Anonymous voucher method oriented to Internet of Vehicles and based on cocout signature

Abstract

The invention discloses an anonymous certificate method based on a cocout signature for the Internet of Vehicles, and the method comprises the steps: enabling a vehicle user to selectively display the attributes of a certificate according to the requirements of a service scene, and providing an anonymous certificate issued by a corresponding issuer to prove that the vehicle user has a qualified access service, and does not need to leak more information to a service provider. The non-linkability of multi-time disclosure of a vehicle user is realized; the method is realized through system model initialization, authority center key generation, authority mechanism key updating, voucher issuing, voucher aggregation, voucher presentation and voucher verification in sequence. The method can meet various security requirements of anonymity, unlinkability, unforgeability and the like, and has better comprehensive performance.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of anonymous credentials of Internet of Vehicles, and particularly relates to an anonymous credential method based on coconut signature for Internet of Vehicles. BACKGROUND

[0002] With the progress of science and technology and the rapid development of mobile communication technology, the automobile industry of countries around the world is also rapidly developing in the direction of informatization, networking and intelligentization, and gradually evolving into an intelligent transportation system of smart travel and transportation digitization. Vehicular Ad hoc NETwork (VANET) as an important component of intelligent transportation is a dynamic network in which vehicles, pedestrians, road units or other various infrastructures transmit messages and share data through modern wireless communication technology. Various vehicle-mounted sensors, controllers and actuators on vehicles enable vehicles to perceive the road environment and make intelligent decisions and collaborative control with people. A large number of vehicle-related service providers have also emerged, and vehicle users can obtain various personalized services through different service providers to improve convenience, experience and road traffic safety.

[0003] However, in the existing communication authentication mechanism, users usually need to provide complete information to service providers. This will lead to unnecessary leakage of data information provided by vehicle users. When vehicle users provide sensitive data such as vehicle identity and location to application services, malicious service providers can associate key data in these information with various historical behaviors of vehicles to extract their lifestyle, track vehicles, threaten the safety of vehicles, and make the entire Internet of Vehicles system face various privacy leakage and security problems. In order to solve the problem of illegal leakage and abuse of user privacy, various anonymous authentication technologies have become the research direction of more and more scholars. Anonymous credentials are an authentication technology that can effectively protect user information. Anonymous credentials allow users to prove to service providers that they have identity credentials belonging to a certain user set (a set of qualified users who can access services) according to the needs of a specific scenario. At the same time, the service provider cannot identify which specific member in the specific user set the user belongs to. Therefore, applying anonymous credentials to the Internet of Vehicles scenario can enable vehicles to remain anonymous when communicating with Internet of Vehicles services and not expose specific vehicle identity information, allowing vehicles to prove that they belong to an authorized set without revealing specific vehicle identity. In this way, vehicles can obtain access to services, and service providers only know whether vehicles meet the access conditions, which helps to protect the privacy of vehicle owners, prevent sensitive information such as individual vehicle trajectories from being abused, and also reduces the possibility of malicious attackers obtaining individual vehicle information.

[0004] Anonymous credential system is composed of credential issuer, credential verifier and prover. The credential issuer issues the relevant credentials to the prover, and then the prover proves to the credential verifier that he has a legal credential without revealing any additional information about himself. Chaum first proposed the concept of anonymous credentials in 1985. Later, Brands et al. proposed a credential issuance and presentation scheme based on blind signature and PKI certificate. Camenisch and Lysyanskaya proposed a credential scheme with optional anonymous revocation based on strong RSA assumption, which realizes the unlinkability between credentials by using zero-knowledge proof. Based on the above two prototype schemes, U-Prove system and Idemix system are constructed, and blind signature technology is used in U-Prove system. In recent years, with the development of bilinear function encryption technology, many anonymous credential systems based on bilinear pair are proposed by taking advantage of the characteristics of bilinear pairing technology in simplifying signature construction. Camenisch et al. use group signature technology to construct an efficient and provably secure CL signature from a bilinear group and apply it to an anonymous credential system. Similarly, a non-interactive proof anonymous credential is constructed by using bilinear function group, which can enable users to effectively prove that they have attribute credentials. At the same time, many anonymous credential schemes applied to specific scenarios have also been proposed. Among them, De Fuentes et al. introduced the application and feasibility of anonymous credential technology for protecting the privacy of intelligent city road traffic safety services. In the literature, three representative anonymous credential systems are applied to VANETs scenarios, including Idemix, U-Prove and Persiano system. The results show that these anonymous credential technologies are feasible in VANETs.

