Method and system for selectively disclosing verifiable credentials based on associated data

Abstract

The invention relates to data security, in particular to a method and a system for selectively disclosing verifiable certificates based on associated data, which are used for solving the problems that the selective calculation amount of the existing verifiable certificates is large, the efficiency is low, the relationship among attributes in the certificates cannot be reflected for a plurality of certificates, and a user is not constrained. According to the scheme, under the framework of the RDF graph, the attributes in the voucher are represented by triples, and a monotone expansion scheme and a linear secret sharing scheme are used for efficiently restraining the attributes which can be selectively disclosed by a user, so that malicious behaviors of the user are prevented; according to the method and the device, attributes in a single voucher can be selectively disclosed, and attribute information association can be carried out after selective disclosure of a plurality of vouchers, so that effective combination of the vouchers can be realized, and meanings to be expressed by the disclosed information can be accurately and efficiently transmitted to a verification party. On the basis, signatures of a plurality of vouchers are aggregated into a BLS signature, so that the purpose of combining the vouchers is achieved.

Description

Technical Field

[0001] This disclosure relates to data security, and in particular to a method and system for selectively disclosing verifiable credentials based on associated data. Background Technology

[0002] With the development of the internet and the explosive growth of data, internet users not only want to manage their identities independently but also desire the ability to selectively disclose their complex attributes in a granular manner to protect data privacy and improve data security. In some scenarios, the information a user needs to present may come from two or more credentials they hold. If users directly hide some attributes from these credentials, a lot of redundant information will be retained, such as the user's name on the credentials. This redundancy wastes storage space and bandwidth and increases the computational load during signature and verification. Furthermore, credential presentation also suffers from the problem of uncontrolled selective disclosure. Once users are granted the right to selectively disclose, they can hide any attribute. Some malicious users may use this to deliberately hide important information to evade verification or legal responsibility. In the medical system, if patients deliberately hide information such as medical history, allergic reactions, or past medication history, doctors may be unable to correctly choose treatment plans. This behavior not only affects the accuracy of medical decisions but may also pose serious risks to the patient's health. Based on the above, how to achieve fine-grained attribute segmentation to represent the complex relationships between credentials, while allowing the issuing party to restrict which attributes users can hide, is a critical problem that urgently needs to be solved.

[0003] This paper presents a selective disclosure method based on BLS-MT-ZKP, combining three approaches for the first time: BLS signatures, Merkle hash trees (MT), and zero-knowledge proofs (ZKP). This achieves a selective disclosure method that meets the requirements of the European Telecommunications Standards Institute (ETSI) regulations. Pedersen commitments obtained from attribute values ​​and salt values ​​are used as leaf nodes of a Merkle hash tree, and BLS signatures are applied to the root node's hash value. When selective disclosure of a specific attribute is required, only the corresponding commitment value can be presented, omitting the attribute value itself, thus achieving selective disclosure. The bulletproof Pedersen commitments not only verify attribute values ​​but also achieve non-associativity through homomorphic values. BLS signatures also support the presentation of combinations of credentials generated by different issuers. Zero-knowledge proofs support verifying whether an attribute value falls within a certain range without disclosing the attribute value itself. However, the selective disclosure of combinations of multiple credentials merely aggregates BLS signatures; it is essentially a mechanical stacking of credential attributes and does not demonstrate the correlation between credentials. When multiple credentials are presented together, the verifier only needs to verify whether the aggregated signature and disclosed attribute information can be used to recover the signature. However, there's a possibility that a user might replace the expiration date in one credential with the one in another, thus intentionally hiding information to evade verification. Even if the user doesn't intend to mislead the verifier, when multiple credentials are presented together, the verifier needs to find the relationships between the credentials to recover the user's intended meaning. This recovery process not only increases the verification workload but also increases the risk of misunderstanding the user's intent.

[0004] In a prior art, for verifying selectively disclosed credentials, verifiers are enabled to flexibly express their needs through logical predicates ("and", "or" predicates) and nested conditions to address situations where verifiers have multiple conditions. In general, this scheme utilizes zk-SNARKs to generate single / multiple zero-knowledge proofs, supporting compliance verification in both on-chain and off-chain dual-verification environments. In single-proof mode, the holder generates a single proof indicating that the requirement is met, while in multi-proof mode, multiple proofs are generated, each showing that a condition is met, and the correctness of all proofs can be checked. Experiments were conducted to evaluate the efficiency of zkSSI in on-chain and off-chain verification, demonstrating its effectiveness even when used in consumer-grade hardware (e.g., personal laptops). However, this scheme uses only basic zero-knowledge proof algorithms for selective disclosure, resulting in relatively low efficiency. Although the constraints on the attributes required by the verifier in the document have been increased, this requirement can only be implemented using the inequality sign to verify the range of attribute values. Using the equality sign and selectively disclosing attributes without it have the same effect. This addition does not reduce the verifier's workload; zero-knowledge proof verification of hidden elements is still required. Only range verification can be applied to certain numerical attributes. Overall, the functional improvement from increasing the constraints on the verifier's requirements is not significant. Furthermore, in the verification of multiple documents, the documents remain isolated, and the problems of the previous solution persist.

