Credential privacy protection, cross-domain aggregation, verification method and device

Abstract

The application provides a credential privacy protection, cross-domain aggregation and verification method and device, wherein the method comprises the following steps: obtaining a resource access policy issued by a verification end; determining a minimum attribute information set meeting the resource access policy from original credential data held locally based on the resource access policy; generating zero-knowledge proof based on the minimum attribute information set; and the zero-knowledge proof is used to prove that there is a set of valid verifiable credentials meeting the minimum attribute information set. The method realizes data minimization disclosure through policy-driven minimum attribute information set calculation, and eliminates excessive exposure of original detailed information of the credential from the source; a verifiable cryptographic evidence meeting the condition is generated without disclosing any original credential evidence to the verification party, and the end user can obtain service authorization on the premise that only the existence of valid credentials meeting the minimum attribute information set is proved, so that the business logic is ensured and the privacy protection of the user credential content is realized.

Description

Technical Field

[0001] This invention relates to the field of digital identity authentication technology, and in particular to a method and apparatus for credential privacy protection, cross-domain aggregation, and verification. Background Technology

[0002] In the field of digital identity authentication, users often need to present digital credentials issued by different authoritative institutions (issuers) to online service providers (verifiers) to prove their combined qualifications, such as meeting income, credit and asset conditions when applying for a loan.

[0003] Current mainstream solutions require users to submit multiple original credentials or copies thereof, raising serious privacy and efficiency issues. First, verifiers can easily link credential identifiers and timestamps to user behavior across different scenarios, building detailed behavioral profiles and leading to privacy breaches. Second, to satisfy a complex logical condition, users are often forced to excessively disclose the complete content of all relevant credentials, violating the principle of data minimization; for example, revealing specific amounts to prove income exceeds a threshold. Third, the process is cumbersome, requiring users to manually combine multiple documents, and verifiers to verify each one individually, resulting in low efficiency.

[0004] Regarding privacy protection, existing technologies mostly focus on hiding or anonymously presenting attributes within a single credential, but fail to address the issues of collaborative verification across multiple independent credentials and overall privacy protection. Some solutions involving multi-attribute processing often rely on centralized aggregators with access to users' raw data, which inherently constitutes a new single point of failure for privacy and a performance bottleneck. Although standards such as verifiable credentials define data formats, they do not specify how to achieve cross-domain, association-free privacy-preserving aggregation computation.

[0005] Therefore, existing technologies struggle to achieve secure aggregation of cross-domain identities, policy-driven minimal disclosure, and prevention of user behavior association while ensuring user experience and verification efficiency, making it a pressing technical challenge to be addressed in this field. Summary of the Invention

[0006] This invention provides a method and apparatus for credential privacy protection, cross-domain aggregation, and verification, which solves the problems of easy leakage of user privacy, correlation of behavior, and excessive exposure of information in cross-domain multi-credential verification in the prior art. Under the premise of meeting complex verification strategies, it supports anonymous and secure aggregation of cross-domain credentials, policy-driven minimal and accurate disclosure of information, and fundamentally prevents the verification party from associating and tracking user identity and behavior in different business scenarios.

[0007] On one hand, the present invention provides a credential privacy protection method applied to a user end, comprising: obtaining a resource access policy published by a verification end; determining a minimum set of attribute information that satisfies the resource access policy from locally held original credential data based on the resource access policy; generating a zero-knowledge proof based on the minimum set of attribute information, and sending the zero-knowledge proof to an aggregation end or a verification end; wherein the zero-knowledge proof is used to prove that there exists a set of valid verifiable credentials that satisfies the minimum set of attribute information.

[0008] Further, determining the minimum set of attribute information that satisfies the resource access policy from the locally held original credential data based on the resource access policy includes: parsing the original credential data to obtain the declaration content of one or more verifiable credentials; matching the logical conditions in the resource access policy with the declaration content of the verifiable credentials; calculating and outputting the minimum set of attribute information based on the matching result; the minimum set of attribute information includes the minimum amount of declaration information that needs to be disclosed to make the resource access policy evaluate to true.

[0009] Furthermore, generating a zero-knowledge proof based on the minimum attribute information set includes: generating a blinding factor for the original voucher data related to the minimum attribute information set; calculating the cryptographic commitment of the original voucher data; generating blinded voucher data corresponding to the original voucher data based on the cryptographic commitment and the blinding factor; and generating the zero-knowledge proof based on the blinded voucher data.

[0010] Secondly, the present invention also provides a cross-domain credential aggregation method, applied at the aggregation end, comprising: receiving zero-knowledge proofs from user terminals corresponding to different issuers; verifying the validity of the zero-knowledge proofs; performing cryptographic aggregation operations on the zero-knowledge proofs that have passed the validity verification to generate an aggregated proof, and forwarding the aggregated proof to the verification end.

[0011] Thirdly, the present invention also provides a credential verification method applied at the verification end, comprising: publishing a resource access policy to a user terminal; receiving proof data from a user terminal or an aggregation terminal; the proof data including a zero-knowledge proof generated by executing the credential privacy protection method or an aggregated proof generated by executing the cross-domain credential aggregation method; verifying the proof data, and determining whether to authorize the user terminal to access the target resource based on the verification result.

[0012] Furthermore, the step of publishing the resource access policy to the user terminal includes: publishing the resource access policy to the policy chain network so that the user terminal can query and obtain it from the policy chain network.

[0013] Furthermore, the resource access strategy includes a computer executable program written in a structured strategy language, which defines a logical combination of multiple attribute conditions that must be satisfied to access the target resource.

[0014] Fourthly, the present invention also provides a credential privacy protection device applied to a user terminal, comprising: a resource access policy acquisition module for acquiring a resource access policy published by a verification terminal; a minimum attribute information set determination module for determining, based on the resource access policy, a minimum attribute information set satisfying the resource access policy from locally held original credential data; and a zero-knowledge proof generation module for generating a zero-knowledge proof based on the minimum attribute information set and sending the zero-knowledge proof to an aggregation terminal or a verification terminal; wherein the zero-knowledge proof is used to prove that there exists a set of valid verifiable credentials satisfying the minimum attribute information set.

[0015] Fifthly, the present invention also provides a cross-domain credential aggregation device applied at the aggregation end, comprising: a zero-knowledge proof receiving module for receiving zero-knowledge proofs from user terminals corresponding to different issuers; a zero-knowledge proof verification module for validating the validity of the zero-knowledge proofs; and a cross-domain zero-knowledge proof aggregation module for performing cryptographic aggregation operations on the valid zero-knowledge proofs to generate an aggregated proof, and forwarding the aggregated proof to the verification end.

