norm value greater than If not, the verification will fail.

[0132] The error limits shall be set by those skilled in the art based on the actual circumstances.

[0133] Step S4022: Reduce the product of the public matrix and the randomized signature by the prime factor to obtain the residual vector. Based on the consistency of the linear relationship of the residual vector, determine whether to continue verification.

[0134] The specific steps of step S4022 are as follows:

[0135] Step S40221: Reduce the product of the public matrix and the randomized signature by the prime factor to obtain the residual vector.

[0136] In this embodiment, matrix-vector multiplication is performed on the public matrix and the randomized signature to obtain an initial residual vector. Each component of the initial residual vector is reduced by a prime factor to make the result fall within the interval [0, prime factor - 1]. The residual vector is generated based on all the reduced component values.

[0137] Step S40222: Normalize each component of the residual vector to obtain the normalized residual vector.

[0138] In this embodiment, each component of the residual vector is centered and reduced to a symmetric interval. If the component is less than (prime number - 1) / 2, the value remains unchanged. If the component is greater than (prime number - 1) / 2, the component is reduced to a normalized interval [0, prime number - 1]. The normalized residual vector is obtained. The normalization process can eliminate the potential magnitude difference between different components and maintain the same linear relationship characteristics as the original residual vector, providing a standardized input for the construction of the linear modular equation.

[0139] Step S40223: Construct a linear modular equation using the public matrix as coefficients and the normalized residual vector as the objective value.

[0140] In this embodiment, the public matrix is ​​used as the coefficient matrix of the linear modular equation, and the normalized residual vector is used as the target value vector of the linear modular equation to construct the linear modular equation.

[0141] Step S40224: Perform vector reduction on the linear modular equations and use the reduced basis vectors in the vector reduction result as candidate solution vectors.

[0142] In this embodiment, a corresponding lattice is constructed based on the linear modular equation. By incorporating the prime factor condition into the lattice, an integer lattice of dimension L is generated. For example, the linear modular equation is expressed as follows: Then the lattice is composed of all satisfying vector Composition, in which, Represents the coefficient matrix. Represents a point on grid L. Represents the target value vector. Represents modulo prime number operations. Let prime numbers represent the basis of the linear modular equation. The basis vectors in the lattice are optimized by lattice basis reduction. The basis vectors in the lattice are orthogonally processed to calculate the orthogonal basis. According to the length and orthogonality of the orthogonal basis, vector swapping and length reduction operations are performed. The iteration is repeated until the preset maximum number of iterations is reached. The reduced basis vectors are checked for consistency of prime numbers. The shortest vector is selected as the candidate solution vector. The reduction process can improve the orthogonality and length characteristics of the basis vectors, making the final candidate solution vector easier to verify.

[0143] The maximum number of iterations can be set by those skilled in the art through simulation experiments or according to actual conditions.

[0144] Step S40225: Determine the candidate solution vector Norm and If the norm satisfies the error bound, the linear relationship consistency verification passes and continues; otherwise, the verification fails.

[0145] In this embodiment, the candidate solution vector is calculated using the same norm calculation method as that used to calculate the randomized signature norm. Norm and Norm, which represents the candidate solution vector Norm and Comparing norm and error bound, where error bound includes Norm error bound and Norm error bound ,like Norm value less than or equal to and Norm value less than or equal to If the linear relationship consistency verification passes, the verification continues. Norm value greater than and Norm value greater than If not, the verification will fail.

[0146] Step S4023: Extract the binding commitment and proof digest from the verifiable assertion. Based on the proof digest and the second challenge value, construct the first binding commitment using the same homomorphic mapping method as that used to generate the binding commitment. Determine the equivalence relationship between the binding commitment and the first binding commitment's bilinear pair value. If the equivalence relationship holds, the verification passes; otherwise, the verification fails.

[0147] In this embodiment, the binding commitment and proof digest are extracted from the verifiable assertion, deserialized according to the big-endian rule, and a first binding commitment is constructed using the same homomorphic mapping method as that used to generate the binding commitment, based on the proof digest and the second challenge value. A cyclic addition group is selected from the finite field. ,Will Represented as The generators are obtained through bilinear pair functions. Calculate separately The bilinear pair value of the binding commitment is obtained. ,in, Represent the cyclic addition group, calculate The bilinear pair value of the first binding commitment is obtained. ,judge and The equivalence relation is determined by the pairing of two commitment values. If the equivalence relation holds, the verification passes; if the equivalence relation does not hold, the verification fails. Using bilinear pairing to determine the equivalence relation allows verification of the equivalence relation between two commitment values ​​without exposing the original data.

