A privacy credential-based enterprise visitor identity verification method

Abstract

The application discloses a kind of enterprise visitor identity verification methods based on privacy credentials, it is related to digital identity authentication field.Enterprise visitor management server generates appointment authorization information and offline state snapshot according to credential state data and reservation state data, is respectively issued to visitor terminal and multiple visitor verification terminals after signature.Offline verification, visitor verification terminal extracts state verification parameter and generates dynamic verification challenge;Visitor terminal generates one-time presentation proof and one-time use identification accordingly;Visitor verification terminal completes proof verification, local reuse query and previous use record verification, and generates use record with front and rear abstract association after verification. After communication is restored, server merges the use record uploaded by multiple verification terminals, identifies reuse conflict, access branch conflict and access sequence conflict, and updates reservation state, realizes offline privacy verification and cross-terminal conflict identification.

Description

Technical Field

[0001] This invention relates to the field of digital identity authentication, and in particular to a method for verifying the identity of enterprise visitors based on privacy credentials. Background Technology

[0002] As the level of digital management in corporate parks, office buildings, and production areas continues to improve, visitor identity verification is gradually shifting from manual registration to automated verification based on visitor appointment systems and electronic identity credentials. Existing visitor management systems typically store visitor identity and appointment information on a visitor management server, and visitor verification terminals deployed at entrances and exits send verification requests to the visitor management server to confirm visitor identity, appointment validity, and permitted access areas.

[0003] The verification methods described above typically rely on real-time communication between the visitor verification terminal and the visitor management server. When the enterprise LAN fails, the communication link between the visitor verification terminal and the server is interrupted, or the visitor verification terminal is deployed in an area with unstable network coverage, the visitor verification terminal may struggle to obtain credential and appointment statuses in a timely manner, potentially preventing it from completing automatic identity verification. Some existing solutions achieve offline verification by caching appointment lists, credential information, or static access codes in the visitor verification terminal. However, cached data may not reflect credential revocation, appointment cancellation, or changes in access permissions in a timely manner, and static access codes or reusable verification data are easily copied or replayed.

[0004] Furthermore, existing visitor identity verification processes typically require visitors to provide plaintext identity information such as name, ID number, and contact information to the enterprise's visitor management system. When visitor verification terminals perform identity verification in different controlled areas, this information may be repeatedly collected and transmitted, increasing the risk of visitor identity information leakage and cross-scenario association. Although identity verification technologies based on privacy credentials and zero-knowledge proofs can achieve selective disclosure of credential attributes, how to simultaneously verify the issuance status of privacy credentials, appointment authorization status, credential holding relationships, and whether credential attributes meet regional verification requirements when the visitor verification terminal cannot connect to the server in real time remains a challenge.

[0005] For enterprise access scenarios involving multiple controlled areas or multiple consecutive verification steps, different visitor verification terminals save usage records separately during offline periods. A single verification terminal can only identify duplicate verification behaviors occurring locally, making it difficult to promptly detect situations where the same appointment authorization is reused across different verification terminals. Furthermore, when visitors need to pass through multiple controlled areas in a predetermined order, existing offline verification methods typically lack reliable records that can represent the relationship between each verification step. After communication is restored, it becomes difficult to accurately identify access branches, abnormal verification sequences, or usage records that do not conform to actual access conditions.

[0006] To address this, a method for verifying the identity of enterprise visitors based on privacy credentials is proposed. Summary of the Invention

[0007] The main objective of this invention is to provide a method for verifying the identity of enterprise visitors based on privacy credentials, which can effectively solve the problems in the background art.

[0008] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0009] A method for verifying enterprise visitor identity based on privacy credentials is applied to an identity verification system including an enterprise visitor management server, visitor terminals, and multiple visitor verification terminals. The visitor terminals store privacy credentials issued by a trusted credential issuer. The privacy credentials include at least a credential attribute commitment, an issuer signature, and a holder key commitment. The method includes the following steps:

[0010] S1. The enterprise visitor management server obtains visitor reservation information, generates reservation authorization information containing reservation random quantity, temporary access identifier and verification step information, and generates an offline status snapshot based on the credential status data issued by the trusted credential issuing terminal and the reservation status data maintained by the enterprise visitor management server; the enterprise visitor management server signs the reservation authorization information and the offline status snapshot respectively, sends the signed reservation authorization information to the visitor terminal, and distributes the signed offline status snapshot to multiple visitor verification terminals;

[0011] S2. When the target visitor verification terminal disconnects from the enterprise visitor management server, it extracts the voucher status summary and appointment status summary from the local offline status snapshot as status verification parameters, and generates a dynamic verification challenge based on its own terminal identifier, the snapshot version number of the local offline status snapshot, the current verification period and a one-time random number, and sends the dynamic verification challenge and status verification parameters to the visitor terminal.