[0005] In a prior art, the W3C Verifiable Credential (VC) data model is combined with zero-knowledge proofs (ZKPs) to minimize information disclosure. This approach considers VCs to be essentially Resource Description Framework (RDF) datasets, enabling the application of the following ZKP techniques on RDF datasets: selective disclosure, numerical boundary proofs, and set non-membership proofs—all operations implemented at the RDF terminology level. To preprocess the RDF dataset to support such ZKP applications, two methods are proposed: schema-less and schema-based, and their differences are clarified. A data model for credential presentation and its semantics are proposed, proving that selective disclosure is equivalent to simple implication relations in RDF, and that verifying the presented proof is essentially a validity check of the processed RDF dataset. While the schema-less transformation of the RDF dataset allows for selective disclosure of each RDF term, this transformation generates a message list in the RDF dataset that is five times the length of the number of quadruples. Each quadruple is decomposed into subject, predicate, object value, object suffix, and graph name. Although this achieves refined attribute representation and fine-grained selective disclosure, it introduces data redundancy. Schema-based transformation converts RDF data into a unified whole with an ID suffix. While this reduces data redundancy, predicates, being public knowledge, cannot be hidden; proofs are only allowed for focal terms in datasets dependent on the schema. Therefore, selective disclosure has limitations and lacks flexibility in applying the RDF framework. Furthermore, both schemes' selective disclosure of attributes are implemented using BBS + signature-based knowledge proofs, offering no significant improvement in technical aspects or efficiency compared to previous methods.

[0006] These shortcomings reflect common problems in current research on selective disclosure of verifiable credentials. First, the use of computationally intensive zero-knowledge proof technology as the main means of selective disclosure is inefficient. Second, the simple superposition of multiple credentials after selective disclosure fails to reflect the relationship between attributes in different credentials. Third, users can arbitrarily disclose or hide attributes in credentials without any constraints on user rights. Summary of the Invention

[0007] To address the aforementioned problems in existing technologies, this disclosure aims to propose a method and system for selectively disclosing verifiable credentials based on associated data. Within a self-sovereign identity management framework, it constructs an LSA-Cred scheme for selectively disclosing credentials based on associated data and possessing attribute constraints. This scheme represents attributes in credentials using triples within the RDF graph framework. It efficiently constrains the attributes that users can selectively disclose using a monotonically tensor scheme and a linear secret-sharing scheme, thereby preventing malicious user behavior. Furthermore, it allows for selective disclosure of attributes within a single credential and enables the association of attribute information among multiple credentials after selective disclosure, achieving effective credential combination. Therefore, it can accurately and efficiently convey the intended meaning of the disclosed information to the verifier. Based on this, the signatures of multiple credentials are aggregated into a single BLS signature to achieve the purpose of credential combination.

[0008] To achieve the aforementioned technical objectives, a method for selectively disclosing verifiable credentials based on associated data includes: after credential generation, when a user selectively discloses a credential under the premise of mandatory disclosure attribute constraints, determining the attribute set of the triplet-type data to be disclosed. Attribute constraint validation is performed based on the attributes to be disclosed; if the validation passes, the hidden attributes are removed from the attribute constraints. Delete it from the middle and update the attribute constraint to... The secret share of the attributes to be disclosed remains unchanged, while the secret share of the attributes to be hidden is masked using a mask set. In the process of element replacement, secret shares with the same attribute are replaced with the same mask value, while secret shares with different attributes are replaced with different masks. This process updates the secret shares, resulting in an updated set of secret shares. S' ;Will r Aggregating with hidden attributes and their corresponding secret shares yields Update signature to Selectively disclosed credentials The credential is sent to the verifier; during the credential verification phase, the verifier will send the attribute set. Attributes and attribute constraints The attributes in the attribute constraint are compared and judged. If all attributes in the attribute constraint are in the attribute set, the verification passes; otherwise, the credential is invalid.

[0009] To achieve the aforementioned technical objectives, a selective disclosure verifiable credential system based on associated data includes: a credential selective disclosure module, configured for user use, which, after credential generation, determines the attribute set of triplet-type data to be disclosed when the user selectively discloses the credential, provided that mandatory disclosure attribute constraints exist. Attribute constraint validation is performed based on the attributes to be disclosed; if the validation passes, the hidden attributes are removed from the attribute constraints. Delete it from the middle and update the attribute constraint to... The secret share of the attributes to be disclosed remains unchanged, while the secret share of the attributes to be hidden is masked using a mask set. In the process of element replacement, secret shares with the same attribute are replaced with the same mask value, while secret shares with different attributes are replaced with different masks. This process updates the secret shares, resulting in an updated set of secret shares. ;Will Aggregating with hidden attributes and their corresponding secret shares yields Update signature to Selectively disclosed credentials The credential is sent to the verifier; the credential verification module, configured for the verifier's use, will send the attribute set... Attributes and attribute constraints The attributes in the attribute constraint are compared and judged. If all attributes in the attribute constraint are in the attribute set, the verification passes; otherwise, the credential is invalid.

[0010] The beneficial technical effects of this disclosure are as follows: This scheme allows the issuing authority to impose attribute constraints on users' selective disclosure rights. Since implementing attribute constraints based on selective disclosure of associated data is difficult, this scheme prevents users from maliciously hiding attribute information to mislead or evade verification. The scheme satisfies non-forgeability and privacy, and its efficiency is higher than schemes using zero-knowledge proofs for selective disclosure. These results demonstrate that the LSA-Cred scheme meets the requirements of innovability, security, and effectiveness. Furthermore, this scheme allows for the association of attribute information among multiple credentials after selective disclosure, thereby addressing more complex credential presentation scenarios and broadening the applicability of the scheme. Attached Figure Description To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is the initialization phase of the LSA-Cred scheme in one implementation.

