Privacy protection identity registration and authentication method and system compatible with standard sim card

Abstract

This invention discloses a privacy-preserving identity registration and authentication method and system compatible with standard SIM cards, belonging to the field of cryptographic protocol technology. The system includes three participants: a user terminal, an operator, and an application. It is based on the SIM card issued by the mobile operator and owned by all mobile phone users. The user and the operator collaborate to complete the application's authentication of the user's identity. This invention features high security and efficiency; even if an adversary compromises the operator, they cannot obtain the user's login behavior. It also protects user authentication from man-in-the-middle attacks, is compatible with existing SIM cards, requires no replacement of existing hardware, and is easy to deploy. This invention further enhances privacy protection, ensuring that user access behavior is not tracked, has excellent interoperability, and is suitable for large-scale 5G application deployment.

Description

Technical Field

[0001] This invention belongs to the field of cryptographic protocol technology, and in particular relates to a privacy-preserving identity registration and authentication method and system compatible with standard SIM cards. Background Technology

[0002] Identity authentication protocols are important and widely used cryptographic protocols in practice, and are a core component in ensuring network security and data protection. With the proliferation of mobile devices and the expansion of network services, ensuring that only authorized users can access network services and resources has become crucial. Proper identity authentication can also prevent risks such as unauthorized access and identity theft.

[0003] In modern mobile communication networks, user devices must authenticate with applications to ensure that only genuine users authenticated by the application provider can access the application server. Typically, authentication between user devices and applications relies on various credential systems, such as password-based, SMS-based, or hardware token-based authentication. Despite significant advancements in authentication technologies in mobile communication networks over the years, finding a user authentication and key establishment method that is both secure and easy to use remains a challenge.

[0004] Password-based authentication is a common method for granting users access to their accounts. However, if the keys or passwords stored on a server are leaked or compromised, attackers could intercept and decrypt user data, compromising the confidentiality and integrity of communications. In recent years, numerous companies have experienced password database breaches.

[0005] SMS-based verification codes are another widely used method of identity verification. However, SMS was not designed for secure data transmission and is therefore vulnerable to attack. The National Institute of Standards and Technology (NIST) recommends abandoning OTPs based on SMS verification codes due to several security flaws.

[0006] The FIDO (Fast IDentity Online) protocol, proposed by the FIDO Alliance in 2012, aims to replace traditional password authentication with a more secure and user-friendly method. The FIDO protocol employs a challenge-response mechanism: users generate a public-private key pair in a hardware token and register the public key with the server. During authentication, the server sends a challenge value to the client, which the user signs using the private key stored in the hardware token. Because the private key is always stored in the hardware token and never leaves the device, adversaries cannot obtain it, thus ensuring the security of the authentication process. These versions are widely used in online banking, e-commerce, and enterprise systems. However, the introduction of hardware tokens also presents usability challenges, increasing the complexity of user operations and thus affecting the protocol's adoption and user experience.

[0007] Therefore, a more secure, user-friendly, and application server-deployable authentication method is still lacking. Based on this principle, 3GPP has been dedicated to designing application-level authentication and key negotiation protocols since 2003. The Generic Bootstrapping Architecture (GBA) was first specified in 3GPP Release 6 to ensure a certain level of security in communication between user equipment and application servers. Subsequently, considering the needs of battery-constrained devices, Battery EfficientSecurity for very low Throughput Machines (BEST) was designed to establish lightweight communication security and key negotiation protocols. These systems delegated the authentication process to mobile authentication operators, aiming to allow users to complete authentication with applications with the help of mobile operators. However, with the continuous evolution of cellular network generations and service requirements, these early mechanisms are no longer applicable. The introduction of Service-Based Architecture (SBA) in fifth-generation mobile communication systems brought about significant architectural changes. Furthermore, the widespread adoption of various IoT devices requires more unified application protocols to achieve application-layer authentication. These changes pose new challenges to existing authentication and key negotiation mechanisms, necessitating the development of solutions that adapt to the new architecture and requirements.

[0008] In 2019, 3GPP defined a delegated authentication system, Authentication and Key Management for Applications (AKMA), in technical specification TS 33.535 and integrated it into the 5G standard. The latest protocol version is 18.3.0, released on March 28, 2024. The protocol's design philosophy is as follows: the operator distributes the same secret to both the user and the application as a pre-shared key. Based on this pre-shared key, the user and the application can communicate securely using the PSK-TLS protocol. While this scheme provides an effective solution for the AKMA protocol, its security relies on trust in the operator. Furthermore, it is important to emphasize that the current AKMA protocol grants operators the authority to determine the applications a user logs into, as well as the frequency and timing of those logins. However, telecommunications companies may intentionally disclose user data, as logging into applications could reveal insights into users' daily behavioral patterns. These concerns have proven valid. The Federal Trade Commission found that six major U.S. internet service providers (such as AT&T and Verizon Wireless) collected and analyzed users' entire internet traffic and real-time location data without their informed consent for targeted advertising and other commercial purposes. According to another report, AT&T played a significant role in the National Security Agency's extensive surveillance of U.S. internet traffic.