[0005] Anonymous credential technology can be used as a potential solution to realize the privacy protection authentication between entities in intelligent transportation system. Sonnino et al. combined blind signature technology and secret sharing technology to propose a distributed threshold blind signature distribution scheme with selective disclosure of credential attributes, thereby constructing the Coconut system. Coconut has the characteristics of unforgeability, anonymity, unlinkability, etc., and can effectively meet the security requirements of vehicle networking system communication. SUMMARY

[0006] In view of the above, the present application provides an anonymous credential method based on coconut signature for vehicle networking.

[0007] The anonymous credential method based on coconut signature for vehicle networking provided by the present application comprises the following steps:

[0008] Step 1: System model initialization.

[0009] The initialization algorithm is implemented by using a bilinear mapping to generate the bilinear mapping and related parameters; according to input security parameters, a prime number p with bit length λ is generated, a bilinear pairing group e: G1 x G2 → G of order p is selected, system public parameters params = (G1, G2, GT, p, g1, g2, h1) are obtained; (g1, h1) and g2 are the generators of G1 and G2 respectively. T , g2 are the generators of G1 and G2 respectively.

[0010] Step 2: Authority Key Generation.

[0011] Executed by the certificate issuing agency CA, the key ski and the verification public key vki are generated, the system public parameters params are input, and the values of t and n are set, n is the number of authorized centers, and t is the threshold value of user certificate aggregation.

[0012] Two polynomials v and w with degree t-1 are selected, whose coefficients are in F p ; using the principle of secret sharing, the private keys ski of the selected n authorities are set as (x i , y i ) = (v(i), w(i)), i ∈ [1,..., n], and all authorities and users are not aware of (x, y) = (v(0), w(0)); The verification key vki is (g2, X i , Y i ), and vki is disclosed on the blockchain.

[0013] Step 3: Authority Key Update.

[0014] When a new authority joins or exits, input the number of updated authorities n and the list of new authorities new_authorities and removed_authorities, generate a random polynomial with degree t-1 for each new authority, the coefficients of this polynomial will be used to generate new shares; for each new polynomial, calculate its polynomial value at the updated n points to get the new share; these shares will be added to the existing shares of the authorities; finally, add the shares of the new authorities to ski and vk, and update the corresponding verification key.

[0015] Step 4: Certificate Issuance.

[0016] When the vehicle OBU prepares to request access services from the intelligent transportation system, it needs to obtain the corresponding legal access credentials from the authority issuing the credentials. The issuer will issue different types of access service anonymous credentials according to the corresponding attributes of the vehicle, the service name to be accessed, the service permission level obtained, and the vehicle type attribute. The vehicle user requests the service to be accessed by aggregating and re-randomizing these anonymous credentials and selectively displaying attributes. The user proves different attributes and interacts with the CA to realize the process of credential issuance.

[0017] Step 5: Certificate aggregation.

[0018] The user selects t from n different authority-issued certificates for aggregation (σ1, …, σ t )→(σ), n / 2<t<n; Let the credential σ i =(h, b'(a' -d )=(h, s i ), i∈[1, …, t] Reconstruct the credential σ=(h, s) that meets the conditions by using the shamir secret sharing principle of t different credentials, wherein the user selects the aggregated attribute credentials according to the verification policy issued by the service provider.

[0019] Here, a t-1 order polynomial is constructed as follows:

[0020] f(x)=s0+s1x+s2x 2 +…+s t X t-1 (mod p)

[0021] Set the coefficients of the polynomial as l i When x=0, the following formula is obtained:

[0022]

[0023] Through the coefficient l i , the following can be constructed:

[0024]

[0025] Therefore, the aggregated credential is

[0026] Step 6: Certificate presentation.

[0027] The user selects the relevant attribute m i according to the requirements of the service provider, and generates a zero-knowledge proof π to prove that m i satisfies the requirements of the attribute constraint set . The user analyzes σ=(h, s), selects two random numbers r' and Compute σ" = (h', s') = (h r′ , s r′ ), and aggregate the public keys vkj of the related authorities to get vk = (g2, X, Y) according to the selected attributes, and compute v = (h') r The introduction of random numbers can avoid the brute force problem of the verifier; finally output

[0028] Step 7: Certificate verification.