[0012] Figure 2 This is a schematic diagram illustrating DID generation and credential request in one implementation method.

[0013] Figure 3 This is a schematic diagram of the credential generation stage in one implementation method.

[0014] Figure 4 This is a schematic diagram of the credential combination stage in one implementation method.

[0015] Figure 5 This is a flowchart of a credential combination algorithm in one implementation.

[0016] Figure 6 This is a flowchart of a credential verification algorithm in one implementation.

[0017] Figure 7 As a representation of the first credential in one implementation, it can be converted into an RDF graph.

[0018] Figure 8 As a representation of the second credential in one implementation, it can be converted into an RDF graph.

[0019] Figure 9 In one implementation, the attribute constraint generated simultaneously when generating the second credential is a binary tree converted by a monotonic Boolean function, where each attribute and its vector are located at the leaf nodes of the binary tree.

[0020] Figure 10 In one implementation, matrix E is composed of row vectors generated from a binary tree, and the subsequent matrix-vector multiplication is for linear secret sharing, assigning a secret share to each attribute. This secret share can later be used to recover the secret value.

[0021] Figure 11 This is an RDF diagram illustrating a combination of credentials in one implementation, clearly showing how two credentials are associated through attributes.

[0022] Figure 12 This refers to the calculation steps required when the verification process needs to recover the secret value s in one implementation. Detailed Implementation

[0023] Terminology Explanation: RDF (Resource Description Framework) describes information using triples (subject-attribute-value) and is suitable for representing structured data.

[0024] Digital identity is the mapping and extension of an individual's or entity's identity in the real world into the digital world, becoming an important technological solution for addressing data security issues in the digital age. With the development and evolution of the internet, digital identity management has undergone four stages: from centralized identity to federated identity, then to user-centric identity, and finally evolving into self-sovereign identity (SSI), also known as decentralized identity (DID). As an emerging internet identity management approach, distributed digital identity management utilizes technologies such as cryptography, distributed identifiers, blockchain, verifiable credentials, and digital wallets, abandoning the traditional centralized account system and enabling users to manage their identities autonomously and selectively disclose information. In 2022, the World Wide Web Consortium (W3C) released the official recommendation standard for DID, defining it as a decentralized, entity-generated new type of identity identifier and establishing a unified JSON-formatted verifiable credential (VC) specification. The DID system includes at least three roles: issuer, user, and verifier. VCs exchange information among these three parties, thus circulating verifiable information. DIDs and VCs are autonomously managed by entities through digital identity wallets, achieving a standardized representation of identity and attributes. The development of blockchain and distributed ledger technologies provides a reliable technological infrastructure for DID construction.

[0025] Selective disclosure is a mechanism to protect user privacy and can be seen as a privacy design that enhances transparency and security. In certain scenarios, users desire the privacy functionality of selective disclosure. Credential holders need to present credentials to verifiers to prove their attributes, but they do not want to disclose irrelevant private data. This means verifying credentials while ensuring minimal exposure of private data. For example, if a user only needs to prove their name, they do not need to disclose their address and phone number. Similarly, verifiers should not collect more data than is necessary to complete the transaction. Selective disclosure not only protects individual privacy but also reduces the responsibility of verifiers in processing or holding personal data they do not need. In 2019, the W3C issued the VC Implementation Guidelines, defining three types of selective disclosure methods: Atomic Credentials, Hashed Values, and Selective Disclosure Signatures. Atomic credentials are verifiable credentials composed of a single attribute. Their atomicity allows the holder to disclose only the attributes that need to be disclosed to the verifier. Hash-based methods hash the attributes in the credential; the credential issued by the issuer contains all attributes, but they are all represented by hash values. Selective disclosure signatures are signature schemes that inherently support the selective disclosure of attributes in a credential. Selective disclosure signature methods rely on sophisticated signature techniques, allowing attributes to be selectively disclosed while retaining the ability to verify them. Although selective disclosure signatures have higher computational complexity than the other two schemes, they can be combined with other cryptographic components to implement sophisticated privacy protection mechanisms, offering good security and scalability. Numerous scholars have proposed a series of selective disclosure signature schemes that can be applied to different digital credential systems to solve data security problems. Verifying multiple attributes or multiple credentials generates a large number of signatures, and many scholars continue to focus their research on reducing the overhead of selective disclosure of multiple credentials.

[0026] Currently, there are many schemes that selectively disclose individual verifiable credentials, but fewer that selectively disclose combinations of multiple credentials. Furthermore, existing schemes often simply overlay multiple credentials without revealing the relationships between them. When a large number of credentials are presented at once, this not only increases the workload for the verifier in reconstructing the meaning of the combined credentials but may also lead the verifier to misunderstand the user's intended message. Additionally, most current schemes assume users can selectively disclose any attributes, which could allow users to maliciously hide attribute information, misleading the verifier or evading verification.

[0027] This invention provides a simple and efficient way to selectively disclose and verify verifiable credentials. When presenting multiple credentials in combination, it can associate attribute information and aggregate signatures. During verification, the verifier can accurately and quickly recover the user's intended meaning, thus enabling accurate and efficient identity information representation and verification in more complex scenarios. Furthermore, it allows for constraints on the attributes that users can selectively disclose, hiding only certain attributes to prevent malicious behavior. Ultimately, the verifier can not only verify the legality of signatures and selective disclosures but also verify whether the user meets the attribute constraints set by the issuing authority.

