Privacy protection method and system based on cryptographic application security

Abstract

The application belongs to the technical field of information security, and specifically discloses a privacy protection method and system based on password application security. The method comprises the following steps: after login, assigning a credential level according to user attributes and generating an anonymous identifier; combining a tracing authorized party public key to calculate a credential value and storing an identity mapping; calculating a user public key and a private key segment based on the anonymous identifier, combining the credential value to form a complete signature private key; selecting two random numbers by the user to generate a public label, calculating a primary signature and sending the primary signature to an intermediate agency; the intermediate agency determines a blinding factor strength parameter, superimposes a blinding factor to generate a final signature; and a verification party verifies that the signature is valid by verifying that a double linear pairing verification equation is established. The application realizes signature anonymity through the cooperation of the intermediate agency and the superposition of the blinding factor, realizes traceability through the generation of the credential value by the tracing authorized party public key and the private key extraction mechanism, and realizes the unity of signature anonymity and traceability.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and specifically relates to a privacy protection method and system based on cryptographic application security. Background Technology

[0002] With the rapid development of the digital economy, electronic signature technology is being used more and more widely. Identity-based signature schemes directly map user identity information to public keys, avoiding the burden of certificate management and offering significant advantages in simplifying key management processes.

[0003] Most existing identity-based signature schemes employ a single signer who independently completes all signing operations. This means the signer directly uses their private key to sign the message and outputs the complete signature. The entire signing process lacks the involvement of an intermediary, and there is a direct mathematical relationship between the signature value and the signer's private key. Attackers can analyze the relationship between the signature value and the public key to correlate the signer's identity, making true anonymity difficult to achieve. Even with group signature schemes, while the specific identity of the signer can be hidden, their anonymity depends on the trustworthiness of the group administrator, who possesses the identity information of all members, posing a single point of failure risk. Furthermore, existing signature schemes struggle to strike a balance between anonymity and traceability: on the one hand, fully anonymous signature schemes cannot trace the signer's true identity in case of disputes, hindering post-event auditing and accountability; on the other hand, fully traceable signature schemes typically require embedding identifiable information within the signature, resulting in insufficient anonymity. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the existing technology and provide a privacy protection method based on cryptographic application security.

[0005] A first aspect of the present invention provides a privacy protection method based on cryptographic application security, comprising: Step 1: After a user successfully logs in, a credential level is assigned based on the user's attributes, and a public anonymous identifier is generated; Step 2: Generate a unique index for the user and select a random number. Combine the credential value with the preset public key of the traceability authorization party, store the mapping relationship between the user's real identity, unique index, credential level and credential value, and return the anonymous identifier, credential value and credential level to the user. Step 3: Select the corresponding security parameters based on the credential level, and calculate the user's public key and private key fragments based on the anonymous identifier. Send the private key fragments to the user, who will then combine the private key fragments with the credential value to form a complete signed private key. Step 4: The user selects two random numbers and calculates two public tags respectively. The message to be signed is hashed with the public tags, anonymous identifier, and credential level to obtain the signature hash value. The initial signature value is calculated using the private key fragment, random numbers, and credential value. The initial signature value, public tags, anonymous identifier, and credential level are then sent to the intermediary institution to form the initial signature. Step 5: The intermediary determines the blinding factor strength parameter based on the credential level, selects a new random number to generate a public label, superimposes the blinding factor on the initial signature value, and generates the final signature value by combining it with the random number it selects. The final signature is output, which includes three public labels, the final signature value, the anonymity identifier, and the credential level. Step 6: The verifier performs a hash operation on the message to be signed, the three public tags, the anonymous identifier, and the credential level to obtain the verification hash value. Using the system master public key, the traceability authorizing party's public key, and the blinding factor strength parameter, the verifier verifies whether the equation is true through a bilinear pairing operation. If it is true, the signature is valid; otherwise, the signature is invalid.