[0016] In a sixth aspect, the present invention also provides a credential verification device applied at a verification end, comprising: a resource access policy publishing module for publishing resource access policies to a user end; a proof data receiving module for receiving proof data from a user end or an aggregation end; the proof data including zero-knowledge proofs or aggregated proofs; and a proof data verification module for verifying the proof data and determining whether to authorize the user end to access the target resource based on the verification result.

[0017] The credential privacy protection method for user terminals provided by this invention obtains the resource access policy published by the verification end, and based on the resource access policy, determines the minimum set of attribute information that satisfies the resource access policy from the original credential data held locally. Then, it generates a zero-knowledge proof based on the minimum attribute information set and sends the zero-knowledge proof to the aggregation end or verification end. The zero-knowledge proof proves that there exists a set of valid verifiable credentials that satisfies the minimum attribute information set. This method achieves minimal data disclosure through policy-driven calculation of the minimum attribute information set, eliminating the over-exposure of original credential details from the source. Without revealing any original credential plaintext to the verification party, it generates verifiable cryptographic evidence that meets the conditions. Ultimately, the user can obtain service authorization simply by proving the existence of valid credentials that satisfy the minimum attribute information set, thus protecting the privacy of the user's credential content while ensuring business logic.

[0018] The cross-domain credential aggregation method provided by this invention, applied to the aggregation end, receives zero-knowledge proofs from users corresponding to different issuers, verifies the validity of these zero-knowledge proofs, performs cryptographic aggregation operations on the valid zero-knowledge proofs, generates an aggregated proof, and forwards the aggregated proof to the verification end. This method, through cryptographic aggregation operations, merges multiple zero-knowledge proofs held by the same user from different issuers into a unified aggregated proof, thereby achieving single-validation of cross-domain credentials. Mathematically, it severs the traceability between the aggregated proof and any original credential, effectively preventing the verification party from analyzing isolated proofs on different credentials to correlate a user's comprehensive identity profile across trust domains. Finally, when a user meets complex multi-condition policies, the verification party only needs to verify one aggregated proof, simplifying the process, improving efficiency, and eliminating the behavioral association risks that may arise from presenting multiple credentials separately.

[0019] The credential verification method provided by this invention, applied to the verification end, publishes resource access policies to the user end and receives proof data from the user end or the aggregation end. The proof data includes zero-knowledge proofs generated by executing the credential privacy protection method or aggregated proofs generated by executing the cross-domain credential aggregation method. The method then verifies the proof data and determines whether to authorize the user end to access the target resource based on the verification result. By receiving and verifying a cryptographic proof (zero-knowledge proof or aggregated proof), the verifier can be certain that the user meets the policy without touching any original credential plaintext. This eliminates the privacy leakage risk caused by data access, removes the technical burden of acquiring and verifying each user's original multi-source credentials, and solves the problems of cumbersome processes and low efficiency. Ultimately, the verifier achieves efficient and automated access control while completely avoiding the security and compliance responsibilities arising from handling sensitive user data. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating the credential privacy protection method applied to the user terminal provided in an embodiment of the present invention.

[0022] Figure 2 This is a schematic diagram of the overall process of the credential privacy protection method applied to the user terminal provided in the embodiment of the present invention.

[0023] Figure 3 This is a flowchart illustrating the cross-domain credential aggregation method applied to the aggregation end provided in this embodiment of the invention.

[0024] Figure 4 This is a schematic diagram of the overall process of the cross-domain credential aggregation method applied to the aggregation end provided in the embodiment of the present invention.

[0025] Figure 5 This is a flowchart illustrating the credential verification method applied to the verification end provided in an embodiment of the present invention.

[0026] Figure 6 This is a complete data interaction diagram of the user terminal, aggregation terminal, and verification terminal provided in the embodiments of the present invention.

[0027] Figure 7 This is a schematic diagram of the structure of a credential privacy protection device applied to a user terminal provided in an embodiment of the present invention.

[0028] Figure 8 This is a schematic diagram of the cross-domain credential aggregation device applied to the aggregation end provided in an embodiment of the present invention.

[0029] Figure 9 This is a schematic diagram of the credential verification device applied to the verification end provided in an embodiment of the present invention. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0031] It is understood that in digital life, users often need to present digital credentials to various online platforms (verifiers) to prove their identity or qualifications, such as graduation certificates, employment certificates, credit reports, etc. These credentials are issued by different institutions (such as schools, companies, government departments). When a business needs to meet multiple conditions at the same time (for example, applying for a loan requires proof of "stable income, good credit, and local real estate"), the existing methods have obvious problems: (1) Privacy leakage and behavior association: When users present multiple credentials, the platform can easily associate the user's behavior in different scenarios through information such as time, IP, and credential identifiers, and build a personal profile, threatening privacy and security; (2) Crude disclosure and overexposure: Existing technology is difficult to intelligently process the combination of credentials from multiple parties; in order to meet the requirements, users are often forced to show the complete content of all credentials, even if the other party only wants to know "whether the income is >30,000 yuan", sensitive information such as the user's specific amount and transaction history will also be exposed; (3) Cumbersome process and poor experience: Verifiers need to verify credentials one by one, which is inefficient; users also need to manually search, combine, and submit multiple documents, which is troublesome and prone to errors.

[0032] Furthermore, existing technologies typically rely on a centralized aggregator that has access to all users' raw data, which itself constitutes a new source of privacy breaches and performance bottlenecks. Moreover, existing technologies do not clearly define how to achieve privacy-preserving aggregation and anti-association measures for cross-domain credentials.

[0033] In view of this, the present invention proposes a credential privacy protection method to solve the problem that existing technologies cannot intelligently disclose only information that exactly meets the conditions, and that there is a risk of leakage of user's original data during transmission and verification. At the same time, the present invention also proposes a cross-domain credential aggregation method to solve the problem that existing technologies cannot achieve anonymous aggregation and anti-association of cross-domain credentials. In addition, the present invention also proposes a credential verification method to solve the problem of how to achieve trusted policy verification without touching user's original data.

[0034] Figure 1 This diagram illustrates a flowchart of a credential privacy protection method for user terminals provided by an embodiment of the present invention. Figure 1 As shown, the method includes: S110, obtaining the resource access policy published by the verification end; S120, determining the minimum set of attribute information that satisfies the resource access policy from the original credential data held locally based on the resource access policy; S130, generating a zero-knowledge proof based on the minimum set of attribute information, and sending the zero-knowledge proof to the aggregation end or the verification end; wherein, the zero-knowledge proof is used to prove that there exists a set of valid verifiable credentials that satisfies the minimum set of attribute information.

[0035] The credential privacy protection method provided in this embodiment of the invention is applied to the user end, such as client software (user agent) deployed on the user's mobile terminal or computer.