[0028] The following is combined Figures 1-6 The technical solution of this case is clearly and completely described. Obviously, the described implementation methods are only a part of the implementation methods of this case, not all of them. Based on the implementation methods in this case, all other implementation methods obtained by those skilled in the art without inventive effort are within the scope of protection of this application.

[0029] The selective disclosure credential scheme LSA-Cred, which is based on associated data and has attribute constraints, mainly includes seven modules: SetUp, DIDGen, CredReq, CredGen, CredSD, CredCom, and CredVerify. The modules are described below.

[0030] Initialization module Enter security parameters Output common parameters ,accumulator Mask set Based on common parameters Users and issuers generate their own key pairs locally. and And upload the public key to the blockchain. For the user's public key, This is the user's private key. For the issuing party's public key, This is the private key of the issuing party.

[0031] DID generation module Enter user key pair Output the user's DID and DID document. They are then uploaded to the blockchain for registration and backup. For the user's DID, This is the corresponding DID document.

[0032] Credential Request Module The user will provide the attribute information required for applying for the certificate. The DID is encrypted using the issuing party's public key and sent to the issuing party. The issuing party can obtain the relevant information after decryption. t represents the sending time. It is an attribute set.

[0033] voucher generation module Enter the issuing party's private key. User attributes Attribute constraints Output vouchers ,in, This is the issuing party's original signature on the attribute set. The attribute constraints... Preset.

[0034] Selective Disclosure Module : Enter the issuing party's public key ,certificate Hidden attribute set Output the credentials after selective disclosure ,in It is the set of disclosed attributes. It is the signature following a selective disclosure operation.

[0035] Voucher Combination Module Input m verifiable credentials after selective disclosure The output can be verified. .

[0036] Credential verification stage Input: The public key of the issuer that generates the k-th credential. Verifiable characterization Output the verification results .

[0037] During the initialization phase, the LSA-Cred scheme is based on security parameters. Generate a prime number on the blockchain. Two groups A bilinear mapping An aggregator and a mask set The user and the issuer each generate a public-private key pair locally based on the aforementioned public parameters. and ,like Figure 1 As shown. Upload the generated public key to the blockchain.

[0038] During the DID generation and credential request phase, users transact with the blockchain using their public-private key pairs and obtain a transaction address, which becomes their DID. Users then upload their DID and a DID document containing their DID and public key to the blockchain for registration and storage, as follows: Figure 2 As shown: Input user's public / private key pair The process involves generating a transaction address / distributed identifier (DID) and a DID document, uploading the public key, DID, and DID document to the blockchain for registration and storage, and outputting the DID and DID document. Next, the user sends their public key, DID, and the information required to generate the credential to the issuer in encrypted form. The issuer decrypts the data, compares the user's public key with the record on the blockchain, and verifies the user's identity. Only after successful verification will the issuer generate the credential for the user.

[0039] During the credential generation phase, once the issuing party verifies the user's legitimacy and the correctness of their attributes, the process can begin. Figure 3 The algorithm for the illustrated process is as follows: First, a triplet-type credential that can be converted into an RDF graph is constructed. This credential can represent the relationships between attributes and can associate attribute information from multiple credentials, thus representing authentication in more complex scenarios. Then, based on the user's triplet-type attribute Attr (which can be equivalently converted to a Resource Description Framework (RDF) graph), according to the attribute constraint P (i.e., a monotonic Boolean function) that the user must satisfy when selectively disclosing information in the future, the attribute constraint P is generated and converted into the corresponding access binary tree T and access matrix E. Based on the equivalent access matrix E, the number of random numbers is determined, and a number of random numbers equal to the number of columns in the access matrix E is generated, thereby generating a determined number of random number column vectors w, the first element of which is the secret value s. Subsequently, the access matrix E and the vector w are multiplied to obtain the secret share corresponding to each attribute, generating a random number r. The issuer then aggregates this r with the attribute value and the secret share using an aggregator. Hash the concatenation of the secret value s and the aggregate value d to obtain... Issuing party's private key Sign the hash value Get a signature Output vouchers It will be distributed to users.

[0040] In the process described above, this solution combines a monotonically tensor scheme and a linear secret-sharing scheme to achieve efficient selective disclosure and verification of verifiable credentials. Furthermore, it adds attribute constraints on users during the selective disclosure phase, requiring mandatory disclosure of certain attributes to prevent users from maliciously hiding attributes to evade verification. Other solutions' attribute constraints are based on key-value pair credentials, while implementing this attribute constraint function on triplet-type credentials is quite difficult. Therefore, this solution has a significant advantage in adding this functionality.

[0041] Once the user receives the credentials, they can obtain the issuer's public key from the blockchain. Verify that the signature on the credential is a correct signature signed with the issuing party's private key, i.e., the signature calculated by the user based on the original credential. ,verify Whether it is valid or not is used to determine the correctness of the voucher, after which the voucher can be used with confidence.