[0009] Furthermore, regulatory bodies and standardization organizations (such as the EU's General Data Protection Regulation) also require operators to comply with privacy protections. 3GPP's TR 33.835 specifically addresses ensuring the confidentiality of communications within operators. These issues all underscore the necessity of prioritizing privacy in system design.

[0010] Therefore, there is still a lack of a user authentication protocol that can balance user usability and protocol security. On the one hand, it should not require users to remember passwords or carry hardware tokens. On the other hand, if third-party involvement is introduced, the possibility of malicious third-party involvement needs to be considered. Summary of the Invention

[0011] This invention discloses a privacy-preserving identity registration and authentication method and system compatible with standard SIM cards. It can construct an identity authentication scheme that does not rely on hardware tokens, is compatible with existing SIM cards, and does not disclose users' identity and behavioral information to third parties.

[0012] To achieve the above objectives, the technical solution of the present invention includes the following:

[0013] A privacy-preserving identity registration method compatible with standard SIM cards, applied to a user terminal, the method comprising:

[0014] Generate a username and initiate registration with the application based on the user identity in the SIM card to obtain the corresponding challenge value ch1;

[0015] The key generation phase, which involves unintentional signing by both the operator and the user, generates the user's account public key (PK). ACC ;

[0016] Choose a random number r1, and input the application identity, challenge value ch1, and account public key PK. ACC After making a commitment using the username and the random number r1, the generated commitment value c1 is sent to the application so that the application can use the application's private key SK. HN Sign the commitment value c1 to obtain the signature σ1;

[0017] After selecting a random number r2 and making a commitment to the application identity, challenge value ch1, and the random number r2, the generated commitment value c2 is sent to the operator to perform a signing phase of unintentional signing between the two parties and the operator, generating signature σ2.

[0018] Receive the signature σ1 and the signature σ2, and use the account public key PK ACC Verify the signature σ2;

[0019] Open the commitment value c1 and its corresponding value, open the commitment value c2 and its corresponding value, the signature σ1, the signature σ2, the username, and the account public key PK. ACC The message is sent to the application so that the application can verify the promise c1, the promise c2, the signature σ1, and the signature σ2 based on the open corresponding to the promise value c1 and the open corresponding to the promise value c2. After successful verification, the application will send the username and the account public key PK. ACC Record it in the database.

[0020] Furthermore, in the key generation phase where the operator and the user perform an unintentional signature, the user's account public key PK is generated. ACC ,include:

[0021] Initiate a registration request to the operator so that the operator can participate in the modulo-q integer ring. A random value is selected as the operator's private key share a2, and the public key S2 and proof π are calculated based on the private key share a2; wherein, the proof π is used to prove that the operator knows the private key share a2 corresponding to the public key S2;

[0022] Obtain the public key S2 and the proof π, and verify the proof π;

[0023] If the proof of π passes, then in the modulo q integer ring... A random value is selected as the private key share a1 of the user terminal, and the signature public key S is calculated based on the private key share a1.

[0024] Furthermore, the signing stage, in which the operator and the parties inadvertently sign each other, generates signature σ2, includes:

[0025] In the ring of integers modulo q A random value is selected as the temporary private key share p1 for the user. After calculating the public key P1 and the proof π1 based on the private key share p1, a commitment is made to the public key P1 and the proof π1 to obtain the commitment value π. ′ Wherein, the proof π1 is used to prove that the user knows the temporary private key share k1 corresponding to the public key R1;

[0026] The system receives a public key P2 and a proof π2 from the operator and verifies the proof π2; wherein the public key P2 is generated based on the operator's temporary private key share p2, and the temporary private key share p2 is a modulo q integer ring. A random value in the public key P2, wherein the proof π2 is used to prove that the operator knows the temporary private key share p2 corresponding to the public key P2;

[0027] If the π2 verification passes, a public-private key pair (pk, sk) is generated, and the private key share a1 is encrypted using the public key pk to generate ciphertext c. he And the hash value m for calculating the commitment value c2. ′ ;

[0028] The ciphertext c he The hash value m ′ and the commitment value π ′ Send it to the operator so that the operator can combine the private key share a2 and the temporary private key share p2 to generate ciphertext c3;

[0029] Receive the ciphertext c3, and combine it with the temporary private key share p1, the public key P2, and the private key sk to generate a signature σ2 of the commitment value c2.