[0006] A further solution is that when it is necessary to trace the identity of the signature, the traceability authorizing party uses the traceability private key to extract the credential value from the final signature, and obtains the user's real identity and credential level based on the credential value.

[0007] A further solution is to generate a record library for each key operation, which includes the operation type, operation subject identifier, timestamp, and operation details, and calculate the hash value of the record library. The hash value corresponding to the record library of the previous key operation is concatenated with the record library of the current key operation and then hashed to obtain the hash value of the current record library, forming a hash chain. A timestamp is added to the latest hash value of the hash chain at preset time intervals. The key operations include: user registration, user login, credential issuance, signature key calculation, signature generation, signature verification, and identity tracing.

[0008] A further solution is that step 1, user login, includes: receiving the real identity, username, and password submitted by the user; generating a unique random salt value for each user; concatenating the random salt value with the password and performing a hash calculation to obtain the login hash value; and storing the correspondence between the username, random salt value, password hash, and real identity. When a user logs in, a random salt value is retrieved based on the username. The input password is concatenated with the random salt value, and a hash calculation is performed. This hash is then compared with the login hash value. If they match, the login is successful.

[0009] A further solution is that step 2, in which the credential value is calculated using the preset public key of the traceability authorizing party, includes: The credential value is obtained by performing an elliptic curve multiplication operation between the authorized party's preset public key and the random number generated for the user.

[0010] A further approach is that step 3, which calculates the user's public and private key fragments based on the anonymous identifier, includes: An anonymous identifier is mapped to a point on an elliptic curve using a hash function, which serves as the user's public key. The system master private key and the user's public key are multiplied by an elliptic curve to obtain a fragment of the user's private key.

[0011] A further solution is that, in step 4, the user selects two random numbers, and in step 5, the intermediate mechanism selects one random number, wherein: The first random number selected by the user is used to generate the first public label. This first public label, together with the hash value, participates in the signature value calculation and is used to prove that the signer holds a valid private key fragment. The second random number selected by the user is used to generate the second public tag. This second public tag, together with the public key of the traceability certifier, participates in the signature value calculation. It is used to bind the traceability credential in the signature, so that the traceability certifier can extract the credential value from the signature to restore the true identity of the signer in the event of a dispute. The third random number selected by the intermediary is used to generate the third public tag. This third public tag, together with the user-generated signature value, participates in the final signature value calculation. It is used to add an intermediary to the signature so that the final signature cannot be associated with the user alone.

[0012] A second aspect of the present invention provides a privacy protection system based on cryptographic application security for implementing the above-described method, comprising: The authentication module is used to log in users and determine whether the login was successful. The credential hierarchy module is used to assign credential levels based on user attributes and generate a public anonymous identifier after a user successfully logs in; and to generate a unique index for the user and select a random number, combine it with the preset public key of the traceability module to calculate the credential value, store the mapping relationship between the user's real identity, unique index, credential level and credential value, and output the anonymous identifier, credential value and credential level. The key generation module is used to select the corresponding security parameters based on the credential level, and to calculate the user's public key and private key fragments based on the anonymous identifier, and output the private key fragments; the private key fragments are used to combine with the credential value to form a complete signature private key; The traceability module has a pre-set traceability private key, which is used to extract the credential value from the final signature and obtain the user's real identity and credential level from the credential classification module based on the credential value. The collaborative signature module is used to receive the initial signature generated by the user. The initial signature includes two public tags, an initial signature value, an anonymous identifier, and a credential level. The system determines the blinding factor strength parameter based on the credential level, selects a new random number to generate a third public label, superimposes the blinding factor onto the initial signature value, combines the selected random number to generate the final signature value, and outputs the final signature containing three public labels, the final signature value, the anonymity identifier, and the credential level. The verification module receives the final signature, performs a hash operation on the message to be signed, three public tags, anonymity identifier, and credential level to obtain the verification hash value, and uses the system master public key, the traceability module's public key, and the blinding factor strength parameter to verify whether the equation is true through bilinear pairing operation, and outputs a signature valid signal when the equation is true.