[0042] When a user needs to present personal credentials, these credentials can be selectively disclosed, provided that attribute constraints are met, without requiring interaction with the issuing authority. For example... Figure 4 As shown, the input credential VC = (Attr, σ), the user selects the attributes to be hidden, and these attributes form the set Hidden. Where c is the size of the Hidden set. Update the attribute set. This involves removing hidden attributes from the original attribute set and generating the corresponding RDF graph. Attribute constraint verification is then performed based on the attributes to be disclosed, using monotonic Boolean functions. Verify whether the updated attribute set meets the attribute constraints set by the publisher. For example, judging Is it 1?: If a set of attribute inputs causes the function to output '1', then access the matrix. All row vectors must exist in a specific linear combination such that the result of the linear combination equals the vector. Here, t represents the column number of the access matrix. This indicates that the input satisfies the requirement of a monotonic Boolean function, meaning it meets the attribute constraints and can be selectively disclosed; otherwise, it does not meet the attribute constraints and cannot be selectively disclosed. After successful verification, the user's secret share value set is updated. The secret share corresponding to the disclosure attribute remains unchanged; while for the secret share corresponding to the hidden attribute, an aggregator is first used to... Pre-aggregation with hidden attributes and their corresponding secret shares is obtained Thus Updated to The secret share corresponding to the hidden attribute is then masked using a mask set. Element replacement in the code—secret shares with the same attribute must be replaced with the same mask value, and secret shares with different attributes must use different masks; and the secret share set is updated to... Users also need to remove the hidden attributes from the attribute constraints. Delete it from the middle and update the attribute constraint to... Finally, update the signature to... The final output is the selectively disclosed voucher. The credential is sent to the verifier.

[0043] In the aforementioned disclosure process, this solution does not employ zero-knowledge proof technology for selective disclosure and verification. Instead, it achieves selective disclosure and verification solely through simple matrix and vector operations, thus offering advantages in terms of computational complexity and ease of use. Furthermore, when multiple credentials are presented, the signatures of different issuing parties can be aggregated, simplifying the final signature process to some extent.

[0044] This solution not only supports selective disclosure of single credentials but also offers advantages in selective disclosure of multiple credentials. When a user needs to present combined information from multiple credentials, the associative nature of RDF can be leveraged to link attribute information from multiple credentials, aggregate signatures from multiple credentials through multiplication, and encapsulate attribute values ​​and other data into a data packet before sending it to the verifier. The entire process is as follows: Figure 5 As shown.

[0045] Specifically, during the voucher combination stage, a user can simultaneously present a combination of m vouchers, for the m-th voucher... Each certificate contains the corresponding signature portion. In Perform cumulative multiplication to obtain the aggregate. As for the remaining parts of the m credentials, they are left unprocessed and directly used to generate the final VP (Verifiable Representation). When the above multiple credentials are presented in combination, not only can the signatures of different issuers be aggregated, but the triplet property also allows the verifier to recover the relationship between the credentials without speculation, thereby achieving efficient and accurate credential verification and preventing the verifier from misunderstanding the user's intended meaning.

[0046] During the document verification phase, when the verifier receives a combined document containing m documents, for the first document... Each credential is verified based on the characteristics of the RDF graph itself and the secret share. The order and secret share With attributes The correspondence is established by locating the disclosed attributes in the RDF diagram, thereby understanding the logical relationships between the attributes and recovering the corresponding relationships. The validity of the credential and whether its attributes meet the verifier's requirements are then verified. Any credential that does not meet the attribute constraints will fail the verification.

[0047] Specifically, the verifier will use the corresponding attribute set. Attributes and attribute constraints The attributes in the attribute constraint are compared to determine if all attributes are present in the attribute set. If all attributes are present, the verification passes; otherwise, the credential is deemed invalid without further verification. If the verification passes, the verifier can proceed according to... Generate the corresponding binary tree and matrix Find a set of numbers containing only 0s and 1s such that the linear combination of the row vectors of the matrix results in the form [1,0,0,...,0]. The secret value can be recovered by multiplying this set of numbers by the secret share and then summing the results. The verifier then aggregates each disclosed attribute with its corresponding secret share, and then... Aggregation yields the final aggregated value. Next, the secret value and the aggregate value are concatenated and hashed to obtain the hash value. For each voucher, the corresponding hash value can be obtained using the method described above. The verifier ultimately only needs to verify the bilinear pair. Are they equal, where Using the private key of the issuer of the k-th credential, the validity of the credential and signature can be verified. See the implementation process below. Figure 6 .

[0048] When verifying the aforementioned vouchers, for combined vouchers, after selective disclosure, the combined vouchers are presented to the verifier. The verifier can recover the relationship between the vouchers through the triplet property without speculation, thereby achieving efficient and accurate voucher verification. This can prevent the verifier from misunderstanding the meaning that the user wants to express.

[0049] The following is combined Figures 7-12 This section describes the specific process of information disclosure using this plan when a user is hospitalized for surgery.

[0050] In one implementation, the original certificate generated by the issuing party is a ternary certificate, such as... Figure 7 and Figure 8 As shown, this can be converted into an RDF diagram. The issuing party generates attribute constraints simultaneously when generating credentials. Users can only selectively disclose credentials within the constraints; otherwise, they will fail the verifier's verification. These attribute constraints are pre-defined based on actual scenario requirements. According to the user's usage scenario, credential 1 ( Figure 7 ) is the user's personal identity credential, credential 2 ( Figure 8 This is the user's hospital admission certificate. The user is about to undergo surgery and needs to apply for surgical permission and designate their mother as the person to sign the surgical consent form, so two certificates must be presented together. The user also needs to hide personal information unrelated to the surgery (such as phone number, home address), and must hide personal DID 'A' and certificate DID 'I / 1' and 'K / 2'.