[0030] Furthermore, the operator combines the private key share x2 and the temporary private key share k2 to generate ciphertext c3, including:

[0031] Verify the commitment value π ′ And in the promised value π ′ If the verification is successful, obtain the public key P1 and the proof π1;

[0032] Verify the proof π1, and if the proof π1 passes verification, calculate the point P = (p1 / 2) on the elliptic curve based on the temporary private key share p2 and the public key P1. x ,p y ); where p x Let p be the x-coordinate of point P. y Let be the ordinate of point P;

[0033] Based on the x-coordinate p x Generate the first part p of the signature;

[0034] From model q 2 Integer ring Select a random number ρ, and from the integer multiplication group modulo N Select random number in,

[0035] Calculate ciphertext

[0036] Calculate the intermediate value And for the intermediate value v and the ciphertext c key Perform an XOR operation to obtain the ciphertext c2;

[0037] The ciphertext c1 and the ciphertext c2 are XORed to obtain the ciphertext c3.

[0038] Further, by combining the temporary private key share p1, the public key P2, and the private key sk, a signature σ2 of the commitment value c2 is generated, including:

[0039] Based on the temporary private key share p1 and the public key P2, the first half p of the signature σ2 is obtained;

[0040] Decrypt the ciphertext c3 using the private key sk to obtain the decryption result s. ′ ;

[0041] Based on the decryption result s ′ And the temporary private key share p1, to obtain the intermediate value s ″ ;

[0042] Calculate the modulus q and the intermediate value s ″ The difference;

[0043] In the intermediate value s ″ and the modulus q and the intermediate value s ″ The smaller value is selected from the differences and used as the second half of the signature σ2, s.

[0044] A privacy-preserving authentication method compatible with standard SIM cards, applied to a user terminal, the method comprising:

[0045] A login request is initiated to the application based on the username to obtain the corresponding challenge value ch2; wherein, the username is recorded in the database according to the method of any one of claims 1 to 5;

[0046] After selecting a random number r3 and making a commitment to the application identity, challenge value ch2 and the random number r3, the two parties jointly and the operator will unintentionally sign the generated commitment value c3 to obtain the signature σ3.

[0047] The signature σ3, the commitment value c3, and the corresponding open key c3 are sent to the application so that the application can find the corresponding account public key PK in the database based on the username. ACC After verifying the signature σ3 and the commitment value c3, the application completes the authentication of the user terminal.

[0048] Furthermore, after the application completes authentication of the client, it also includes:

[0049] Based on the challenge value ch2, signature σ3, commitment value c3 and the opening corresponding to the commitment value c3, a hash value is generated;

[0050] Use this hash value as the session key for communication between the client and the application.

[0051] A privacy-preserving identity authentication system compatible with standard SIM cards, the system comprising: a user terminal, a telecommunications provider, and an application program; wherein the user terminal is used for:

[0052] Generate a username and initiate registration with the application based on the user identity in the SIM card to obtain the corresponding challenge value ch1;

[0053] The key generation phase, which involves unintentional signing by both the operator and the user, generates the user's account public key (PK). ACC ;

[0054] Choose a random number r1, and input the application identity, challenge value ch1, and account public key PK. ACC After making a commitment using the username and the random number r1, the generated commitment value c1 is sent to the application so that the application can use the application's private key SK. HN Sign the commitment value c1 to obtain the signature σ1;

[0055] After selecting a random number r2 and making a commitment to the application identity, challenge value ch1, and the random number r2, the generated commitment value c2 is sent to the operator to perform a signing phase of unintentional signing between the two parties and the operator, generating signature σ2.

[0056] Receive the signature σ1 and the signature σ2, and use the account public key PK ACC Verify the signature σ2;

[0057] Open the commitment value c1 and its corresponding value, open the commitment value c2 and its corresponding value, the signature σ1, the signature σ2, the username, and the account public key PK. ACC The message is sent to the application so that the application can verify the promise c1, the promise c2, the signature σ1, and the signature σ2 based on the open corresponding to the promise value c1 and the open corresponding to the promise value c2. After successful verification, the application will send the username and the account public key PK. ACC Record in the database;

[0058] Initiate a login request to the application based on the username to obtain the corresponding challenge value ch2;

[0059] After selecting a random number r3 and making a commitment to the application identity, challenge value ch2 and the random number r3, the two parties jointly and the operator will unintentionally sign the generated commitment value c3 to obtain the signature σ3.

[0060] The signature σ3, the commitment value c3, and the corresponding open key c3 are sent to the application so that the application can find the corresponding account public key PK in the database based on the username. ACC After verifying the signature σ3 and the commitment value c3, the application completes the authentication of the user terminal.

[0061] An electronic device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements either the privacy-preserving identity registration method for a compatible standard SIM card or the privacy-preserving identity authentication method for a compatible standard SIM card as described above.

[0062] A computer-readable storage medium, characterized in that the computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the privacy-preserving identity registration method for a compatible standard SIM card or the privacy-preserving identity authentication method for a compatible standard SIM card as described above.