[0029] After the service provider obtains the user's certificate, the verification key vk and the attribute constraint set are used to verify the zero-knowledge proof π, if e(h', k) = e(s'v, g2), the certificate is valid, output true, otherwise, output false, and the service provider will not provide related services for the user.

[0030] Further, the system model includes 3 types of entities:

[0031] (1) Authority set: responsible for issuing certificates to vehicle users, undertaken by regional vehicle registration authorities, vehicle manufacturers, public administrative entities or any service providers, the specific entity involved depends on the ITS service considered.

[0032] (2) Vehicle user: as the prover in the anonymous certificate scheme, represented by the vehicle and the driver; first, the user needs to prove identity to the certificate issuer, in order to protect privacy, take zero-knowledge proof to obtain a valid attribute certificate; then, based on the idea of aggregate signature, aggregate multiple different certificates into an effective certificate; finally, in the certificate presentation phase, prove to the service provider that he has a legal certificate of multiple attributes from multiple issuers, and then obtain services from the service provider through the certificate.

[0033] (3) Service provider: the certificate verifier, undertaken by RSU, other vehicles, and service providers; responsible for setting access policies for the services or resources it provides, verifying the validity of the certificate presented by the user who applies for services or resources, if the verification is passed, the service or resource is provided, otherwise the user's request is rejected.

[0034] Further, the certificate issuance process is as follows:

[0035] (1) The user first encrypts the attribute for which the certificate needs to be issued.

[0036] The user randomly selects an integer d, d∈F p , generates an El-Gamal key pair Then randomly select r∈F p , calculate the commitment c to attribute mm , Next, select a hash function H on the G1 group and calculate h = H(c m Then, k∈F is randomly selected. p The attributes are encrypted using the El-Gamal algorithm, as shown in the following formula:

[0037]

[0038] Finally Send to the authoritative center; among them This is the tag information generated for attribute m, π s It is a user-generated zero-knowledge proof, represented as:

[0039] (2) An authoritative institution performs blind signature operations.

[0040] Authoritative institution i analyzes Λ=(γ,c m c, π s ), using γ, c m c verifies and proves π s The correctness of the result is verified; if it is proven invalid, the operation is stopped; if it is proven valid, the operation continues, and the result is set to... Calculate h = H(c) m The authoritative institution uses its own private key ski=(x) i y i ) build The certificate σ after blind signing i ′=(h,c i ') Send to the user.

[0041] (3) The user performs the unblinding operation.

[0042] User analyzes the credentials generated by the authoritative institution through blind signature. i ′=(h,c i Let c' = (a', b'), calculate (h, b'(a')); -d Finally, the deblinded certificate σ is obtained. i = (h, b′(a′)) -d ).

[0043] The beneficial technical effects of this invention are as follows:

[0044] 1. This invention defines a Cocout-based authentication scheme for the Internet of Vehicles (IoV), including an initialization algorithm, a key generation algorithm, and the processes of credential issuance, credential aggregation, and credential verification. In this scheme, vehicle users interact with n different credential issuers to obtain attribute credentials. Then, based on the idea of ​​aggregated signatures, multiple different credentials are aggregated into a single valid credential. Users can then use this credential to authenticate that they possess multiple attributes from multiple issuers. Furthermore, the vehicle user's credential must be jointly completed by at least t (n / 2 < t < n) of the n authorization centers. Therefore, this scheme can resist collusion attacks from at most t-1 authorization centers, exhibiting high security.

[0045] 2. Due to the limitations of the Shamir secret sharing scheme, the Coconut signature scheme of this invention introduces a dynamic key management system to address the issue of key regeneration required when an authorized user rejoins or leaves. Simultaneously, the authoritative institution's key is periodically changed, rendering any leaked subkeys invalid in subsequent periods, thereby improving system security.

[0046] 3. Because blockchain does not rely on a centralized third party, data in the blockchain is stored in a distributed manner across multiple nodes, preventing single points of failure. Furthermore, this solution can utilize zero-knowledge proofs for fast anonymous vehicle authentication in VANET and employ non-linear pair aggregation signatures to achieve rapid batch authentication, effectively reducing the computational load during the authentication process and improving message authentication efficiency.