[0051] Taking voucher 2 as an example, the specific operation of the LSA-Cred scheme is as follows.

[0052] After the issuing party verifies the correctness of the attributes in credential 2 requested by the user, it sets the attributes to triple type data. (See Figure 8 The three-line table on the right), and generate the corresponding RDF graph (see Figure 8(Directed graph on the left). Attribute constraints. Generate based on the attributes that the user needs to disclose.

[0053] first, Figure 8 The three-line table in the data structure has six rows of data besides the column names Subject, Predicate, and Object. Each row contains three elements, forming a triplet. The elements in each of the six triplets are represented by... For example, the third element A of the triplet in the second row is represented as... The first element A of the triplet in the third row is represented as .

[0054] Subsequent attribute constraints:

[0055] This attribute constraint The monotonically tensor scheme MSP is sequentially converted into an equivalent access binary tree. ( Figure 9 ) and access matrix ( Figure 10 ).

[0056] Issuing party That is, four random numbers are randomly generated from the integer field modulo p, denoted as... , to obtain a combination Let s be the secret value, and adopt a linear secret sharing scheme, using the formula... Generate secret shares, which constitute a set. The aggregator then aggregates each attribute and its corresponding share. Add to the aggregate value to generate the final aggregate value:

[0057] Final aggregate value With secret value After concatenation, a hash operation is performed to obtain the hash value. The issuing party uses its private key. Sign the hash value to obtain a BLS signature. The final credential and signature pair sent to the user is .

[0058] When a user needs to selectively disclose this credential, the first step is to determine the final set of attributes that need to be presented, i.e. Figure 8 Some elements from the six triples in the three-line table on the right: , And represent its corresponding position as .

[0059] The first step is to determine whether presenting only these attributes satisfies the attribute constraints set by the issuing authority. Attributes connected by "or" in the attribute constraints only require disclosure of one of them, while attributes connected by "and" must be disclosed simultaneously. Therefore... It can be simplified to an equation consisting of the minimum disclosure elements, namely: .

[0060] It can be proven that the user-disclosed attributes satisfy the attribute constraints if the set of attributes in the equation is a subset of the user-disclosed attributes. In this case, the user needs to modify the attribute constraints to be functions containing only the disclosed attributes, i.e.: .

[0061] For attributes that need to be hidden, they are pre-aggregated with their corresponding secret shares, and then... Aggregate these aggregation results to obtain new random numbers:

[0062] For a set consisting of secret shares If it corresponds to the attribute that needs to be hidden, then that secret share will be masked by the set. The elements in the mask set are replaced, and it should be noted that: regardless of whether the same secret share exists in the set, if it corresponds to a different attribute, the secret share must be replaced by a different element in the mask set; and secret shares corresponding to the same attribute must be replaced with the same element in the mask set. If it is a secret share corresponding to the attribute to be disclosed, the real secret share is sent so that the verifier can verify the disclosed attribute.

[0063] Ultimately, the set Modified to a set:

[0064] It contains a portion of the real secret share and some elements from the mask set.

[0065] At this point, the user can send selectively disclosed credentials to the verifier. .

[0066] In this scenario, the user needs to selectively disclose two credentials and combine them (see...). Figure 11 The document is sent to the verifier. Therefore, after performing the same operation as document 1, a selectively disclosed document can also be obtained.

[0067] To distinguish between the two sets of credentials, we add subscripts to the attribute and signature pairs, thus obtaining two sets of data: Since the issuing authority uses BLS signatures to sign the credentials, users can combine credential signatures using a cumulative multiplication method to achieve credential combination. After combining the data, the user sends it to the validator. .

[0068] After receiving the combined credentials provided by the user, the validator first verifies the validity of each credential. The following explanation uses credential 2 as an example. The validator is aware that these credentials can be converted into a ternary RDF graph, therefore... The data is partitioned, with each set consisting of three elements forming a triplet, and then converted into an RDF graph. The validator can also query... Whether an element in the set belongs to the mask set is used to filter out the true secret shares and sort them. Disclosed attributes Send these attributes to the verifier in the order of the triples in the original voucher. The verifier only needs to match these attributes with the true secret share. By matching them one-to-one in sequence, the location identifiers of these attributes can be found in the voucher. Since the verifier has converted all elements in the set containing the secret share into edges or nodes in a triple-type RDF graph, the position of the actual secret share in the RDF graph is the position of the corresponding attribute. Based on this positional information, the verifier can understand the relationships between the disclosed attributes and the specific meaning they ultimately express, thereby determining whether these disclosed attributes meet the requirements for the service application.

[0069] The verifier also needs to verify whether the received attributes meet the attribute constraints set by the certificate issuer. That is, verifying whether the disclosed attributes contain attribute constraints. All attributes in [the system / database]. After successful validation, the validator can [follow the validation criteria]. Generate the corresponding binary tree and matrix And solve for the matrix row vectors satisfy of Thus, the secret value can be solved. .

[0070] In the above scenario, Therefore, the secret value is See details Figure 12 The verifier then aggregates each disclosed attribute with its corresponding secret share, and then... Aggregation yields the final aggregated value. Then the secret value With the final aggregate value Cascade hashing to obtain the hash value For each voucher, the corresponding hash value can be obtained using the method described above. In this scenario, the user sends a combination of two vouchers. To distinguish the hash values ​​of the two vouchers, an index identifier needs to be added, i.e. The verifier ultimately only needs to verify... Whether it is valid or not can confirm whether the voucher and signature are valid.