[0063] Compared to existing technologies, this invention does not rely on additional hardware tokens, is compatible with existing SIM cards, and securely and efficiently achieves user-application authentication. It is based on the SIM card issued by the mobile operator, which is owned by all mobile phone users, and involves collaboration between the user and the operator to complete the application's authentication of the user. This invention offers high security and efficiency; even if an adversary compromises the operator, they cannot obtain the user's login behavior. It also protects user authentication from man-in-the-middle attacks, is compatible with existing SIM cards, requires no replacement of existing hardware, and is easy to deploy. This invention further enhances privacy protection, ensuring that user access behavior is not tracked, has excellent interoperability, and is suitable for large-scale 5G application deployment. Attached Figure Description

[0064] Figure 1 This is a flowchart illustrating the operation of the privacy-preserving identity authentication system compatible with standard SIM cards proposed in this invention. Detailed Implementation

[0065] To make the above-mentioned objectives, features and advantages of the present invention more apparent and understandable, the implementation process of the present invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0066] This invention is based on the AKMA authentication scheme framework proposed by 3GPP, and combines existing infrastructure such as SIM cards with 5G AKA protocol, TLS protocol and unintentional signature of two parties to design a brand-new identity authentication scheme. It does not require users to remember passwords, avoids the risk of man-in-the-middle attacks, is compatible with SIM and eSIM cards, and is a privacy-preserving identity authentication method and system that will not disclose user identity information.

[0067] A SIM card (Subscriber Identity Module) is a miniature smart card used to store a user's identity information, ensuring that mobile devices can connect to cellular networks and enable voice calls, SMS messaging, and data transmission. The key function of a SIM card is to store the user's identity identifier. For example, in traditional 2G, 3G, and 4G networks, the IMSI (International Mobile Subscriber Identity) in the SIM card is a globally unique user identifier used to connect to the mobile network. With the introduction of 5G networks, the user identifier in the SIM card has changed, with the IMSI gradually being replaced by the SUPI (Subscription Permanent Identifier). The SUPI plays a similar role to the IMSI in 5G, identifying the user. However, 5G networks have significantly improved privacy protection. To prevent eavesdropping, the SUPI is usually not transmitted directly but is converted to the SUCI (Subscription Concealed Identifier) ​​and transmitted encrypted, ensuring the security of the user's identity during network transmission. Only in the network core is the SUCI decrypted into the SUPI for user identification and authentication. SIM card form factors have evolved with technological advancements, from the initial standard SIM card to micro SIM and nano SIM, with sizes gradually shrinking to meet the miniaturization requirements of devices. In recent years, eSIM (Embedded SIM) has emerged as a new alternative. It no longer exists as a physical card but is instead a microchip embedded within the device. eSIM possesses the same functionality as a physical SIM card, securely storing the user's identity information (SUPI / IMSI) to ensure smooth network access and communication. In summary, both traditional physical SIM cards and embedded eSIMs can be considered trusted hardware, securely storing and managing the user's SUPI to ensure authentication with the core network.

[0068] 5G AKA (Authentication and Key Agreement) is a secure authentication mechanism in 5G networks used to establish a secure channel between user equipment (UE) and the core network, ensuring the legitimacy of communication. Its main function is to authenticate users based on the SUPI (Supplemental Identity Provider Interface) in the SIM card, ensuring that only legitimate users can access the core network, and generating a shared key for subsequent encrypted communication. The process begins with the UE requesting authentication from the network using an encrypted SUPI (SUCI). The core network retrieves the user's long-term key and SUPI, and generates an authentication vector (including a random number and expected response). The UE calculates a response value using its own SUPI and the random number sent by the network, and returns it to the core network. The core network compares the user's calculated response with its own; if they match, authentication is successful, and both parties establish a secure connection based on the shared key. By using an encrypted SUPI, the 5G AKA protocol effectively prevents user privacy leaks while ensuring the reliability of authentication and the security of data communication. Compared to 4G AKA, 5G AKA adds privacy protection measures to prevent SUPI leakage by using SUCI, thus improving the privacy and security of user identity.

[0069] The TLS (Transport Layer Security) protocol protects network communication security through a variety of functions. It encrypts data transmission, ensuring information is not eavesdropped on during transmission, thus protecting user privacy; by detecting and preventing data tampering, TLS ensures information integrity; by verifying the identities of both communicating parties with digital certificates, TLS ensures users are connecting to trusted servers, preventing man-in-the-middle attacks; furthermore, TLS generates session keys through a secure key negotiation mechanism, used to encrypt communication data, ensuring the security of the key exchange process. These functions make TLS a key protocol for protecting internet communication security and it is widely used in various network services requiring security guarantees.