[0013] A further solution is that the authentication module includes: a registration unit, used to receive the real identity, username and password submitted by the user, generate a unique random salt value for each user, concatenate the random salt value with the password to calculate the hash value, and store the correspondence between the username, random salt value, password hash and real identity; The login unit is used to retrieve a random salt value based on the username, add salt to the input password, calculate the hash, compare it with the stored value, and determine successful login when the comparison matches.

[0014] A further solution includes a tracking module, which generates a record library for each key operation, containing the operation type, operation subject identifier, timestamp, and operation details. It calculates the hash value of the record library, concatenates the hash value of the record library corresponding to the previous key operation with the record library of the current key operation, performs hash calculation, obtains the hash value of the current record library, forms a hash chain, and adds a timestamp to the latest hash value of the hash chain at preset time intervals.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: In this invention, the user only completes the initial signature, which contains a combination of the user's private key fragment and the credential value, but is not directly output as the final signature. After receiving the initial signature, the intermediary selects a new random number to generate a third public tag, and adds a blinding factor to the initial signature value to generate the final signature value. This makes the final signature value contain multiple contributions from the user's private key fragment, the credential value, the blinding factor, and the intermediary's random number. It is impossible to reverse-engineer the user's identity by parsing the final signature. When verifying, the verifier can only confirm the validity of the signature but cannot know the identity of the signer. This fundamentally solves the problem in the prior art where the signature value is directly related to the signer's private key, making the signer's identity easy to analyze and track.

[0016] This invention generates a credential value by performing an elliptic curve multiplication operation on a random number using a preset public key of the traceability authorizing party. It then stores the mapping relationship between the credential value and the user's real identity. During normal signature verification, the traceability authorizing party's public key is only used as a public parameter in the calculation; the verifying party cannot extract identity information, ensuring that the anonymity of the signing process remains unaffected. When traceability is required, the traceability authorizing party uses a preset traceability private key to extract the credential value from the final signature and transmits it to the credential classification module. The credential classification module then uses the pre-stored mapping relationship to find the corresponding user's real identity and credential level, achieving accountability traceability. This approach maintains signature anonymity while preserving complete traceability, resolving the contradiction between anonymity and traceability in existing technologies.

[0017] This invention generates a unique random salt value for each user. This salt value is concatenated with the password and stored as a hash value. Even if the database is leaked, attackers cannot use rainbow tables to reverse-engineer the user's original password. Furthermore, the same password from different users will produce completely different hash values ​​due to different random salt values, effectively preventing the risk of multi-account linkage and leakage. In addition, credential levels are assigned according to user attributes. These credential levels not only determine the signing permissions that the user can obtain later, but also serve as the basis for selecting the blinding factor strength parameter. This allows high-risk scenarios or high-credit users to obtain stronger privacy protection, while low-risk scenarios can adopt weaker protection strategies to improve efficiency. Moreover, the login process only verifies the user's identity. The generation and issuance of the signing key are completed by an independent key generation module. Even if the login credentials are leaked, attackers cannot directly obtain signing capabilities. Attached Figure Description

[0018] The following figures are for illustrative purposes only and are not intended to limit the scope of the invention, wherein: Figure 1 : Schematic diagram of the privacy protection method of this invention; Figure 2 : Schematic diagram of the successful login determination process; Figure 3 : Schematic diagram of the signature verification success determination process. Detailed Implementation

[0019] To make the objectives, technical solutions, design methods, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the invention.

[0020] Example 1 This embodiment provides a privacy protection method based on cryptographic application security, such as... Figure 1 As shown, it includes the following steps: After a user successfully logs in, a credential level is assigned based on the user's attributes, and a public anonymous identifier is generated. Based on the user's credit score, business scenario sensitivity, and other attributes, the user is divided into three levels: public, internal, or confidential, with each level corresponding to a different security policy.