[0071] In summary, the static aggregator used in this scheme meets the security requirements of collision resistance, indistinguishability, and exchangeability. Therefore, this scheme can achieve the unforgeability of credentials and the indistinguishability of credentials after selective disclosure. Unforgeability means that, given the issuer's public key, the probability that a PPT adversary can calculate the signature corresponding to a new attribute based on known attributes and corresponding signatures is negligible. This mainly relies on the collision resistance of the aggregator and stems from the difficulty of solving the CDH problem. Privacy means that no information about hidden attributes can be obtained from the credentials generated through selective disclosure using this scheme. This mainly depends on the indistinguishability of the aggregator, because when users selectively disclose, they need to aggregate hidden attributes and corresponding secret shares in advance; therefore, only an aggregator with indistinguishability and exchangeability can achieve this function.

[0072] Compared to ordinary key-value pair vouchers, the vouchers constructed in this solution are triplet-type and can be converted into RDF graphs. This construction can represent the relationships in identity information, especially when multiple vouchers are presented together, it can associate attributes in different vouchers, thereby dealing with more complex voucher presentation scenarios and making the solution more widely applicable.

[0073] Compared to conventional schemes with selective disclosure capabilities, this scheme does not employ zero-knowledge proofs. Instead, it achieves selective disclosure through Boolean functions, binary trees, and matrices constructed using monotone spanning schemes and linear secret-sharing schemes. This method eliminates the need for complex zero-knowledge proof calculations, requiring only simple matrix operations, resulting in lower computational complexity and enabling efficient selective disclosure and verification. Furthermore, this technology allows the issuing authority to impose attribute constraints on users during selective disclosure, preventing malicious users from hiding attributes to evade verification. Moreover, this added functionality does not increase computational load; the entire scheme remains computationally simple and verification-efficient.

[0074] The beneficial technical effects of this solution are as follows: By introducing RDF triples and selective disclosure with attribute constraints, the selective disclosure and verification of verifiable credentials can be realized simply and efficiently, preventing malicious behavior by users. Furthermore, when multiple credentials are presented in combination, attribute information can be associated and signatures aggregated. During verification, the intended meaning of the user can be accurately and quickly recovered, thereby enabling identity information identification and accurate and efficient verification in more complex scenarios. These innovations provide new ideas for research in the field of selective disclosure of verifiable credentials.

[0075] This invention can be a system, method, and / or computer program product.

[0076] For example, a method for selectively disclosing verifiable credentials based on associated data includes: after the credential is generated, when a user selectively discloses the credential under the premise of satisfying the attribute constraint of mandatory disclosure, determining the attribute set of the triplet-type data to be disclosed. Attribute constraint validation is performed based on the attributes to be disclosed; if the validation passes, the hidden attributes are removed from the attribute constraints. Delete it from the middle and update the attribute constraint to... The secret share of the attributes to be disclosed remains unchanged, while the secret share of the attributes to be hidden is masked using a mask set. In the process of element replacement, secret shares with the same attribute are replaced with the same mask value, while secret shares with different attributes are replaced with different masks. This process updates the secret shares, resulting in an updated set of secret shares. S' ;Will r Aggregating with hidden attributes and their corresponding secret shares yields Update signature to Selectively disclosed credentials The credential is sent to the verifier; during the credential verification phase, the verifier will send the attribute set. Attributes and attribute constraints The attributes in the attribute constraint are compared and judged. If all attributes in the attribute constraint are in the attribute set, the verification passes; otherwise, the credential is invalid.

[0077] For example, a selective disclosure verifiable credential system based on associated data includes: a credential selective disclosure module, configured for user use, which, after credential generation, determines the attribute set of triplet-type data to be disclosed when the user selectively discloses the credential under the premise of satisfying the attribute constraints of mandatory disclosure. Attribute constraint validation is performed based on the attributes to be disclosed; if the validation passes, the hidden attributes are removed from the attribute constraints. Delete it from the middle and update the attribute constraint to... The secret share of the attributes to be disclosed remains unchanged, while the secret share of the attributes to be hidden is masked using a mask set. In the process of element replacement, secret shares with the same attribute are replaced with the same mask value, while secret shares with different attributes are replaced with different masks. This process updates the secret shares, resulting in an updated set of secret shares. ;Will Aggregating with hidden attributes and their corresponding secret shares yields Update signature to Selectively disclosed credentials The credential is sent to the verifier; the credential verification module, configured for the verifier's use, will send the attribute set... Attributes and attribute constraints The attributes in the attribute constraint are compared and judged. If all attributes in the attribute constraint are in the attribute set, the verification passes; otherwise, the credential is invalid.

[0078] Computer program products may include computer-readable storage media having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of the present invention. Exemplarily, a computer-readable storage medium stores a computer program capable of being loaded by a processor and executing any of the methods or systems described above.

[0079] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0080] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0081] The computer program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, Python, etc., and conventional procedural programming languages ​​such as "C" or similar languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing state information from the computer-readable program instructions. This electronic circuitry can execute the computer-readable program instructions to implement various aspects of the invention.

[0082] Various aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0083] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0084] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions that execute on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0085] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions. It will be well known to those skilled in the art that implementation in hardware, implementation in software, and implementation using a combination of software and hardware are equivalent.