[0047] 4. The present invention is applied to a distributed threshold scheme for the Internet of Vehicles that can selectively display credential attributes to service providers, and has security attributes such as anonymity, re-randomization and non-linkability. Attached Figure Description

[0048] Figure 1 This is the system model and schematic diagram of the present invention. Detailed Implementation

[0049] The present invention will be further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0050] This invention provides an anonymous credential method for vehicle-to-everything (V2X) networks based on coconut signatures, consisting of eight algorithms: system initialization (Setup), authority key generation (CAKeygen), authority key update (UpdateCAK), credential issuance (IssueCred), credential aggregation (AggCred), key aggregation verification (AggKey), credential proof (ProveCred), and credential verification (VerifyCred). The definitions of each algorithm are as follows:

[0051] 1) Setup(1 λ → (params): The authoritative body inputs the security parameter λ and outputs the system's common parameters params.

[0052] 2) CAKeygen(params)→(sk i vk i (Multiple authoritative CA institutions) i (1≤i≤N) Perform this step respectively to generate the corresponding key sk. i and verify public key vk i .

[0053] 3)UpdateCAK(params,t,updated_n,sk i vk i → (new-authorities): This is executed when a new authority joins or leaves the system, generating a new list of authorities.

[0054] 4) The user interacts with the CA (Certificate Authority), the authoritative body issues credentials to the user, and the user's private attributes satisfy a set of attributes.

[0055] 5) AggCred(σ1, …, σ t )→(σ): The user aggregates multiple credentials into a single valid credential σ.

[0056] 6) AggKey(vk1, ..., vk) i (vk): The service provider aggregates the verification keys generated by t authoritative institutions and synthesizes the complete verification key vk.

[0057] 7) The user generates proof π, proving that its private properties satisfy the attribute set.

[0058] 8) VerifyCred(vk, ∑) → (true / false): The verifier verifies the validity of the user's credentials using the verification key vk.

[0059] Specifically, the following steps are included:

[0060] Step 1: System model initialization.

[0061] System model such as Figure 1 As shown, it includes 3 types of entities:

[0062] (1) Authority set: responsible for issuing certificates to vehicle users, which may be the regional vehicle registration authority, vehicle manufacturer, public administration entity or any service provider, depending on the ITS service being considered.

[0063] (2) Vehicle users: As the proof party in the anonymous credential scheme, they are represented by vehicles and drivers. First, users need to prove their identity to the credential issuer. In order to protect privacy, zero-knowledge proof is used to obtain a valid attribute credential. Then, based on the idea of ​​aggregate signature, multiple different credentials are aggregated into a valid credential. Finally, in the credential presentation stage, users prove to the service provider that they have legal credentials with multiple attributes from multiple issuers, and then obtain services from the service provider through the credential.

[0064] (3) Service provider: i.e. credential verification party, which is the RSU, other vehicle and service provider; responsible for setting access policies for the services or resources it provides, verifying the validity of the credentials presented by the user applying for the service or resources, and providing the service or resources if the verification is successful, otherwise rejecting the user's request.

[0065] The initialization algorithm is implemented using a bilinear mapping to generate the bilinear mapping and related parameters; based on the input security parameters, a prime number p of length λ is generated, and a bilinear pairing group e of order p is selected: G1×G2→G T The system common parameters are obtained as params = (G1, G2, GT, p, g1, g2, h1); (g1, h1) and g2 are the generators of G1 and G2, respectively.

[0066] Step 2: Generating the authoritative central key.

[0067] The process is executed by the Certificate Authority (CA), which generates the key ski and the verification public key vki. The system's common parameters params are input, and the values ​​of t and n are set, where n is the number of authorization centers and t is the threshold value for user credential aggregation.

[0068] Choose two polynomials v and w of degree t-1, whose coefficients are in F p Above; utilizing the principle of secret sharing, for the selected n authoritative centers, set their private key ski to (x i y i )=(v(i), w(i)), i∈[1,…,n], all authoritative centers and users are unaware of (x,y)=(v(0), w(0)); The verification key vki is (g2, X i Y i ), and make vki public on the blockchain.

[0069] Step 3: Authoritative institution key update.

[0070] When a new authority joins or leaves, the system takes the updated number of authorities, n, and the list of newly joined or removed authorities, new_authorities and removed_authorities, as input. For each newly joined authority, a random polynomial of degree t-1 is generated. The coefficients of this polynomial are used to generate new shares. For each new polynomial, its existing polynomial values ​​at the updated n points are calculated to obtain new shares. These shares are then added to the shares of existing authorities. Finally, the new authority's shares are added to sk and vk, and the corresponding verification key is updated.