[0070] Two-party unintentional signing is a signing method involving two parties, R1 and R2, and possesses the characteristic of being unintentional, meaning that only the party initiating the signing can obtain the final signature value. Considering the scenario where the two parties perform multiple key generation operations and generate multiple pairs of signing keys, this scheme allows one party to participate in signing without knowing which key generation attempt the other party is using. The two-party unintentional signing used in this invention includes a distributed key generation phase and a signing phase.

[0071] The goal of the distributed key generation phase is for both parties to jointly run the key generation protocol and jointly generate a random group element S as the signature PK. This phase involves only one round of interaction, and the specific process is as follows:

[0072] 1. R1 requests registration from R2, and P2 is in the ring of integers modulo q. Randomly select a2 as your private key share, and calculate the corresponding public key S2←a2·G (where... S2 is an elliptic curve group of order q, with generator G (if a2 already exists, then the value is reused). A proof π is also given to prove that you know the private key a2 corresponding to S2.

[0073] 2. R2 sends S2 and π to R1. After receiving the message from R2, R1 first verifies π. If the verification is successful, R1 then... Randomly select a1 as the private key share of R1, and calculate the public key S←a1·S2 based on S2 given by R2.

[0074] During the signature phase, R1 and R2 jointly generate a signature for message m, as follows:

[0075] 1. Before the protocol begins, R1 has a signing public key S, a message m to be signed, and a private key share a1 generated by R1 during the distributed key generation phase; R2 has a private key share a2 generated during the distributed key generation phase.

[0076] 2. R1 in Randomly select p1 as the temporary private key share, calculate the corresponding public key P1←p1·G, and provide a proof π1 for Q1, proving that you know the p1 corresponding to P1. At the same time, make a commitment to P1 and π1 to obtain the commitment value π. ′ , will π ′ Send to R2;

[0077] 3. R2 in Randomly select p2 as a temporary private key share, calculate the corresponding public key P2←p2·G, and provide a proof for P2 π2 to prove that you know the p2 corresponding to Q2;

[0078] 4. R2 sends P2 and π2 to R1. After receiving R2's message, R1 first verifies π2. If the verification is successful, it generates a Paillier-encrypted public-private key pair (pk, sk) and uses pk to encrypt R1's private key share a1, c. he =Enc pk (a1), and at the same time, calculate the hash value m of the message to be signed locally. ′ ←H(m);

[0079] 5. R1 will c he m ′ and the commitment π in the second step ′ The opened π is sent to R2, and R2 first verifies π. ′Then verify π1 and simultaneously calculate P←p2·P1 based on P1. P, as a point on the elliptic curve, can be used (p x ,p y Let p = p x mod q. R2 modulo q 2 Integer ring Randomly select ρ from the integer multiplication group modulo N. Choose random Where N is a group The modulus, calculate c1 = Enc pk (ρ·q+[p2 -1 ·m′mod q;r]),

[0080] 6. R2 sends c3 to R1. R1 calculates P←p·P2, which is the same as R2's calculation, and then calculates p in the same way as R2. R1 decrypts c3 using sk to obtain s′, and then multiplies the inverse of its own private key share with the decryption result to get... s′modq, select the smaller of s″ and qs″ as the signature s, generate the signature (p,s), and verify the signature using the public key S to ensure the correctness of the signature.

[0081] The privacy-preserving authentication system for standard SIM cards of this invention involves three parties: User Equipment (UE), Home Network (HN), and Application Function (AF). Its goal is for the user to complete authentication with the application, with the assistance of the operator, while preventing malicious operators from impersonating legitimate users to complete authentication. Before the protocol begins, the user possesses a SIM card issued by the operator, containing a key and the user's identity. The operator has all the SIM cards it has issued to users; that is, the operator knows the user's identity and public-private key pair (PK) on all users' SIM cards. HN SK HN The application has a public-private key pair (PK). AF SK AF In this protocol, users communicate with operators using the 5G AKA protocol, while users communicate with applications using the TLS protocol.

[0082] like Figure 1 As shown, the privacy-preserving identity authentication system compatible with standard SIM cards of the present invention operates, including a registration phase and an authentication phase.

[0083] The specific process during the registration phase is as follows:

[0084] 1) At the start of the registration phase, the user receives a challenge value of length λ generated by the application. Simultaneously, the user and the operator perform a key generation phase involving unintentional signing by both parties. The user acts as R1 in the signing scheme, while the operator acts as R2 in the signing process. After successful key generation, the user receives the public key of the unintentional signing by both parties. In this authentication scheme, this public key PK... ACC This serves as the public key for the account the user is registering this time.

[0085] 2) The user generates a username for the account registered this time, and performs an application identity verification, challenge, and account public key PK. ACC And the username selects a random number r1 as a commitment c1, allowing the operator to use its own private key SK. HN Signing the commitment value is a step to inform the application that the public key has been approved by the carrier. Having the carrier sign the commitment instead of the original text ensures that the application's identity and the user's account information are kept confidential from the carrier.