[0036] The user's local device holds original credential data issued by various credential issuers (such as universities, financial institutions, and government agencies). This original credential data is typically an electronic file conforming to the W3C Verifiable Credential Standard format, containing digitally signed attribute statements from the issuer, such as Degree = Master's, Annual Income = 350,000, Credit Rating = AAA. The authenticity of the original credential data can be cryptographically verified using the issuer's public key.

[0037] The credential privacy protection method provided in this embodiment of the invention is executed by the user terminal in a local secure environment (e.g., a security chip, a trusted execution environment) to protect the privacy of the original credential data.

[0038] The following will provide a detailed description of steps S110-S130 and related steps.

[0039] S110, obtain the resource access policy published by the verification terminal.

[0040] In this step, the user client (user agent) queries the policy chain network and obtains the resource access policy published by the target authentication client.

[0041] A policy chain network is a distributed ledger or decentralized network used to immutably register, store, and provide machine-readable resource access policies published by various validators.

[0042] Verification providers are service providers that seek to verify user qualifications in order to control resource access, such as online lending platforms and recruitment websites.

[0043] Resource access policies are formalized expressions of the access control intent of the authentication end, specifically computer executable programs written in structured policy languages ​​(such as ZKP-SNARKs circuits or Ciphertext-Policy attribute-based encryption policies). These executable programs explicitly define the logical combination of attribute conditions required to access a specific resource (such as applying for a loan or submitting a job application). For example, a loan application policy might be encoded as the logical expression: (Proof of Income.Annual Income > 30,000) AND (Credit Report.Credit Rating = "Good") AND (Proof of Identity.Age >= 22).

[0044] S120, based on the resource access policy, determine the minimum set of attribute information that satisfies the resource access policy from the original credential data held locally.

[0045] This step specifically includes: parsing the original credential data to obtain the declaration content of one or more verifiable credentials; matching the logical conditions in the resource access policy with the declaration content of the verifiable credentials; calculating and outputting the minimum attribute information set based on the matching results; the minimum attribute information set includes the minimum amount of declaration information that needs to be disclosed to make the resource access policy evaluate to true.

[0046] The purpose of this step is to intelligently calculate locally the minimum and least sensitive set of attribute information that needs to be disclosed to the verifier to satisfy the resource access policy, i.e., the minimum set of attribute information, thereby achieving the principle of data minimization.

[0047] Specifically, firstly, the original voucher data is parsed to obtain the declaration content of one or more verifiable vouchers. The client, in a local secure environment, retrieves and parses all original voucher data it holds that may be relevant to the policy. The parsing process includes verifying the digital signature of the voucher issuer to ensure the voucher's authenticity and validity, and extracting the declaration content contained within the voucher. The declaration content refers to the specific attribute key-value pairs declared by the voucher; for example, the declaration content parsed from a university diploma is (degree, Master's), and from a bank statement it is (annual income, 35,000).

[0048] Then, the logical conditions in the resource access policy are matched with the declaration content of the verifiable credentials. The client runs the policy parsing and matching engine, which automatically compares the resource access policy (the logical expression described above) obtained in step S110 with all extracted declaration content. The engine determines whether the locally held credential declaration content can satisfy each logical condition in the resource access policy. For example, the condition in the resource access policy (proof of income, annual income > 30,000) is matched with the locally held annual income declaration (35,000), confirming that the condition is satisfied.

[0049] Next, based on the matching results, the minimum set of attribute information is calculated and output. After confirming that the local credential set as a whole can satisfy the resource access policy, the client executes an optimization algorithm with the goal of generating a minimum set of attribute information, which is the minimum amount of claim information that needs to be disclosed to make the resource access policy evaluate to true.

[0050] The optimization algorithm abstracts or generalizes the content of successfully matched original claims to reduce the sensitivity and specificity of the information. For example, although a user holds a claim (degree, Master's), but the resource access policy only requires (education level >= Bachelor's), the optimization algorithm will optimize the specific "Master's" to the broader assertion "education level >= Bachelor's," and output the latter as part of the minimum attribute information set. Similarly, the specific age "35 years old" is optimized to "age >= 25 years old." The final output minimum attribute information set may be, for example, ((education level, >= Bachelor's), (years of work experience, >= 3 years), (no criminal record, = yes)), without including original details such as the graduating institution, specific employer, and specific age.

[0051] S130, generate a zero-knowledge proof based on the minimum attribute information set, and send the zero-knowledge proof to the aggregation end or the verification end; wherein, the zero-knowledge proof is used to prove that there exists a set of valid verifiable credentials that satisfy the minimum attribute information set.

[0052] This step specifically includes: generating a blinding factor for the original voucher data related to the minimum attribute information set; calculating the cryptographic commitment of the original voucher data; generating blinded voucher data corresponding to the original voucher data based on the cryptographic commitment and the blinding factor; and generating a zero-knowledge proof based on the blinded voucher data.

[0053] The purpose of this step is to generate a cryptographic proof (zero-knowledge proof) without revealing any plaintext of the original credential data. This proof is used to demonstrate to the verifier that the valid credentials held by the user satisfy the minimum set of attribute information determined in step S120, thereby satisfying the resource access policy.

[0054] Specifically, firstly, a blinding factor is generated for the original credential data related to the minimum attribute information set. For each piece of original credential data determined in step S120 that is related to the minimum attribute information set (e.g., the corresponding university graduation certificate or employment certificate), the user terminal generates a cryptographically secure random number locally as the blinding factor for this credential use. The blinding factor is the core secret, regenerated each time a zero-knowledge proof is generated, and is destroyed after use to ensure the non-association between different sessions.

[0055] Simultaneously, a cryptographic commitment to the original voucher data is calculated. The client calculates the cryptographic hash value of the original voucher data (or its key claim portion) and uses a specific algorithm (e.g., elliptic curve mapping) to convert the cryptographic hash value into a point on an elliptic curve. This point is called the cryptographic commitment to the original voucher data. The cryptographic commitment binds to the content of the original voucher data (any alteration will cause a drastic change in the commitment value), but simultaneously hides the plaintext data.

[0056] Furthermore, based on the cryptographic commitment and the blinding factor, blinded credential data corresponding to the original credential data is generated. The client executes the core blinding operation; specifically, on the elliptic curve, the generated blinding factor (as a scalar) is multiplied by the obtained cryptographic commitment point. The result is a new elliptic curve point, denoted as the blinded credential data. This operation mathematically irreversibly mixes the random secret (blinding factor) with the credential commitment. To an external observer, the blinded credential data is a random point that cannot be associated with the original credential data or any other session.

[0057] Finally, a zero-knowledge proof is generated based on the blinded credential data. The user runs a zero-knowledge proof generation algorithm (e.g., a zk-SNARKs or zk-STARKs proof system) using all blinded credential data, public parameters, and the minimum attribute information set obtained in step S120 as input to generate a zero-knowledge proof.