[0148] Step S403: If the verifiable assertion verification passes, the personnel data verification passes; if the verifiable assertion verification fails, the personnel data verification fails.

[0149] In this embodiment, verifiable assertions ensure that the entire verification process always adheres to the core requirement of zero-knowledge proofs: not disclosing the original data.

[0150] exist Figure 3 In this scenario, Institution A generates an initial credential based on the user's credit data and employment information, and sends the initial credential to the user. After receiving the initial credential, the user calculates a verifiable assertion using zero-knowledge proof and sends the verifiable assertion to Institution B. Institution B verifies the verifiable assertion to determine whether the user's personnel data is valid and informs the user of the verification result. Institution A and Institution B belong to an industry credit alliance.

[0151] Example 2

[0152] Please see Figure 4 The present invention provides an embodiment of a personnel data verification system based on zero-knowledge proof, comprising a data acquisition module, a proof generation module, and a verification module.

[0153] The data acquisition module is used to obtain user credit data and employment information.

[0154] The proof generation module is used to calculate the user's initial credentials based on the user's credit data and employment information; generate randomized pseudo-names based on the initial credentials; and construct verifiable assertions on the randomized pseudo-names using zero-knowledge proofs.

[0155] The verification module is used to determine whether the personnel data verification is successful by verifying verifiable assertions. If the verifiable assertion verification is successful, the personnel data verification is successful; if the verifiable assertion verification fails, the personnel data verification is unsuccessful.

[0156] In addition, the parts of the technical solutions provided in the embodiments of this application that are consistent with the implementation principles of the corresponding technical solutions in the prior art have not been described in detail, so as to avoid excessive elaboration.

[0157] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A method for verifying personnel data based on zero-knowledge proof, characterized in that, include: Obtain user credit data and employment information; Calculate the user's initial credentials based on user credit data and employment information; Randomized pseudo-names are generated based on the initial credentials, and verifiable assertions are constructed on the randomized pseudo-names using zero-knowledge proofs. Verifiable assertions are used to determine whether personnel data verification passes. If the verifiable assertion is successful, the personnel data verification passes; if the verifiable assertion fails, the personnel data verification fails. The calculation of the user's initial credentials based on user credit data and employment information includes: Extract the credit attributes from the user credit data and work information, and generate a credit attribute vector by combining it with preset attribute selection rules; Randomly select prime numbers and finite fields of prime order. Within the finite field, use the prime numbers as the modulus to determine the elliptic curve and its base points. Use the prime numbers and 1 as upper and lower bounds to uniformly and randomly generate private keys. Multiply the private key by the base points by a scalar to obtain the public key. Based on the base point and prime number, the elliptic curve points are obtained by scalar multiplication. The x-axis coordinates of the elliptic curve points are extracted and combined with the hash commitment of the credit attribute vector and the private key to obtain the signature value. Obtain the current timestamp and the identifier of the computer, serialize the signature value, public / private key pair, current timestamp and the identifier of the computer into a byte stream, and encode the hash value of the byte stream into the initial credential.

2. The personnel data verification method based on zero-knowledge proof according to claim 1, characterized in that, The process of generating randomized pseudo-names based on initial credentials and constructing verifiable assertions on the randomized pseudo-names using zero-knowledge proofs includes: The initial voucher is mapped to a polynomial ring, a message polynomial is constructed based on the polynomial ring, the message polynomial is blinded and an error term is added to obtain a randomized pseudo-name. Based on randomized pseudonyms and initial credentials, an arithmetic circuit is constructed by combining logic gates, and linear constraint transformations are used to generate satisfiability constraints on the lattice basis. Based on the satisfiability constraint, a public matrix and a composite vector are constructed, and a lattice basis reduction operation is performed on the public matrix and the composite vector to obtain the target vector. Pre-set an error vector, and combine the target vector and the error vector into an initial proof tuple; The initial proof tuple is serialized and combined with its probability density to obtain the proof tuple. The proof tuple and its hash are combined into an initial verifiable assertion. Based on the initial verifiable assertion, the binding commitment and randomized signature are calculated to generate the final verifiable assertion.

3. The personnel data verification method based on zero-knowledge proof according to claim 2, characterized in that, The process of combining the proof tuple and its hash into an initial verifiable assertion, calculating the binding commitment and randomized signature based on the initial verifiable assertion, and generating the final verifiable assertion includes: Based on the initial verifiable assertion, preset security parameters and random blinding factor, homomorphic mapping calculation is performed to obtain the binding commitment; The first challenge value is obtained by calculating the hash of the binding commitment by embedding a preset first random source; Based on the first challenge value and the initial verifiable assertion, perform lattice proxy signing to generate a randomized signature; The hash value of the target vector and error vector after being converted into a byte sequence is used as the proof digest. The randomized signature, binding commitment and proof digest are combined to obtain the verifiable assertion.