[0086] 3) The user commits to the application's identity and challenge using a random number r2 (c2), and then performs a signing phase with the operator, where both parties unwittingly sign the commitment. This signature can use the PK generated in the first step. ACC Let's verify.

[0087] 4) The user submits the above commitments c1 and c2, along with their opening, signing, username, and public key PK. ACC The message is sent to the application, which verifies both promises and signatures. Once verified, the username and public key are PK'd. ACC Recorded in the database.

[0088] The specific process for the certification stage is as follows:

[0089] 1) First, the user provides their username to the application to request login. The application sends a challenge to the user, and the user, along with the application's identity and the challenge, selects a random number r3 as a commitment c3, and interacts with the operator to jointly perform a two-way unintentional signature on the commitment.

[0090] 2) The user sends the signature and commitment to the application together. The application then looks up the public key (PK) corresponding to the account in the database based on the username. ACC The application verifies the signature and commitment. Once verification is successful, both parties will use the challenge, signature, commitment, and the hash of the commitment's open hash, transmitted within the channel, as the session key. At this point, the two parties have completed identity authentication.

[0091] The following is a specific experiment illustrating the privacy-preserving identity authentication system for standard SIM cards provided by this invention.

[0092] First, a theoretical analysis of the communication scale during the registration and authentication phases of this invention is presented. Unwittingly, both parties instantiate their signatures using ECDSA, the hash function used is SHA-256, the commitment scheme uses SHA3-256, and 32 bytes (256 bits) are used to represent the elliptic curve. The elements in the signature, with Paillier-encrypted ciphertext encoded in 768 bytes, assume the user's identity and the application's challenge value are both 256 bits. During registration, the user sends 1824 bytes to the operator, 384 bytes to the application, and receives 1152 bytes from the operator and 32 bytes from the application. During authentication, the user sends 1760 and 160 bytes to the operator and application respectively, and receives 960 and 32 bytes from the operator and application respectively. Our results focus on the messages exchanged between the participants, excluding metadata related to specific deployment contexts or underlying channels, such as metadata related to the TLS connection between the parties. The analysis shows that the main overhead of protocol communication occurs between the user and the operator, specifically during the unintentional signing phase, while the application's main task is to provide the authentication challenge and signature verification.

[0093] According to the privacy-preserving authentication scheme proposed in this invention, the privacy-preserving authentication protocol scheme was implemented and its performance was tested. Key generation and signing were implemented using the Golang libraries tronch0 / curv3 and tronch0 / crypt0. An iPhone 15 (equipped with an A16 processor and running iOS 18.1) was chosen as the performance testing platform. The aforementioned Golang implementation was built as a linkable library in the Swift language for iOS. We deployed a carrier cloud server and an application cloud server. Specifically, we equipped the carrier and application servers with 8-core (vCPU) Intel Xeon E5-2620 v4 CPUs and 32GB of RAM. The carrier server and application server are located in the same data center. Users connect to the servers via a 5G cellular network (i.e., 5G AKA), and the maximum network bandwidth for both the carrier and the application is 100Mbps. The latency between the user and the carrier is approximately 10ms, and the latency between the user and the application is approximately 20ms. Communication between the user and both servers is via HTTPS. This invention uses RSA4096 signatures to generate self-signed certificates for the carrier and the application, which is sufficient to simulate a TLS channel.

[0094] Experimental results show that during the authentication phase, the communication time between the user, the operator, and the application is 363.2645 milliseconds, while the user's local computation time is 633.4864 milliseconds. During the login phase, the communication time between the user, the operator, and the application is 203.7113 milliseconds, while the user's local computation time is 552 milliseconds. This indicates that the most time-consuming part of the protocol is the user's local computation time. However, due to the choice of signature scheme, this part can be pre-computed, and there will not be large-scale concurrent scenarios in this part. Therefore, the performance of this solution can be further improved in actual deployment.

[0095] In summary, this invention satisfies the conditions of authentication, operator indistinguishability, and application indistinguishability.

[0096] 1. Authentication. Even if an adversary attacks the operator and obtains its secrets, no one other than the user can impersonate the user and complete the authentication process with the application.

[0097] 2. Indistinguishable by the operator. When a user executes the protocol process, the operator only knows that the user has logged in, but does not know which specific application the user logged into. Although the signature needs to include the application's identity information, since the operator signs a commitment message, it does not disclose information about the application the user logged into.

[0098] 3. Application indistinguishability. If a user has multiple accounts on the same application, the application cannot link these accounts to the same person. This is because the public key associated with the user is jointly generated by the user and the operator, and the application cannot deduce the user's identity from the public key or signature itself, nor can it deduce the secret share used by the operator. Therefore, the user's identity is ensured to be untraceable.