[0058] The knowledge declaration implied by zero-knowledge proof is: the prover (user) knows a set of valid original voucher data and its corresponding correct blinding factor, enabling the generation of this blinded voucher data, and the attributes declared by this original voucher data satisfy or exceed all assertions defined in the minimum attribute information set. The entire generation process does not reveal the specific content of the original voucher data, the blinding factor value, or any attributes not appearing in the minimum attribute information set.

[0059] After generating the zero-knowledge proof, the user can choose to send it directly to the verification end along with the blinded credential data (direct connection mode) or to a dedicated aggregation end (aggregation mode) depending on the business scenario.

[0060] For example, if the verifier only needs to verify a single policy and has no special requirements for user behavior association, or if the business itself allows identity association, then the direct connection mode can be chosen. In the direct connection mode, the zero-knowledge proof generated by the user client is directly used as the verification basis, and the verifier can authorize access by verifying the validity of a single zero-knowledge proof.

[0061] If it is necessary to prevent the verifier from associating user behavior across different times and business scenarios using proof data, or if it is necessary to package credentials from different issuers into an indivisible proof, then the aggregation mode should be applied. In the aggregation mode, the aggregator will perform further cryptographic aggregation processing on zero-knowledge proofs from the same user but corresponding to different issuers, generating a completely new, unassociated aggregated proof for the verifier.

[0062] Regardless of the mode, the final verifier receives one or more cryptographic proofs and verifies the validity of these proofs to ensure that the user meets its resource access policy, without needing to know the specific content of any original credential data, thus achieving strong privacy protection for cross-domain credential verification.

[0063] In this embodiment, by acquiring the resource access policy published by the verification end, and based on the resource access policy, determining the minimum set of attribute information that satisfies the resource access policy from the locally held original credential data, and then generating a zero-knowledge proof based on the minimum attribute information set, the zero-knowledge proof is sent to the aggregation end or the verification end. The zero-knowledge proof is used to prove that there exists a set of valid verifiable credentials that satisfies the minimum attribute information set. This method, through policy-driven calculation of the minimum attribute information set, achieves minimal data disclosure, eliminating the over-exposure of original credential details from the source. Without revealing any original credential plaintext to the verification party, a verifiable cryptographic evidence that meets the conditions is generated. Ultimately, the user can obtain service authorization simply by proving the existence of valid credentials that satisfy the minimum attribute information set, thus protecting the privacy of the user's credential content while ensuring business logic.

[0064] In one specific embodiment Figure 2 The diagram illustrates the overall process of the credential privacy protection method for user terminals provided by an embodiment of the present invention, and demonstrates the execution logic of the core blinding and proof generation process in the credential privacy protection method.

[0065] like Figure 2 As shown, the node begins with "Start holding credentials". "The user's local storage contains the original voucher data issued by the voucher issuer." The original certificate data contains attribute statements (such as education level, income, credit rating, etc.) digitally signed by the issuer, and its authenticity can be verified through the issuer's public key.

[0066] Subsequently, the blinding factor was selected. The client generates a cryptographically secure random number locally. This random number has the characteristics of being destroyed after use and never being repeated: even with the same voucher data... Multiple submissions, because The final output of the blinded voucher point is different. The results will be completely different. The core purpose of this step is to provide irrelevance for this submission, cutting off the possibility of data association between the same credential in different scenarios from the technical source.

[0067] At the same time, calculate the commitment H( ): User-side access to original voucher data Perform a cryptographic hash operation and map the hash value to a point H on an elliptic curve. This operation fixes raw voucher data of arbitrary length into a standard elliptic curve point: from a privacy perspective, Hidden The plaintext content; from the perspective of completeness, H( ) bound Content (if) Tampering, H( (It will change). H( As the unique, definite, and anonymous representative (commitment) of the original voucher data, it forms the basis for subsequent blinding operations.

[0068] Then, scalar multiplication is performed. The user-side performs elliptic curve scalar multiplication, and the randomization factor is then applied. With voucher commitment The mathematically irreversible mixing yields blinded voucher points. For external observers (such as the aggregation end and the verification end), It is a random curve point and cannot be compared with the original voucher data. This step is the core operation of blinding, which uses mathematical transformations to sever the direct link between the plaintext of the voucher and the submitted data. It also involves associating with other submitted blinding points.

[0069] Furthermore, construct zero-knowledge proof statements: the user end is based on blinded credential points. Blinding factor and original voucher data Construct the declaration logic for zero-knowledge proof. The declaration is: "I know a set of values..." , making Established, and "Validity rules that meet system requirements (e.g., the issuer's signature is valid, the credential is within its validity period)." This statement defines the assertions that zero-knowledge proofs need to verify and is the core logical basis for generating the proof.

[0070] Then, generate the proof. (Proof of knowledge) and The user client calls the zero-knowledge proof generation algorithm, based on the constructed zero-knowledge statement and blinded credential points. Blinding factor and original voucher data Generate zero-knowledge proofs The core function of this proof is to demonstrate, without revealing... (Original voucher plaintext) and Under the premise of (blinding factor), prove two key facts to the aggregation / verification end: the submitted It is a correctly formatted blinded result (i.e.) (Established); the original voucher data behind it. It is authentic and valid, meaning it meets the validity rules such as signature and validity period.

[0071] Output blinded voucher points and proof The user client will generate blinded voucher points. and zero-knowledge proof This serves as the result of the submission. At this point, the data submitted by the user to the aggregation / verification end is only... The aggregation / verification end can only see these two data points and has no way of knowing anything else. (Original voucher plaintext) and The specific content of (blinding factor).

[0072] Finally, the submission is sent to the aggregation server (i.e., the aggregation end): the user client will... Submit to the aggregation end (or verification end, depending on the business model). Once received, the aggregation end can verify the submission. Validity, Confirmation The legitimacy of the credentials and the validity of the underlying documents are questioned, while the original plaintext of the user's credentials and the blinding factor are not accessible throughout the process.

[0073] Figure 3 This diagram illustrates a flowchart of a cross-domain credential aggregation method applied to the aggregation end, as provided in an embodiment of the present invention. Figure 3 As shown, the method includes: S310, receiving zero-knowledge proofs from user terminals and corresponding to different issuers; S320, verifying the validity of the zero-knowledge proofs; S330, performing cryptographic aggregation operations on the zero-knowledge proofs that have passed the validity verification to generate an aggregated proof, and forwarding the aggregated proof to the verification terminal.

[0074] The cross-domain credential aggregation method provided in this embodiment of the invention is applied to the aggregation end, such as a privacy computing service module deployed on a cloud server or trusted third-party infrastructure.