[0086] The various embodiments of the present invention have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein. The scope of the invention is defined by the appended claims.

Claims

1. A method for selectively disclosing verifiable credentials based on associated data, characterized in that, include: After the voucher is generated, when a user selectively discloses the voucher while satisfying the attribute constraints that require mandatory disclosure, the attribute set of the triplet type data to be disclosed is determined. Attribute constraint verification is performed based on the attributes to be disclosed; If the validation passes, the hidden attribute will be removed from the attribute constraint. Delete it from the middle and update the attribute constraint to The secret share of the attributes to be disclosed remains unchanged, while the secret share of the attributes to be hidden is masked using a mask set. In the process of element replacement, secret shares with the same attribute are replaced with the same mask value, while secret shares with different attributes are replaced with different masks. This process updates the secret shares, resulting in an updated set of secret shares. S' ;Will r Aggregating with hidden attributes and their corresponding secret shares yields Update signature to Selectively disclosed credentials The credential is sent to the verifier; During the credential verification phase, the verifier will use the attribute set. Attributes and attribute constraints The attributes in the attribute constraint are compared and judged. If all attributes in the attribute constraint are in the attribute set, the verification passes; otherwise, the credential is invalid.

2. The method according to claim 1, characterized in that: When a user needs to selectively disclose m combined vouchers, for the first... Each credential will have a corresponding signature. In Perform cumulative multiplication to obtain the aggregate. ; After the m credentials are verified, the th credential is... A credential, verified by the party. Secret Shares Recover the secret value Then, each disclosed attribute is aggregated with its corresponding secret share, and then compared with the signature. In Aggregation yields the final aggregated value. Then the secret value With aggregate value Cascade hashing to obtain the hash value ; Finally, verify the bilinear pairing. Are they equal, where Using the private key of the issuer of the k-th credential, the validity of the credential and signature can be verified; e and g are based on security parameters, respectively. The generated bilinear mapping and group.

3. The method according to claim 1, characterized in that, sign The generation steps include: Based on attribute constraint P, a monotonically stretched scheme is used to transform it into an equivalent access binary tree T and an access matrix E. The number of random numbers is determined based on the equivalent access matrix E. A number of random numbers equal to the number of columns in the access matrix E are generated, and then a column vector w of the determined number of random numbers is generated, the first element of which is the secret value s. Based on matrix E and vector w, a linear secret sharing scheme is used to obtain secret shares that correspond one-to-one with attributes, forming a set S; Generate a random number r and combine it with the attribute value. The secret share S is aggregated into d; Concatenate the secret value s with the aggregate value d and then perform a hash calculation to obtain... ; Using private key Sign the hash value Get a signature .

4. The method according to claim 1, characterized in that, The voucher generation process includes the following steps: When the issuing party verifies based on the issuing party's private key Verify user legitimacy and attributes When verifying the correctness of the certificate, the issuing party bases it on the attributes. Generate attribute constraints P, and generate secret shares S based on attribute constraints P; Generate a random number r based on the random number r, the secret value s, and the attribute. And secret share, generate signature Output vouchers .

5. The method according to claim 1, characterized in that, A monotonic Boolean function is used for comparison and judgment.

6. A computer-readable storage medium, characterized in that: The computer program is stored that can be loaded by a processor and executed as described in any one of claims 1 to 5.

7. A selective disclosure system for verifiable credentials based on associated data, characterized in that: include: The selective disclosure module for vouchers is configured for user use. After vouchers are generated, when a user selectively discloses a voucher while satisfying attribute constraints that require mandatory disclosure, it determines the attribute set of triplet-type data to be disclosed. Attribute constraint verification is performed based on the attributes to be disclosed; If the validation passes, the hidden attribute will be removed from the attribute constraint. Delete it from the middle and update the attribute constraint to The secret share of the attributes to be disclosed remains unchanged, while the secret share of the attributes to be hidden is masked using a mask set. In the process of element replacement, secret shares with the same attribute are replaced with the same mask value, while secret shares with different attributes are replaced with different masks. This process updates the secret shares, resulting in an updated set of secret shares. ;Will Aggregating with hidden attributes and their corresponding secret shares yields Update signature to Selectively disclosed credentials The credential is sent to the verifier; The credential verification module is configured for use by the verifier, who will then use the attribute set. Attributes and attribute constraints The attributes in the attribute constraint are compared and judged. If all attributes in the attribute constraint are in the attribute set, the verification passes; otherwise, the credential is invalid.

8. The system according to claim 7, characterized in that, The system also includes: The voucher combination module is configured to, when a user needs to selectively disclose vouchers as m combined vouchers, select the voucher for the m-th voucher combination. Each credential will have a corresponding signature. In Perform cumulative multiplication to obtain the aggregate. ; The combined credential signature verification module is configured for use by the verifier. After m successful verifications, it verifies the 1st credential signature. A credential, verified by the party. Secret Shares Recover the secret value Then, each disclosed attribute is aggregated with its corresponding secret share, and then compared with the signature. In Aggregation yields the final aggregated value. Then the secret value With aggregate value Cascade hashing to obtain the hash value Finally, verify the bilinear pairing. Are they equal, where Using the private key of the issuer of the k-th credential, the validity of the credential and signature can be verified; e and g are based on security parameters, respectively. The generated bilinear mapping and group.

Images