[0071] Step 4: Issuance of vouchers.

[0072] Before a vehicle's On-Board Unit (OBU) can request access to services from the intelligent transportation system, it needs to obtain the corresponding legal access credentials from the issuing authority. The issuer will issue different types of anonymous access credentials based on the vehicle's attributes, the name of the service to be accessed, the level of service access permission, and the vehicle type. The vehicle user requests the services by aggregating and re-randomizing these anonymous credentials and selectively displaying attributes. The user proves different attributes and interacts with the Certificate Authority (CA) to complete the credential issuance process.

[0073] The specific process for issuing the certificate is as follows:

[0074] (1) The user first encrypts the attributes that need to be issued with credentials.

[0075] The user randomly selects an integer d, d∈F p Generate E1-Gamal key pairs Then randomly select r∈F p Calculate the commitment c for attribute m. m , Next, select a hash function H on the G1 group and calculate h = H(c m Then, k∈F is randomly selected. p The attributes are encrypted using the El-Gamal algorithm, as shown in the following formula:

[0076]

[0077] Finally Send to the authoritative center; among them This is the tag information generated for attribute m, π s It is a user-generated zero-knowledge proof, represented as:

[0078] (2) An authoritative institution performs blind signature operations.

[0079] Authoritative institution i analyzes Λ=(γ,c m c, π s ), using γ, c m c verifies and proves π s The correctness of the result is verified; if it is proven invalid, the operation is stopped; if it is proven valid, the operation continues, and the result is set to... Calculate h = H(c) m The authoritative institution uses its own private key ski=(x) i y i ) build The certificate σ after blind signing i ′=(h,c i ') Send to the user.

[0080] (3) The user performs the unblinding operation.

[0081] User analyzes the credentials generated by the authoritative institution through blind signature. i ′=(h,c i Let c' = (a', b'), calculate (h, b'(a')). -d Finally, the deblinded certificate σ is obtained. i = (h, b′(a′)) -d ).

[0082] Step 5: Voucher aggregation.

[0083] The user selects t certificates from n different authoritative institutions and aggregates them (σ1, ..., σ). t → (σ), n / 2 < t < n; let the voucher σ i = (h, b′(a′)) -d )=(h,s i ), i∈[1,...,t], using t different credentials to reconstruct the credentials σ=(h,s) that satisfy the conditions using the Shamir secret sharing principle, where the attribute credentials selected by the user for aggregation depend on the verification policy published by the service provider.

[0084] The polynomial of order t-1 is constructed as shown in the following equation:

[0085] f(x) = s0 + s1x + s2x 2 +…+s t x t-1 (mod p)

[0086] Set the coefficients of the polynomial to l. i When x = 0 is substituted into the equation, we get:

[0087]

[0088] Through coefficient l i It can be constructed as follows:

[0089]

[0090] Therefore, the aggregated voucher is

[0091] Step 6: Present the voucher.

[0092] The user selects the relevant attributes as required by the service provider. i And generate a zero-knowledge proof π to prove m i Satisfying the set of attribute constraints The requirement is that the user selects two random numbers r′ and r′ by parsing σ=(h,s). Calculate σ″=(h',s')=(h r′ s r′ And based on the selected attributes, aggregate the public keys vki of the relevant authorities to obtain vk = (g2, X, Y), and calculate v = (h') r The introduction of random numbers can avoid the brute-force problem of the verifier; finally, output...

[0093] Step 7: Verify credentials.

[0094] After obtaining the user's credentials, the service provider uses the verification key vk and the attribute constraint set. To verify the zero-knowledge proof π, if e(h′,k)=e(s′v,g2), then the credential is valid and the output is true; otherwise, the output will be false and the service provider will not provide the relevant services to the user.

[0095] The safety performance of the proposed solution is compared with that of different solutions, and the analysis of its safety performance and running time is used as a performance evaluation indicator.

[0096] 1) Safety performance

[0097] Based on the actual security requirements of anonymous authentication, this invention compares the proposed scheme with some other existing anonymous credential schemes. Table 1 shows the comparison results of the four schemes in terms of security objectives. All four schemes satisfy blindness and non-linkability. Among them, only CL signature does not achieve selective disclosure of attributes. The threshold strategy adopted by the scheme proposed in this invention, compared with the other schemes, can enable vehicle users to resist collusion attacks from up to t-1 authorization centers when requesting services from service providers.