[0075] The aggregator itself is trustless and cannot access any user's original plaintext credential data throughout the process. Its core function is to perform batch verification and secure aggregation of privacy-preserving zero-knowledge proofs from different user terminals at the cryptographic level.

[0076] The following will provide a detailed description of steps S310-S330 and related steps.

[0077] S310 receives zero-knowledge proofs from users and from different issuers.

[0078] In this step, the aggregator receives data submitted from one or more user clients, which contains zero-knowledge proofs generated by the user clients using the credential privacy protection method described in this invention.

[0079] Specifically, each data packet submitted by a user typically contains two parts: 1) Blinding credential points ;2) Regarding this blinded voucher point Zero-knowledge proof . It is the user end that performs calculations Generated, among which It is a blinding factor generated by the user. It is the original voucher data. Cryptographic commitments. Zero-knowledge proofs. Used to prove that the user is aware of the validity and ,and It satisfies the validity rules.

[0080] The key lies in the original credential data corresponding to these zero-knowledge proofs from the user's end. These credentials were issued by multiple different credential issuers (e.g., University A, Bank B, Government Department C), demonstrating cross-domain characteristics. The aggregator, upon receiving the credentials, can only see these cryptographically processed documents. and It is completely impossible to obtain any original document in plain text. or blinding factor .

[0081] S320, Verify the validity of the zero-knowledge proof.

[0082] In this step, the aggregator receives submissions from all users. After the data is matched, the first step is to enter the batch verification stage, which aims to filter out valid and correctly formatted submissions and build a secure dataset to be aggregated.

[0083] The aggregator iterates through each received zero-knowledge proof. The corresponding zero-knowledge proof verification algorithm is then run. This verification process is public and depends only on the public parameters and the received... and The content to be verified corresponds to the statement made by the user when generating the zero-knowledge proof, that is: the verifier can be confident that the user submitting the zero-knowledge proof does indeed know a valid set of values. , making Established, and the original voucher data behind it. It is authentic and valid (e.g., it has a valid digital signature from the issuer, is within its validity period, etc.).

[0084] This step is a crucial security barrier; any invalid, forged, or malformed zero-knowledge proofs will be penalized. and their corresponding blinded voucher points Users whose data is identified and rejected at this stage will be immediately rejected, ensuring that only user data with valid credentials can enter the subsequent aggregation pool, thus preventing invalid data pollution attacks.

[0085] S330, perform cryptographic aggregation operations on the zero-knowledge proof that has passed the validity verification to generate an aggregated proof, and forward the aggregated proof to the verification end.

[0086] After all submissions pass verification in step S320, the aggregation end performs the core cryptographic aggregation operation on the selected set of valid blinded credential points. This operation achieves irreversible data mixing without the original credential data being visible.

[0087] Specifically, first, a cryptographic aggregation operation is performed. The aggregation end blinds all valid, verified credentials. As input. In a preferred embodiment, the aggregation operation is a point addition operation on an elliptic curve. The aggregation end initializes a starting point (e.g., an infinity point or a preset generator point) on the elliptic curve, and then iteratively adds each valid blinded credential point. The summation is applied to the current state using elliptic curve point addition, meaning that for all valid states... Perform operation After the loop completes, a final aggregation result point is obtained, denoted as the aggregation voucher point. ,Right now According to cryptographic properties, from It is impossible to reverse derive or separate any of the individual components that make it up. It is even more impossible to trace back to The corresponding original voucher data The user's identity is used to mathematically guarantee the uncorrelatedness of the aggregation results.

[0088] Subsequently, in order to prove the correctness of this aggregation operation to the final verifier (i.e. Indeed, it consists of a set of verified effective (This is from a correctly aggregated source, not a forged one; the aggregation end needs to provide the aggregation result.) Generate a short cryptographic proof, denoted as the aggregation proof. In a specific implementation, aggregate proof It can be a short signature based on the BLS signature algorithm. The aggregator uses its private key (or a specific aggregator key) to... Perform signing and generate . The cryptographic significance is that any verifier holding the aggregate public key can verify this signature to confirm its validity. It is a correct aggregation result that has been certified by the aggregation authority.

[0089] Finally, the aggregator will output the final result, namely the aggregated voucher point. and the corresponding aggregate proof This information is then sent to the verification end corresponding to the one that initiated the resource access request. At this point, the aggregator's work is complete.

[0090] The verification end receives Then, efficient verification algorithms (such as BLS signature verification) can be run to check. The validity of the credentials is verified. If the verification passes, the verifier can be confident that a valid set of user credentials has been successfully and correctly aggregated. Furthermore, the specific content and the identity of the submitter are completely unknown, thus enabling cross-domain, anonymous, and batch credential verification.

[0091] In this embodiment, zero-knowledge proofs from different issuers and received from the user are validated. Cryptographic aggregation operations are then performed on the validated proofs to generate an aggregated proof, which is then forwarded to the verification end. This method integrates multiple zero-knowledge proofs held by the same user from different issuers into a single aggregated proof, achieving unified verification of cross-domain credentials. Mathematically, it severs the traceability between the aggregated proof and any original credential, effectively preventing the verification party from analyzing isolated proofs on different credentials to correlate a user's comprehensive identity profile across trust domains. Finally, when a user meets complex multi-condition policies, the verification party only needs to verify one aggregated proof. This simplifies the process, improves efficiency, and eliminates the behavioral association risks that may arise from presenting multiple credentials separately.

[0092] In one specific embodiment Figure 4 The diagram illustrates the overall process of the cross-domain credential aggregation method applied to the aggregation end provided by the embodiments of the present invention, demonstrating the trusted batch processing process of the aggregation server under the premise that the original credential data is not visible.

[0093] like Figure 4 As shown, starting with "Start receiving all user submissions", the aggregation server receives submissions from users. Data pairs, To blind voucher points, This is a zero-knowledge proof.

[0094] In the first stage, batch verification is performed to filter trustworthy inputs.

[0095] Iterate through each commit: The server processes zero-knowledge certificates submitted by users from different issuers in turn. and blinded voucher data Verifying zero-knowledge proofs Validity: Run the zero-knowledge proof verification algorithm to check. Whether it is legally proven "Corresponding to genuine, correctly formatted blinded vouchers." (This is in contrast to zero-knowledge proofs.) If invalid, discard the submission. And continue to verify the next one; if zero-knowledge proof If valid, the voucher point will be blinded. Add to the list to be aggregated.

[0096] Determine if all valid submissions have been verified. Once it is confirmed that all valid submissions have been processed, proceed to the second stage.

[0097] In the second stage, cryptographic aggregation (mixing all inputs) is performed, and an aggregation proof (outputting a verifiable result) is generated.