[0099] Furthermore, this invention effectively solves 13 of the 17 issues concerning the 3GPP AKMA protocol outlined in TR33.835. Of the remaining issues, issues 1 and 13 relate to engineering implementation and are beyond the scope of this invention; issue 17 concerns active communication from the application to the user, primarily affecting devices with severe communication limitations; and issue 11 concerns lightweight instantiation of IoT devices. In summary, this invention is compatible with the vast majority of devices, except for a very few with extremely limited resources, and effectively solves almost all the issues outlined in TR33.835. Specifically, the 13 problems solved by this invention are as follows: This invention does not rely on a specific transport layer protocol (Problem 2); the authentication between the user and the operator is based on the SUPI in the SIM card, and the SUPI will not be leaked outside the core network (Problems 3, 4, 5, 7); it can avoid man-in-the-middle attacks by operators (Problem 6); different applications and users use different session keys (Problem 9); new authentication will update the session key (Problems 15, 16); the unintentional two-party signature used in this invention can be instantiated based on algorithms such as ECDSA, SM2, and Schnorr, which complies with the legal requirements of most countries (Problem 10); although this invention does not explicitly include a key revocation mechanism, it supports key update operations, which can be achieved by the user and the operator re-registering new accounts in the engineering implementation (Problem 14).

[0100] Although specific embodiments of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments, and the scope of protection claimed by the invention is defined by the claims.

Claims

1. A privacy-preserving identity registration method compatible with standard SIM cards, characterized in that, Applied to a user terminal, the method includes: Generate a username and initiate registration with the application based on the user identity in the SIM card to obtain the corresponding challenge value ch1; The key generation phase, which involves unintentional signing by both the operator and the user, generates the user's account public key (PK). ACC ; Choose a random number r1, and input the application identity, challenge value ch1, and account public key PK. ACC After making a commitment using the username and the random number r1, the generated commitment value c1 is sent to the application so that the application can use the application's private key SK. HN Sign the commitment value c1 to obtain the signature σ1; After selecting a random number r2 and making a commitment to the application identity, challenge value ch1, and the random number r2, the generated commitment value c2 is sent to the operator to perform a signing phase of unintentional signing between the two parties and the operator, generating signature σ2. Receive the signature σ1 and the signature σ2, and use the account public key PK ACC Verify the signature σ2; Open the commitment value c1 and its corresponding value, open the commitment value c2 and its corresponding value, the signature σ1, the signature σ2, the username, and the account public key PK. ACC The message is sent to the application so that the application can verify the promise c1, the promise c2, the signature σ1, and the signature σ2 based on the open corresponding to the promise value c1 and the open corresponding to the promise value c2. After successful verification, the application will send the username and the account public key PK. ACC Record it in the database.

2. The privacy-preserving identity registration method compatible with standard SIM cards according to claim 1, characterized in that, The key generation phase, in which the operator and the user perform an unintentional signature, generates the user's account public key PK. ACC ,include: Initiate a registration request to the operator so that the operator can participate in the modulo-q integer ring. A random value is selected as the operator's private key share a2, and the public key S2 and proof π are calculated based on the private key share a2; wherein, the proof π is used to prove that the operator knows the private key share a2 corresponding to the public key S2; Obtain the public key S2 and the proof π, and verify the proof π; If the proof of π passes, then in the modulo q integer ring... A random value is selected as the private key share a1 of the user terminal, and the signature public key S is calculated based on the private key share a1.

3. The privacy-preserving identity registration method compatible with standard SIM cards according to claim 2, characterized in that, The signing stage, in which the operator and the parties inadvertently sign each other, generates signature σ2, including: In the ring of integers modulo q A random value is selected as the temporary private key share p1 for the user. After calculating the public key P1 and the proof π1 based on the private key share p1, a commitment is made to the public key P1 and the proof π1 to obtain the commitment value π. ′ Wherein, the proof π1 is used to prove that the user knows the temporary private key share k1 corresponding to the public key R1; The system receives a public key P2 and a proof π2 from the operator and verifies the proof π2; wherein the public key P2 is generated based on the operator's temporary private key share p2, and the temporary private key share p2 is a modulo q integer ring. A random value in the public key P2, wherein the proof π2 is used to prove that the operator knows the temporary private key share p2 corresponding to the public key P2; If the π2 verification passes, a public-private key pair (pk, sk) is generated, and the private key share a1 is encrypted using the public key pk to generate ciphertext c. he And calculate the hash value m′ of the commitment value c2; The ciphertext c he The hash value m′ and the commitment value π′ are sent to the operator so that the operator can combine the private key share a2 and the temporary private key share p2 to generate ciphertext c3; Receive the ciphertext c3, and combine it with the temporary private key share p1, the public key P2, and the private key sk to generate a signature σ2 of the commitment value c2.