[0098] Table 1 Comparison of Safety Objectives

[0099] Scheme Blinding Unlinkability Selective disclosure Threshold policy CL signatures √ √ × × U-Prove √ √ √ × Sanders' scheme √ √ √ × The present scheme √ √ √ √

[0100] The proposed solution also introduces dynamic key updates, which eliminates the need to regenerate all keys when an authorized user rejoins or leaves. Furthermore, periodic key updates reduce the risk of key leakage or intrusion. Therefore, compared to traditional key sharing, dynamic keys offer higher security and flexibility.

[0101] 2) Execution time analysis

[0102] Encryption operations and zero-knowledge construction are the main components of the proposed solution. Table 2 shows the average (μ) and standard deviation of the execution time for the main encryption operations and zero-knowledge construction processes used in this solution. Each operation was tested and run 100 times on an Ubuntu system. Because pairing operations are used in zero-knowledge construction, the encryption operation is much faster than the zero-knowledge proof construction. The zero-knowledge construction results shown in Table 2 are the time taken assuming two private attributes and one public attribute. Since zero-knowledge construction is attribute-dependent, the execution time of the zero-knowledge construction operation will increase as the number of attributes increases.

[0103] Table 2 Running Time Analysis

[0104]

[0105]

[0106] To adapt to the frequently changing scenarios in the Internet of Vehicles (IoV) environment, the proposed solution introduces the Herzberg dynamic key update algorithm to address the issue of needing to regenerate all keys when an authoritative institution rejoins or leaves. Table 3 shows a comparison of the key generation computation time between the proposed solution and the coconut signature scheme when a new authoritative institution leaves or joins.

[0107] Table 3 Comparison of Key Generation Time

[0108]

[0109] The algorithm in Table 3 was run 50 times on the Ubuntu system. The comparison shows that the scheme that introduces the Herzberg dynamic key algorithm can dynamically adapt to changes in the authorizer during system operation, effectively improving the speed of new key generation when an authoritative institution rejoins or leaves.

[0110] This invention addresses the problem of malicious service providers excessively collecting vehicle user information in existing connected vehicle systems, leading to unnecessary leakage of user data. It proposes a coconut signature-based authentication scheme for connected vehicles. This scheme allows vehicle users to selectively present certain attributes to the service provider, providing properties such as non-repudiation, non-linkability, anonymity, and resistance to collusion attacks. Performance analysis also demonstrates that this scheme has certain performance advantages.

Claims

1. A method for anonymous credentials based on Cocout signatures for the Internet of Vehicles, characterized in that, Includes the following steps: Step 1: System model initialization; The initialization algorithm is implemented using a bilinear mapping to generate the bilinear mapping and related parameters. Based on the input security parameters, generate a prime number p of length λ, and select a bilinear pairing group e of order p: G1×G2→G T Thus, the system common parameters are obtained as params = (G1, G2, GT, p, g1, g2, h1); (g1, h1) and g2 are the generators of G1 and G2, respectively. Step 2: Generating the authoritative central key; The process is executed by the Certificate Authority (CA), which generates the key ski and the verification public key vki, inputs the system public parameters params, and sets the values ​​of t and n, where n is the number of authorization centers and t is the threshold value for user credential aggregation. Choose two polynomials v and w of degree t-1, whose coefficients are in F p Above; utilizing the principle of secret sharing, for the selected n authoritative centers, set their private key ski to (x i y i )=(v(i), w(i)), i∈[1,...,n], all authoritative centers and users are unaware of (x,y)=(v(0), w(0)); The verification key vki is (g2, X i Y i ), and make vki publicly available on the blockchain; Step 3: Authoritative institution key update; When a new authority joins or leaves, the system takes the updated number of authorities, n, and the list of newly joined or removed authorities, new_authorities and removed_authorities, as input. For each newly joined authority, a random polynomial of degree t-1 is generated. The coefficients of this polynomial are used to generate new shares. For each new polynomial, its existing polynomial values ​​at the updated n points are calculated to obtain new shares. These shares are then added to the shares of existing authorities. Finally, the new authority's shares are added to sk and vk, and the corresponding verification keys are updated. Step 4: Issuance of vouchers; Before a vehicle's On-Board Unit (OBU) can request access to services from the intelligent transportation system, it needs to obtain the corresponding legal access credentials from the issuing authority. The issuer will issue different types of anonymous access credentials based on the vehicle's attributes, the name of the service to be accessed, the level of service access permission, and the vehicle type. The vehicle user requests the services to be accessed by aggregating and re-randomizing these anonymous credentials and selectively displaying attributes. The user proves different attributes and interacts with the CA to realize the credential issuance process. Step 5: Voucher aggregation; The user selects t certificates issued by n different authoritative institutions for aggregation (σ1,...., σ t ) → (σ), where n / 2 < t < n; Let the credential σ i = (h, b′(a′) -d ) = (h, s i ), i ∈ [1,..., t]. Using the Shamir secret sharing principle, reconstruct a credential σ = (h, s) that meets the conditions from t different credentials. Among them, the attribute credentials selected by the user for aggregation depend on the verification strategy published by the service provider; The polynomial of order t-1 is constructed as shown in the following equation: f(x)=s0+s1x+s2x 2 +...+s t x t-1 (mod p) Set the coefficients of the polynomial to l. i When x = 0 is substituted into the equation, we get: Through coefficient l i It can be constructed as follows: Therefore, the aggregated voucher is Step 6: Present the voucher; The user selects the relevant attributes as required by the service provider. i And generate a zero-knowledge proof π to prove m i Satisfying the set of attribute constraints The requirement is that the user selects two random numbers r' and r' by parsing σ = (h, s). Calculate σ”=(h',s')=(h r ', s r And based on the selected attributes, aggregate the public keys vki of the relevant authorities to obtain vk = (g2, X, Y), and calculate v = (h') r The introduction of random numbers can avoid the brute-force problem of the verifier; finally, output... Step 7: Verify credentials; After obtaining the user's credentials, the service provider uses the verification key vk and the attribute constraint set. To verify the zero-knowledge proof π, if e(h′,k)=e(s′v,g2), then the credential is valid and the output is true; otherwise, the output will be false and the service provider will not provide the relevant services to the user.