[0021] A unique index is generated for each user, and a random number is selected. This, combined with the authorized party's pre-defined public key, is used to calculate the credential value. The mapping relationship between the user's real identity, unique index, credential level, and credential value is stored, and the anonymous identifier, credential value, and credential level are returned to the user. The credential value is calculated by performing an elliptic curve multiplication operation between the authorized party's public key and the user's random number.

[0022] After obtaining the credential value, the user selects the corresponding security parameters based on the credential level and calculates the user's public and private key fragments based on the anonymous identifier. The user's public key is obtained by mapping the anonymous identifier to a point on an elliptic curve using a hash function; the user's private key fragment is obtained by performing an elliptic curve multiplication operation between the system's master private key and the user's public key. The key generation center sends the private key fragment to the user, who combines the private key fragment with the credential value to form a complete signed private key.

[0023] The user selects two random numbers, multiplies them by the generators published by the system, and obtains two public labels. and The message to be signed and , The anonymous identifier and credential level are hashed together to obtain a hash value. .

[0024] The user calculates the initial signature value using a fragment of their private key, the first random number, the system's master public key, and the credential value. .Will , , Anonymous identifiers and credential levels are packaged into an initial signature and sent to an intermediary institution.

[0025] Upon receiving the initial signature, the intermediary agency first verifies its validity. If verification is successful, the intermediary agency determines the blinding factor strength parameter based on the credential level, where the blinding factor strength parameter determines the strength of privacy protection. The intermediary agency then selects a new random number and multiplies it by the system's publicly available generator to obtain the third public tag. The intermediary uses homomorphic encryption to add a blinding factor to the signature, along with a randomly selected number, to generate the final signature value. The final signature contains three public tags. , , Final signature value Anonymous identifiers and credential levels.

[0026] like Figure 3 As shown, after receiving the final signature, the verifier performs a hash operation on the message to be signed, the three public tags, the anonymity identifier, and the credential level to obtain the verification hash value. The verifier then uses the system master public key, the traceability authorizing party's public key, and the blinding factor strength parameter to verify whether the following equation holds true through a bilinear pairing operation: ; in, It is a bilinear mapping. For public generators, For the system master public key, To trace the public key of the authorizing party, For the user's public key, The hash value calculated when the user first signs. This is the blinding factor strength parameter. If the equation holds true, the signature is valid; otherwise, it is invalid.

[0027] like Figure 2 As shown, the authentication center receives the user's real identity, username, and password. It generates a unique random salt value for each user, concatenates this random salt value with the password, performs a hash calculation to obtain the password hash value, and stores the correspondence between username, random salt value, password hash, and real identity. When a user logs in, the authentication center retrieves the corresponding salt value based on the username, concatenates the entered password with this salt value, performs the same hash calculation, and compares the result with the stored password hash value. If they match, the login is successful. In this way, even if the database is leaked, attackers cannot use rainbow tables to reverse-engineer the user's original password. Furthermore, the same password from different users will produce completely different hash values ​​due to different salt values, effectively preventing the risk of multi-account linked leaks.

[0028] In this embodiment, the user selects two random numbers. and Among them, the first random number Used to generate the first public tag The public label and hash value They jointly participate in the signature value calculation, which proves that the signer possesses a valid private key fragment. The second random number... Used to generate a second public label The public label is linked to the public key of the tracing authorized party. They jointly participate in the signature value calculation, which is used to bind traceability credentials to the signature, enabling the authorized party to extract the credential value from the signature to restore the signer's true identity in the event of a dispute. An intermediary selects a third random number. This is used to generate a third public tag, which, together with the user-generated signature value, participates in the final signature value calculation. It is used to add the contribution of an intermediary to the signature, so that the final signature cannot be associated with the user alone.