4. The privacy-preserving identity registration method compatible with standard SIM cards according to claim 3, characterized in that, The operator combines the private key share x2 and the temporary private key share k2 to generate ciphertext c3, including: Verify the commitment value π ′ And in the promised value π ′ If the verification is successful, obtain the public key P1 and the proof π1; Verify the proof π1, and if the proof π1 passes verification, calculate the point P = (p1 / 2) on the elliptic curve based on the temporary private key share p2 and the public key P1. x ,p y ); where p x Let p be the x-coordinate of point P. y Let be the ordinate of point P; Based on the x-coordinate p x Generate the first part r of the signature; From model q 2 Integer ring Select a random number ρ, and from the integer multiplication group modulo N Select random number in, Calculate the ciphertext c1 = Enc pk (ρ·q+[p2 -1 ·m′mod q;r]); Calculate the intermediate value And for the intermediate value v and the ciphertext c key Perform an XOR operation to obtain the ciphertext c2; The ciphertext c1 and the ciphertext c2 are XORed to obtain the ciphertext c3.

5. The privacy-preserving identity registration method compatible with standard SIM cards according to claim 3, characterized in that, Combining the temporary private key share p1, the public key P2, and the private key sk, a signature σ2 for the commitment value c2 is generated, including: Based on the temporary private key share p1 and the public key P2, the first half p of the signature σ2 is obtained; Decrypt the ciphertext c3 using the private key sk to obtain the decryption result s′; Based on the decryption result s ′ And the temporary private key share p1, to obtain the intermediate value s ″ ; Calculate the modulus q and the intermediate value s ″ The difference; In the intermediate value s ″ and the modulus q and the intermediate value s ″ The smaller value is selected from the differences and used as the second half of the signature σ2, s.

6. A privacy-preserving identity authentication method compatible with standard SIM cards, characterized in that, Applied to a user terminal, the method includes: A login request is initiated to the application based on the username to obtain the corresponding challenge value ch2; wherein, the username is recorded in the database according to the method of any one of claims 1 to 5; After selecting a random number r3 and making a commitment to the application identity, challenge value ch2 and the random number r3, the two parties jointly and the operator will unintentionally sign the generated commitment value c3 to obtain the signature σ3. The signature σ3, the commitment value c3, and the corresponding open key c3 are sent to the application so that the application can find the corresponding account public key PK in the database based on the username. ACC After verifying the signature σ3 and the commitment value c3, the application completes the authentication of the user terminal.

7. The privacy-preserving identity authentication method compatible with standard SIM cards according to claim 6, characterized in that, After the application completes authentication of the client, the following steps are also included: Based on the challenge value ch2, signature σ3, commitment value c3 and the opening corresponding to the commitment value c3, a hash value is generated; Use this hash value as the session key for communication between the client and the application.

8. A privacy-preserving identity authentication system compatible with standard SIM cards, characterized in that, The system includes: a user terminal, a telecommunications provider, and an application program; wherein, the user terminal is used for: Generate a username and initiate registration with the application based on the user identity in the SIM card to obtain the corresponding challenge value ch1; The key generation phase, which involves unintentional signing by both the operator and the user, generates the user's account public key (PK). ACC ; Choose a random number r1, and input the application identity, challenge value ch1, and account public key PK. ACC After making a commitment using the username and the random number r1, the generated commitment value c1 is sent to the application so that the application can use the application's private key SK. HN Sign the commitment value c1 to obtain the signature σ1; After selecting a random number r2 and making a commitment to the application identity, challenge value ch1, and the random number r2, the generated commitment value c2 is sent to the operator to perform a signing phase of unintentional signing between the two parties and the operator, generating signature σ2. Receive the signature σ1 and the signature σ2, and use the account public key PK ACC Verify the signature σ2; Open the commitment value c1 and its corresponding value, open the commitment value c2 and its corresponding value, the signature σ1, the signature σ2, the username, and the account public key PK. ACC The message is sent to the application so that the application can verify the promise c1, the promise c2, the signature σ1, and the signature σ2 based on the open corresponding to the promise value c1 and the open corresponding to the promise value c2. After successful verification, the application will send the username and the account public key PK. ACC Record in the database; Initiate a login request to the application based on the username to obtain the corresponding challenge value ch2; After selecting a random number r3 and making a commitment to the application identity, challenge value ch2 and the random number r3, the two parties jointly and the operator will unintentionally sign the generated commitment value c3 to obtain the signature σ3. The signature σ3, the commitment value c3, and the corresponding open key c3 are sent to the application so that the application can find the corresponding account public key PK in the database based on the username. ACC After verifying the signature σ3 and the commitment value c3, the application completes the authentication of the user terminal.

9. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the privacy-preserving identity registration method for a compatible standard SIM card as described in any one of claims 1-5 or the privacy-preserving identity authentication method for a compatible standard SIM card as described in any one of claims 6-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the privacy-preserving identity registration method for a compatible standard SIM card as described in any one of claims 1-5 or the privacy-preserving identity authentication method for a compatible standard SIM card as described in any one of claims 6-7.

Images