2. The anonymous credential method based on Cocout signature for the Internet of Vehicles according to claim 1, characterized in that, The system model includes three types of entities: (1) Authority set: responsible for issuing certificates to vehicle users, which may be the regional vehicle registration authority, vehicle manufacturer, public administration entity or any service provider, depending on the specific ITS service being considered; (2) Vehicle users: as the proof party in the anonymous credential scheme, they are represented by the vehicle and the driver; first, the user needs to prove his / her identity to the credential issuer. In order to protect privacy, zero-knowledge proof is used to obtain a valid attribute credential. Then, based on the idea of ​​aggregated signature, multiple different credentials are aggregated into a single valid credential; finally, during the credential presentation stage, the user proves to the service provider that they possess a legitimate credential with multiple attributes from multiple issuers, and then obtains services from the service provider through the credential. (3) Service provider: i.e. credential verification party, which is the RSU, other vehicle and service provider; responsible for setting access policies for the services or resources it provides, verifying the validity of the credentials presented by the user applying for the service or resources, and providing the service or resources if the verification is successful, otherwise rejecting the user's request.

3. The anonymous credential method based on Cocout signature for the Internet of Vehicles according to claim 1, characterized in that, The specific process for issuing the certificate is as follows: (1) The user first encrypts the attributes of the certificate to be issued; The user randomly selects an integer d, d∈F p Generate El-Gamal key pairs Then randomly select r∈F p Calculate the commitment c for attribute m. m , Next, select a hash function H on the G1 group and calculate h = H(c m Then, k∈F is randomly selected. p The attributes are encrypted using the El-Gamal algorithm, as shown in the following formula: Finally Send to the authoritative center; among them This is the tag information generated for attribute m, π s It is a user-generated zero-knowledge proof, represented as: π s =NIZK{(d, m, r, k): (2) An authoritative institution performs blind signature operations; Authoritative institution i analyzes Λ=(γ,c m ,c,π s ), using γ,c m c Verify and prove π s The correctness of the result is verified; if it is proven invalid, the operation is stopped; if it is proven valid, the operation continues, and the result is set to... Calculate h = H(c) m The authoritative institution uses its own private key ski=(x) i y i ) build The certificate σ after blind signing i ′=(h,c i Send to the user; (3) The user performs the unblinding operation; User analyzes the credentials generated by the authoritative institution through blind signature. i ′=(h,c i Let c' = (a', b'), calculate (h, b'(a')). -d Finally, the deblinded certificate σ is obtained. i = (h, b′(a′)) -d ).

Images