4. The personnel data verification method based on zero-knowledge proof according to claim 3, characterized in that, The step of generating a randomized signature by performing lattice-based proxy signing based on the first challenge value and the initial verifiable assertion includes: The first challenge value and the initial verifiable assertion are serialized and mapped to a polynomial ring to construct the message to be signed; Calculate the proxy signature based on the message to be signed and the temporary signature key generated through GLONASS authorization; A statistical test is performed on the distribution of proxy signatures and the ideal distribution to obtain the statistical distance. The statistical distance and the tolerance of the statistical distance are then sampled by inverse transformation to generate the initial randomized signature. The statistical state of the initial randomized signature is transformed into a uniform distribution by probability integral transformation. The initial randomized signature in the uniform distribution is then reorganized to obtain the randomized signature.

5. The personnel data verification method based on zero-knowledge proof according to claim 4, characterized in that, The calculation of the proxy signature based on the message to be signed and the temporary signature key generated through GLONASS authorization includes: Select a random number and convert it into a byte sequence. Adjust the byte sequence according to its average entropy and frequency. Use the adjusted byte sequence as the proxy key seed. Set the dimension as The integer lattice is used, with prime numbers as the order. The base field is determined within the integer lattice, and a temporary signature key is obtained by base expansion based on the proxy key seed and the base field. Based on the message hash of the message to be signed, it is mapped to an integer sequence through modulo operation and then expanded into a normalized input vector; The signature is calculated by performing a signature calculation on the normalized input vector based on the temporary signature key, and then combined with norm control operations to obtain the proxy signature.

6. The personnel data verification method based on zero-knowledge proof according to claim 5, characterized in that, The process of determining whether personnel data verification passes by verifying verifiable assertions, whereby personnel data verification passes if the verifiable assertion succeeds and fails if the verifiable assertion fails, includes: Based on the verifiable assertion and the preset second random source, a second challenge value is constructed through hash calculation; Verify the verifiable assertions and the second challenge value to determine whether the personnel data verification passes. If the verifiable assertion passes, the personnel data verification passes; if the verifiable assertion fails, the personnel data verification fails.

7. The personnel data verification method based on zero-knowledge proof according to claim 6, characterized in that, The verification of verifiable assertions and the second challenge value to determine whether the personnel data verification passes includes: Extract the randomized signature from the verifiable assertion, and compute the randomized signature. Norm and The norm is used to determine whether it meets the preset error bound. If it does, the verification continues; otherwise, the verification fails. The product of the public matrix and the randomized signature is reduced by the prime factor to obtain the residual vector. Based on the consistency of the linear relationship of the residual vector, it is determined whether to continue verification. Extract the binding commitment and proof digest from the verifiable assertion. Based on the proof digest and the second challenge value, construct the first binding commitment using the same homomorphic mapping method as that used to generate the binding commitment. Determine the equivalence relation between the binding commitment and the first binding commitment's bilinear pair value. If the equivalence relation holds, the verification passes; otherwise, the verification fails.

8. The personnel data verification method based on zero-knowledge proof according to claim 7, characterized in that, The step of performing modulo prime reduction on the product of the public matrix and the randomized signature to obtain the residual vector, and determining whether to continue verification based on the linear consistency of the residual vector, includes: The residual vector is obtained by reducing the product of the public matrix and the randomized signature by the prime factor. Normalize each component of the residual vector to obtain the normalized residual vector; Using the public matrix as coefficients and the normalized residual vector as the objective value, a linear modular equation is constructed. The linear modular equations are subjected to vector reduction, and the reduced basis vectors in the vector reduction result are used as candidate solution vectors. Determine the candidate solution vector Norm and If the norm satisfies the error bound, the linear relationship consistency verification passes and continues; otherwise, the verification fails.

9. A personnel data verification system based on zero-knowledge proof, used to implement the personnel data verification method based on zero-knowledge proof according to any one of claims 1-8, characterized in that, It includes a data acquisition module, a proof generation module, and a verification module. The data acquisition module is used to acquire user credit data and employment information; The proof generation module is used to calculate the user's initial credentials based on the user's credit data and employment information; Randomized pseudo-names are generated based on the initial credentials, and verifiable assertions are constructed on the randomized pseudo-names using zero-knowledge proofs. The verification module is used to determine whether the personnel data verification is successful by verifying verifiable assertions. If the verifiable assertion verification is successful, the personnel data verification is successful; if the verifiable assertion verification fails, the personnel data verification is unsuccessful.

Images