[0098] Initialize the aggregation point S=0: Set the initial aggregation point (usually at infinity or a generator point) on the elliptic curve. Iterate through each valid list... Blinded credential points that have passed verification in the security pool Perform point addition operations one by one By performing point addition operations on elliptic curves, all valid... Mathematically, this is combined to obtain the final aggregated voucher point. .

[0099] Generate aggregate proof :for Generate an aggregation proof (such as a BLS signature) to prove that it is a valid aggregation result. Finally, output... and Aggregate voucher points With aggregate proof Send to the verification end.

[0100] It should be noted that, Figure 4 This demonstrates the complete process of batch verification and cryptographic aggregation of zero-knowledge proofs at the aggregation end. Although this embodiment mainly targets multiple credentials held by the same user (to prevent cross-issuer association), the illustrated process is logically applicable to batch processing scenarios of multiple user credentials, which will not be elaborated here.

[0101] Figure 5 This diagram illustrates a flowchart of a credential verification method applied to the verification end, provided by an embodiment of the present invention. Figure 5As shown, the method includes: S510, publishing a resource access policy to the user terminal; S520, receiving proof data from the user terminal or the aggregation terminal; the proof data includes a zero-knowledge proof generated by executing the credential privacy protection method or an aggregated proof generated by executing the cross-domain credential aggregation method; S530, verifying the proof data, and determining whether to authorize the user terminal to access the target resource based on the verification result.

[0102] The credential verification method provided in this embodiment of the invention is applied to the verification end (the terminal where the verifier is located), i.e., the online platform providing services or resources (such as financial institutions, recruitment platforms, and leasing service providers). The verification end is the maker and publisher of resource access policies, as well as the initiator of the verification process and the final authorization decision-maker.

[0103] This embodiment aims to illustrate how the verification end can complete trusted access control without touching the user's original credential data.

[0104] The following will provide a detailed description of steps S510-S530 and related steps.

[0105] S510 publishes resource access policies to user terminals.

[0106] In this step, the verification end needs to clearly and immutably define its access control requirements, including the definition of resources and the publication of policies.

[0107] Specifically, first, define and encode resource access policies. Administrators or automated systems at the verification end encode business logic (e.g., loan applications must meet requirements such as "annual income exceeding 300,000 yuan, good credit rating, and proof of local property ownership") into a machine-readable, executable format. This format is a computer-executable program written in a structured policy language, i.e., a resource access policy.

[0108] Structured strategy languages ​​are formalized languages ​​that define syntax and semantics, such as the arithmetic circuit description language of ZKP-SNARKs, quadratic arithmetic programs, or domain-specific languages ​​that support logical operations.

[0109] A resource access policy precisely defines the logical combination of multiple attribute conditions that must be satisfied to access a target resource. For example, the encoded policy program may be a function or circuit that can accept a set of attribute assertions as input and output a Boolean value (true / false), whose internal logic is (attribute A > threshold X) AND (attribute B = specific value Y) AND (attribute C is true).

[0110] To ensure the openness, transparency, and immutability of resource access policies, and to prevent the verifier from repudiating or unilaterally modifying the rules, the verifier publishes the coded resource access policies to a policy chain network. The policy chain network is a distributed ledger or decentralized network that uses a consensus mechanism to ensure the immutability and public searchability of the data uploaded to the chain.

[0111] The verification end registers and publishes resource access policies by calling the smart contract or interface of the policy chain network. Upon successful publication, the resource access policy obtains a unique policy identifier (such as a transaction hash or policy ID) and is bound to the verification end's identity (such as a DID). The user end can subsequently use this identifier to query and obtain the complete and trusted resource access policy program on the policy chain network.

[0112] S520, receive proof data from the user terminal or the aggregation terminal; the proof data includes zero-knowledge proofs generated by executing the credential privacy protection method or aggregated proofs generated by executing the cross-domain credential aggregation method.

[0113] After publishing the resource access policy, the verification end enters a phase of waiting for and receiving zero-knowledge proofs or aggregate proofs. Depending on the business scenario and privacy protection level, the verification end may receive two types of proof data.

[0114] The first scenario (direct connection mode): The verification end directly receives the proof data from the user end. This proof data is a zero-knowledge proof (denoted as ) generated by the user end through the execution of a credential privacy protection method. The client, based on the published resource access policy, determines the minimum set of attribute information locally and generates the corresponding zero-knowledge proof. Then, it uses this zero-knowledge proof... It is sent to the verification end along with the policy identifier.

[0115] The second scenario (aggregation mode): The verification end receives proof data from the aggregation end. This proof data is an aggregated proof generated by the aggregation end through executing the cross-domain credential aggregation method (denoted as...). Typically associated with aggregated voucher points They are sent together. In this mode, the user first submits their zero-knowledge proof to the aggregator, which performs validity verification and cryptographic aggregation before forwarding the final aggregated proof to the verifier.

[0116] The verification end needs to be able to receive and parse these two types of proof data. The proof data contains a policy identifier, enabling the verification end to match it with previously published policies.

[0117] S530, verify the proof data, and determine whether to authorize the user terminal to access the target resource based on the verification result.

[0118] This entire process requires no verification party to access or parse any user's original credential data.

[0119] Specifically, firstly, the verification end calls the corresponding verification algorithm based on the type of proof data received.

[0120] If you receive a zero-knowledge proof The verification end runs a public verification algorithm corresponding to the proof system. This algorithm uses public parameters, a policy identifier (used to associate specific policy procedures), and the received zero-knowledge proofs. As input. The verification process is computational and designed to check zero-knowledge proofs. Whether a cryptographic proof is valid or not verifies whether there exists a set of valid original credentials whose attributes satisfy the specific resource access policy (or its minimum set of attribute information) issued by the verifier. The verification algorithm outputs a Boolean value indicating whether the zero-knowledge proof is valid.

[0121] If the received document is a proof of aggregation and The verification end first verifies the aggregate proof. The validity of. For example, if If it is a BLS signature, the verifier uses the aggregator's public key to verify whether the signature is valid. Valid. If the signature verification passes, it proves... This is a correct aggregation result certified by the trusted aggregation endpoint. Subsequently, the verification endpoint can... It is regarded as an aggregated credential, which logically confirms that a batch of valid credentials has been aggregated and satisfies the policy requirements (the specific policy satisfaction has been proven and encapsulated at the user end and the aggregation end).

[0122] Subsequently, the verification end makes the final access control decision based on the verification result.

[0123] If the proof data (regardless of) still If the verification passes, the verifier is convinced (in a cryptographic sense) that the user who submitted the proof meets its published resource access policy. At this point, the verifier performs an authorization operation, such as creating a session for the user, issuing an access token, granting API access permissions, or directly returning the requested resource.