[0029] In this embodiment, when a dispute arises requiring verification of the signature's identity, the verification authority uses its pre-set and secretly stored verification private key to extract the credential value from the final signature. Specifically, the verification authority decrypts the final signature using mathematical operations, searches for the unique index corresponding to the credential value based on a pre-stored mapping relationship, and thus obtains the user's true identity and credential level, returning it to the verification authority to complete the identity verification process.

[0030] In this embodiment, to ensure the sequential integrity and tamper-proof capability of the audit logs, a record database containing the operation type, operation subject identifier, timestamp, and operation details is generated for each key operation. For example, corresponding record databases are generated for operations such as user registration, user login, credential issuance, signature key calculation, signature generation, signature verification, and identity tracing. For each record database, the system concatenates its content with the hash value of the previous record database to calculate a new hash value, which serves as the fingerprint of this record database. All record databases are linked together through hash values, forming a hash chain. Furthermore, a timestamp is added to the latest hash value of the hash chain at preset time intervals.

[0031] Example 2 Based on Embodiment 1, this embodiment also discloses a privacy protection system based on cryptographic application security, including an authentication module, a credential hierarchy module, a key generation module, a traceability module, a collaborative signature module, and a verification module.

[0032] The authentication module is responsible for user account management and login authentication. It includes a registration unit and a login unit. The registration unit receives the user's real identity, username, and password, generates a unique random salt value for each user, concatenates the random salt value with the password, calculates the hash value, and stores the correspondence between the username, random salt value, password hash, and real identity. The login unit retrieves the random salt value based on the username, salts the input password, calculates the hash value, compares it with the stored value, and determines successful login if the comparison matches.

[0033] The credential hierarchy module connects to the authentication module. After a user successfully logs in, it assigns a credential level based on user attributes and generates a public anonymous identifier. Simultaneously, it generates a unique index for the user, selects a random number, and calculates the credential value using a preset public key from the traceability module. It stores the mapping relationship between the user's real identity, unique index, credential level, and credential value, and outputs the anonymous identifier, credential value, and credential level. The credential hierarchy module also connects to the key generation module and the traceability module, providing the key generation module with the anonymous identifier and credential level, and providing the traceability module with a mapping query service between credential value and user identity.

[0034] The key generation module connects to the credential hierarchy module and is responsible for deriving the signing key. Based on the credential level, the key generation module selects the corresponding security parameters, calculates the user's public and private key fragments based on the anonymous identifier, and outputs the private key fragment. After receiving the private key fragment, the user combines it with the credential value to form the complete signing private key. The key generation module does not depend on the login status of the authentication module; the user obtains the signing key regardless of whether the user is online, ensuring separation between login authentication and signing capability acquisition.

[0035] The traceability module has a pre-set traceability private key, which is responsible for extracting the credential value from the final signature in the event of a dispute, and obtaining the user's real identity and credential level from the credential hierarchy module based on the credential value. The traceability module is connected to the credential hierarchy module and is only activated when a dispute occurs. It does not participate in the normal signature verification process, ensuring that the anonymity of the signature is not affected.

[0036] The collaborative signature module connects with the user and verification modules and is responsible for generating the final signature. It receives the initial signature generated by the user (containing two public tags, an initial signature value, an anonymity identifier, and a credential level), verifies its validity, determines the blinding factor strength parameter based on the credential level, generates a third public tag using a new random number, adds the blinding factor to the initial signature value, and combines it with its own selected random number to generate the final signature value. The module then outputs the final signature, which includes the three public tags, the final signature value, the anonymity identifier, and the credential level. The involvement of the collaborative signature module introduces the contribution of an intermediary into the final signature, making it impossible to attribute solely to the user.

[0037] The verification module connects to the collaborative signature module and is responsible for verifying the validity of the signature. This module receives the final signature output by the collaborative signature module, performs a hash operation based on the message to be signed, three public tags, anonymity identifier, and credential level to obtain a verification hash value, and uses the system master public key, the traceability module's public key, and the blinding factor strength parameter to verify whether the equation holds true through a bilinear pairing operation. If the equation holds true, it outputs a signature validity signal.