[0124] If the verification of the proof data fails, the verification end will reject the access request, return an unauthorized error, and log the failed verification attempt.

[0125] In this embodiment, a resource access policy is published to the user terminal, and proof data is received from the user terminal or the aggregation terminal. The proof data includes a zero-knowledge proof generated by executing the credential privacy protection method or an aggregated proof generated by executing the cross-domain credential aggregation method. The proof data is then verified, and based on the verification result, it is determined whether to authorize the user terminal to access the target resource. This method, by receiving and verifying a cryptographic proof (zero-knowledge proof or aggregated proof), allows the verifier to be certain that the user meets the policy without touching any original credential plaintext. This eliminates the privacy leakage risk caused by data access, removes the technical burden of acquiring and verifying each user's original multi-source credentials, and solves the problems of cumbersome processes and low efficiency. Ultimately, while achieving efficient and automated access control, the verifier also completely avoids the security and compliance responsibilities arising from processing sensitive user data.

[0126] In one specific embodiment Figure 6 This diagram illustrates the complete data interaction between the user terminal, aggregation terminal, and verification terminal provided in an embodiment of the present invention.

[0127] like Figure 6 As shown, on the voucher holder's side (user side), the user uses the original voucher. For input, first perform blinding processing to generate blinded voucher points. Subsequently targeting Generating zero-knowledge proofs This proves that they possess valid original vouchers. and the correct blinding factor (Specific details not disclosed) Ultimately, blinded credential points and zero-knowledge proofs will be implemented. Submit to the aggregation server (aggregator).

[0128] At the aggregation end, all are received and verified. If the verification fails and the result is negative, the process is rejected and terminated, and invalid submissions are discarded; if the result is positive, a dot-plus operation is performed to aggregate all blinded voucher points. Generate aggregated vouchers (Mathematically, it is irreversible to mix all private information), thus providing Generate aggregate proof This proves that it correctly aggregates all valid [data / information]. .

[0129] On the verifier side (verifier end), receive and Subsequently, the aggregation proof was verified. If the verification fails and the result is negative, the aggregation result is rejected; if it succeeds, the overall validity of the credentials is confirmed (no individual information is known), indicating that a set of valid credentials has been successfully aggregated, and from... It is impossible to infer a single or original voucher ,User ID.

[0130] Taking an employment background check scenario as an example, suppose job seeker Xiao Zhang needs to prove to the new company (verifier) ​​that: (education level >= Bachelor's degree) AND (recent work experience >= 3 years) AND (no criminal record).

[0131] Xiao Zhang holds: a master's degree certificate issued by University B, a certificate of employment duration issued by his former company C for 4 years, and a certificate of no criminal record issued by the Public Security Bureau D.

[0132] The user client obtains the company's policy from the policy chain network. After optimization, the minimum set of attribute information A is determined to be: (Education >= Bachelor's Degree) AND (Work Experience >= 3 Years) AND (No Criminal Record = True). Subsequently, a corresponding zero-knowledge proof is generated based on the minimum set of attribute information for each credential. The optimization here is that the education attribute is weakened from the specific "Master's Degree" to ">= Bachelor's Degree," achieving minimal disclosure.

[0133] The aggregator performs cryptographic aggregation operations on the zero-knowledge proofs corresponding to the three credentials to generate an aggregated credential. And generate an aggregation proof for it. "I have an effective" The corresponding set of original vouchers satisfies assertion A.

[0134] New company verification at the verification end Once approved, Xiao Zhang is considered to meet the employment requirements, but his specific university, previous company name, and years of service are unknown, effectively protecting Xiao Zhang's privacy.

[0135] Compared with existing technologies, this invention has the following advantages: (1) Strong privacy protection: By generating aggregated credentials that are cryptographically independent of the original credentials through "blind aggregation", the verifier's ability to associate user identities in different services is fundamentally cut off; (2) Through minimal disclosure optimization, only the minimum information required by the policy is exposed, realizing the principle of data minimization; (3) Verifiable and trustless third party: Throughout the process, the verifier only needs to verify a zero-knowledge proof or aggregated proof, without contacting any credential issuer or trusted aggregator. Among them, the correctness of the execution of the policy logic is guaranteed by the cryptographic security of the zero-knowledge proof, and the policy chain network is only an immutable policy library and does not involve user data.

[0136] Corresponding to the credential privacy protection method applied to the user terminal described in the above embodiments, the present invention also provides a credential privacy protection device applied to the user terminal. Specifically, Figure 7 A schematic diagram of the structure of a credential privacy protection device for user terminals provided in an embodiment of the present invention is shown.

[0137] like Figure 7 As shown, the device includes: a resource access policy acquisition module 710, used to acquire a resource access policy published by a verification end; a minimum attribute information set determination module 720, used to determine a minimum attribute information set that satisfies the resource access policy from locally held original credential data based on the resource access policy; and a zero-knowledge proof generation module 730, used to generate a zero-knowledge proof based on the minimum attribute information set and send the zero-knowledge proof to an aggregation end or a verification end; wherein the zero-knowledge proof is used to prove that there exists a set of valid verifiable credentials that satisfies the minimum attribute information set.

[0138] In this embodiment, the resource access policy acquisition module 710 acquires the resource access policy published by the verification end. The minimum attribute information set determination module 720, based on the resource access policy, determines the minimum attribute information set that satisfies the resource access policy from the locally held original credential data. Then, the zero-knowledge proof generation module 730 generates a zero-knowledge proof based on the minimum attribute information set and sends the zero-knowledge proof to the aggregation end or verification end. The zero-knowledge proof proves that a set of valid verifiable credentials satisfies the minimum attribute information set. This device, through policy-driven minimum attribute information set calculation, achieves minimal data disclosure, eliminating the over-exposure of original credential details from the source. Without revealing any original credential plaintext to the verification party, it generates verifiable cryptographic evidence that meets the conditions. Ultimately, the user can obtain service authorization simply by proving the existence of a valid credential that satisfies the minimum attribute information set, thus protecting the privacy of the user's credential content while ensuring business logic.

[0139] Corresponding to the cross-domain credential aggregation method applied to the aggregation end described in the above embodiments, the present invention also provides a cross-domain credential aggregation apparatus applied to the aggregation end. Specifically, Figure 8 A schematic diagram of the cross-domain credential aggregation device for the aggregation end provided in an embodiment of the present invention is shown.

[0140] like Figure 8 As shown, the device includes: a zero-knowledge proof receiving module 810, used to receive zero-knowledge proofs from user terminals and corresponding to different issuers; a zero-knowledge proof verification module 820, used to verify the validity of the zero-knowledge proofs; and a cross-domain zero-knowledge proof aggregation module 830, used to perform cryptographic aggregation operations on the zero-knowledge proofs that have passed the validity verification, generate an aggregated proof, and forward the aggregated proof to the verification terminal.