[0038] In this embodiment, to ensure that the system forms an immutable audit record for all critical operations and meets the compliance requirements of post-audit, the system also includes a tracking module. The tracking module is connected to the authentication module, credential hierarchy module, key generation module, collaborative signature module, verification module, and traceability module. It is responsible for generating and managing audit logs, generating a record library for each critical operation that includes the operation type, operation subject identifier, timestamp, and operation details. It calculates the hash value of the record library, concatenates the hash value of the record library corresponding to the previous critical operation with the record library of the current critical operation, and performs a hash calculation to obtain the hash value of the current record library, forming a hash chain. A timestamp is added to the latest hash value of the hash chain at preset time intervals.

[0039] The modules in this embodiment communicate through a secure channel, together forming a multi-party collaborative signature system that supports anonymous authentication, traceability, and adaptive optimization.

[0040] The various embodiments of the present invention have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A privacy protection method based on cryptographic application security, characterized in that, include: Step 1: After a user successfully logs in, a credential level is assigned based on the user's attributes, and a public anonymous identifier is generated; Step 2: Generate a unique index for the user and select a random number. Combine the credential value with the preset public key of the traceability authorization party, store the mapping relationship between the user's real identity, unique index, credential level and credential value, and return the anonymous identifier, credential value and credential level to the user. Step 3: Select the corresponding security parameters based on the credential level, and calculate the user's public key and private key fragments based on the anonymous identifier. Send the private key fragments to the user, who will then combine the private key fragments with the credential value to form a complete signed private key. Step 4: The user selects two random numbers and calculates two public tags respectively. The message to be signed is hashed with the public tags, anonymous identifier, and credential level to obtain the signature hash value. The initial signature value is calculated using the private key fragment, random numbers, and credential value. The initial signature value, public tags, anonymous identifier, and credential level are then sent to the intermediary institution to form the initial signature. Step 5: The intermediary determines the blinding factor strength parameter based on the credential level, selects a new random number to generate a public label, superimposes the blinding factor on the initial signature value, and generates the final signature value by combining it with the random number it selects. The final signature is output, which includes three public labels, the final signature value, the anonymity identifier, and the credential level. Step 6: The verifier performs a hash operation on the message to be signed, the three public tags, the anonymous identifier, and the credential level to obtain the verification hash value. Using the system master public key, the traceability authorizing party's public key, and the blinding factor strength parameter, the verifier verifies whether the equation is true through a bilinear pairing operation. If it is true, the signature is valid; otherwise, the signature is invalid.

2. The privacy protection method based on cryptographic application security according to claim 1, characterized in that, Step 1, user login, includes: receiving the real identity, username, and password submitted by the user; generating a unique random salt value for each user; concatenating the random salt value with the password and performing a hash calculation to obtain the login hash value; and storing the correspondence between the username, random salt value, password hash, and real identity. When a user logs in, a random salt value is retrieved based on the username. The input password is concatenated with the random salt value, and a hash calculation is performed. This hash is then compared with the login hash value. If they match, the login is successful.

3. The privacy protection method based on cryptographic application security according to claim 2, characterized in that, Step 2, which involves calculating the credential value using the pre-set public key of the tracing authorizer, includes: The credential value is obtained by performing an elliptic curve multiplication operation between the authorized party's preset public key and the random number generated for the user.

4. The privacy protection method based on cryptographic application security according to claim 3, characterized in that, Step 3, which involves calculating the user's public and private key fragments based on the anonymous identifier, includes: An anonymous identifier is mapped to a point on an elliptic curve using a hash function, which serves as the user's public key. The system master private key and the user's public key are multiplied by an elliptic curve to obtain a fragment of the user's private key.

5. The privacy protection method based on cryptographic application security according to claim 4, characterized in that, In step 4, the user selects two random numbers; in step 5, the intermediate mechanism selects one random number, wherein: The first random number selected by the user is used to generate the first public label. This first public label, together with the hash value, participates in the signature value calculation and is used to prove that the signer holds a valid private key fragment. The second random number selected by the user is used to generate the second public tag. This second public tag, together with the public key of the traceability certifier, participates in the signature value calculation. It is used to bind the traceability credential in the signature, so that the traceability certifier can extract the credential value from the signature to restore the true identity of the signer in the event of a dispute. The third random number selected by the intermediary is used to generate the third public tag. This third public tag, together with the user-generated signature value, participates in the final signature value calculation. It is used to add an intermediary to the signature so that the final signature cannot be associated with the user alone.

6. The privacy protection method based on cryptographic application security according to claim 5, characterized in that, When it is necessary to trace the identity of the signature, the traceability authorizing party uses the traceability private key to extract the credential value from the final signature, and obtains the user's real identity and credential level based on the credential value.

7. The privacy protection method based on cryptographic application security according to claim 6, characterized in that, For each key operation, a record library containing operation type, operation subject identifier, timestamp, and operation details is generated, and the hash value of the record library is calculated. The hash value corresponding to the record library of the previous key operation is concatenated with the record library of the current key operation and hash calculation is performed to obtain the hash value of the current record library, forming a hash chain. A timestamp is added to the latest hash value of the hash chain at preset time intervals. The key operations include: user registration, user login, credential issuance, signature key calculation, signature generation, signature verification, and identity tracing.

8. A privacy protection system based on cryptographic application security, characterized in that, To implement the method of any one of claims 1-7, comprising: The authentication module is used to log in users and determine whether the login was successful. The credential hierarchy module is used to assign credential levels based on user attributes and generate a public anonymous identifier after a user successfully logs in; and to generate a unique index for the user and select a random number, combine it with the preset public key of the traceability module to calculate the credential value, store the mapping relationship between the user's real identity, unique index, credential level and credential value, and output the anonymous identifier, credential value and credential level. The key generation module is used to select the corresponding security parameters based on the credential level, and to calculate the user's public key and private key fragments based on the anonymous identifier, and output the private key fragments; the private key fragments are used to combine with the credential value to form a complete signature private key; The traceability module has a pre-set traceability private key, which is used to extract the credential value from the final signature and obtain the user's real identity and credential level from the credential classification module based on the credential value. The collaborative signature module is used to receive the initial signature generated by the user. The initial signature includes two public tags, an initial signature value, an anonymous identifier, and a credential level. The system determines the blinding factor strength parameter based on the credential level, selects a new random number to generate a third public label, superimposes the blinding factor onto the initial signature value, combines the selected random number to generate the final signature value, and outputs the final signature containing three public labels, the final signature value, the anonymity identifier, and the credential level. The verification module receives the final signature, performs a hash operation on the message to be signed, three public tags, anonymity identifier, and credential level to obtain the verification hash value, and uses the system master public key, the traceability module's public key, and the blinding factor strength parameter to verify whether the equation is true through bilinear pairing operation, and outputs a signature valid signal when the equation is true.

9. The privacy protection system based on cryptographic application security according to claim 8, characterized in that, The authentication module includes: a registration unit, used to receive the real identity, username and password submitted by the user, generate a unique random salt value for each user, concatenate the random salt value with the password to calculate the hash value, and store the correspondence between username, random salt value, password hash and real identity; The login unit is used to retrieve a random salt value based on the username, add salt to the input password, calculate the hash, compare it with the stored value, and determine successful login when the comparison matches.

10. The privacy protection system based on cryptographic application security according to claim 9, characterized in that, The system also includes a tracking module, which generates a record library for each key operation, containing the operation type, operation subject identifier, timestamp, and operation details. It calculates the hash value of the record library, concatenates the hash value of the record library corresponding to the previous key operation with the record library of the current key operation, performs hash calculation, obtains the hash value of the current record library, forms a hash chain, and adds a timestamp to the latest hash value of the hash chain at preset time intervals.

Images