[0141] In this embodiment, the zero-knowledge proof receiving module 810 receives zero-knowledge proofs from the user terminal and corresponding to different issuers. The zero-knowledge proof verification module 820 verifies the validity of the zero-knowledge proofs. Then, the cross-domain zero-knowledge proof aggregation module 830 performs cryptographic aggregation operations on the valid zero-knowledge proofs to generate an aggregated proof, which is then forwarded to the verification terminal. This device merges multiple zero-knowledge proofs held by the same user from different issuers into a unified aggregated proof through cryptographic aggregation operations, thereby achieving single verification of cross-domain credentials. Mathematically, it severs the traceability between the aggregated proof and any original credential, effectively preventing the verifier from associating the user's comprehensive identity profile across trust domains by analyzing isolated proofs on different credentials. Finally, when a user meets complex multi-condition policies, the verifier only needs to verify one aggregated proof, simplifying the process, improving efficiency, and eliminating the behavioral association risks that may arise from presenting multiple credentials separately.

[0142] Corresponding to the credential verification methods applied to the verification end described in the above embodiments, the present invention also provides a credential verification device applied to the verification end. Specifically, Figure 9 A schematic diagram of the structure of a credential verification device for the verification end provided in an embodiment of the present invention is shown.

[0143] like Figure 9 As shown, the device includes: a resource access policy publishing module 910, used to publish resource access policies to user terminals; a proof data receiving module 920, used to receive proof data from user terminals or aggregation terminals; the proof data includes zero-knowledge proofs or aggregation proofs; and a proof data verification module 930, used to verify the proof data and determine whether to authorize the user terminal to access the target resource based on the verification result.

[0144] In this embodiment, the resource access policy publishing module 910 publishes the resource access policy to the user terminal, and the proof data receiving module 920 receives proof data from the user terminal or the aggregation terminal. The proof data includes a zero-knowledge proof generated by executing the credential privacy protection method or an aggregated proof generated by executing the cross-domain credential aggregation method. Then, the proof data verification module 930 verifies the proof data and determines whether to authorize the user terminal to access the target resource based on the verification result. By receiving and verifying a cryptographic proof (zero-knowledge proof or aggregated proof), the verifier can be certain that the user meets the policy without touching any original credential plaintext, thus eliminating the risk of privacy leakage caused by data contact and freeing the user from the technical burden of having to obtain and verify the user's original multi-source credentials one by one, solving the problems of cumbersome processes and low efficiency. Ultimately, while achieving efficient and automated access control, the verifier also completely avoids the security and compliance responsibilities arising from processing sensitive user data.

[0145] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0146] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0147] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for protecting credential privacy, characterized in that, Applied to the user end, including: Obtain the resource access policy published by the verification terminal; Based on the resource access policy, determine the minimum set of attribute information that satisfies the resource access policy from the original credential data held locally; A zero-knowledge proof is generated based on the minimum attribute information set, and the zero-knowledge proof is sent to the aggregation end or the verification end; wherein, the zero-knowledge proof is used to prove that there exists a set of valid verifiable credentials that satisfy the minimum attribute information set.

2. The credential privacy protection method according to claim 1, characterized in that, The step of determining the minimum set of attribute information that satisfies the resource access policy from the locally held original credential data includes: Parse the original voucher data to obtain the declaration content of one or more verifiable vouchers; Match the logical conditions in the resource access policy with the declaration content of the verifiable credentials; Based on the matching results, the minimum attribute information set is calculated and output; the minimum attribute information set includes the minimum amount of claim information that needs to be disclosed to make the resource access policy evaluate to true.

3. The credential privacy protection method according to claim 1, characterized in that, The generation of zero-knowledge proofs based on the minimum attribute information set includes: A blinding factor is generated for the original voucher data related to the minimum attribute information set; Calculate the cryptographic commitment of the original voucher data; Based on the cryptographic commitment and the blinding factor, generate blinded voucher data corresponding to the original voucher data; The zero-knowledge proof is generated based on the blinded credential data.

4. A method for cross-domain credential aggregation, characterized in that, Applied to the aggregation end, including: Receive zero-knowledge proofs from users and from different issuers; The validity of the zero-knowledge proof is verified. Cryptographic aggregation operations are performed on the zero-knowledge proof that has passed validity verification to generate an aggregated proof, and the aggregated proof is forwarded to the verification end.

5. A method for verifying credentials, characterized in that, Applied to the verification end, including: Publish resource access policies to users; Receive proof data from the user terminal or the aggregation terminal; the proof data includes zero-knowledge proofs generated by executing the credential privacy protection method as described in claim 1 or aggregated proofs generated by executing the cross-domain credential aggregation method as described in claim 4; The evidence data is verified, and based on the verification results, it is determined whether to authorize the user terminal to access the target resource.

6. The credential verification method according to claim 5, characterized in that, The method of publishing resource access policies to user terminals includes: The resource access policy is published to the policy chain network so that users can query and obtain it from the policy chain network.

7. The credential verification method according to claim 6, characterized in that, The resource access policy includes a computer-executable program written in a structured policy language, which defines a logical combination of multiple attribute conditions that must be satisfied to access the target resource.

8. A credential privacy protection device, characterized in that, Applied to the user end, including: The resource access policy acquisition module is used to acquire the resource access policies published by the verification terminal. The minimum attribute information set determination module is used to determine the minimum attribute information set that satisfies the resource access strategy from the original credential data held locally, based on the resource access strategy. A zero-knowledge proof generation module is used to generate a zero-knowledge proof based on the minimum attribute information set and send the zero-knowledge proof to the aggregation end or the verification end; wherein, the zero-knowledge proof is used to prove that there exists a set of valid verifiable credentials that satisfy the minimum attribute information set.

9. A cross-domain credential aggregation device, characterized in that, Applied to the aggregation end, including: The zero-knowledge proof receiving module is used to receive zero-knowledge proofs from users and from different issuers. A zero-knowledge proof verification module is used to verify the validity of the zero-knowledge proof. The cross-domain zero-knowledge proof aggregation module is used to perform cryptographic aggregation operations on zero-knowledge proofs that have passed validity verification, generate aggregated proofs, and forward the aggregated proofs to the verification end.

10. A credential verification device, characterized in that, Applied to the verification end, including: The resource access policy publishing module is used to publish resource access policies to the user end. The proof data receiving module is used to receive proof data from the user terminal or the aggregation terminal; the proof data includes zero-knowledge proofs or aggregated proofs. The proof data verification module is used to verify the proof data and determine whether to authorize the user terminal to access the target resource based on the verification result.

Images