[0012] S3. The visitor terminal generates a one-time presentation certificate and a one-time use identifier according to a preset zero-knowledge proof protocol, based on the privacy certificate, reservation authorization information, dynamic verification challenge, and status verification parameters. The one-time presentation certificate includes a certificate issuance relationship certificate, a holder's secret holding relationship certificate, a certificate attribute condition certificate, a dynamic verification challenge binding certificate, and a status validity certificate relative to the status verification parameters. This is used to prove the validity of the privacy certificate issuance, the visitor terminal's holding relationship with the privacy certificate, the satisfaction of the verification requirements by the certificate attributes, and the status validity of the privacy certificate and reservation authorization information relative to the offline status snapshot, without disclosing certificate attributes other than those required for verification. The visitor terminal sends the one-time presentation certificate and the one-time use identifier to the target visitor verification terminal. If the current verification step is not the first verification step, the visitor terminal also sends the usage record corresponding to the previous verification step it saved to the target visitor verification terminal.

[0013] S4. The target visitor verification terminal verifies the one-time presentation certificate based on the local offline status snapshot and queries whether the one-time use identifier exists in the local usage record. When the current verification step is not the first verification step, the target visitor verification terminal also verifies the usage record corresponding to the previous verification step. When the one-time presentation certificate verification is successful, the offline status snapshot is in an allowed usage state, the one-time use identifier does not exist in the local usage record, and the current verification step is the first verification step or the usage record corresponding to the previous verification step is verified, the identity verification success result is output, a usage record containing the temporary access identifier and the previous usage record summary is generated, the usage record is written locally and sent to the visitor terminal. Wherein, when the current verification step is the first verification step, the previous usage record summary adopts a preset initial summary.

[0014] S5. After the target visitor verification terminal restores its communication connection with the enterprise visitor management server, it uploads the usage records generated during the period of disconnection to the enterprise visitor management server.

[0015] S6. The enterprise visitor management server merges the usage records uploaded by multiple visitor verification terminals according to the sequential relationship between temporary access identifiers and usage records, identifies the repeated use conflicts of one-time use identifiers and the access order conflicts between usage records and verification step information, updates the reservation status according to the identification results, generates incremental status updates and sends them to the corresponding visitor verification terminals.

[0016] Furthermore, the reservation authorization information also includes the target enterprise identifier, reservation identifier, reservation validity period, allowed access area, and verification strategy identifier;

[0017] The enterprise visitor management server concatenates and hashes the target enterprise identifier, reservation identifier, reservation valid time period, allowed access area, verification policy identifier, and reservation random quantity in a preset order to obtain a reservation binding summary, and writes the reservation binding summary into the reservation authorization information.

[0018] The one-time presentation of proof is associated with the appointment binding summary to verify the consistency between the privacy credential presentation and the target company, the valid appointment period, and the allowed access area.

[0019] Furthermore, the offline status snapshot includes a snapshot version number, snapshot generation time, snapshot expiration time, credential status summary, appointment status summary, verification strategy summary, previous offline status snapshot summary, and signature of the enterprise visitor management server.

[0020] No. The snapshot summary of the offline snapshot is determined according to the following formula:

[0021]

[0022] in, Indicates the first A snapshot summary of the offline status snapshot. Indicates the snapshot version number. Indicates the snapshot generation time. Indicates the time when the snapshot expires. This indicates a summary of the voucher status. This indicates a summary of the appointment status. This represents a summary of the verification strategy. This represents a summary of the previous offline snapshot. Represents a hash function. Indicates data concatenation;

[0023] The visitor verification terminal verifies the source and version continuity of the offline status snapshot by using the signature of the enterprise visitor management server and the snapshot digest of the previous and subsequent offline status snapshots.

[0024] Furthermore, the target visitor verification terminal concatenates and hashes the terminal identifier, snapshot version number, current verification time period, and one-time random number in a preset order to generate the dynamic verification challenge;

[0025] The target visitor verification terminal records the usage status of the one-time random number, and determines that the verification of the one-time proof presentation has failed when the one-time proof presentation is not bound to the current dynamic verification challenge, the one-time random number has been used, or the dynamic verification challenge exceeds the preset valid duration.

[0026] Furthermore, the single-use identifier is generated according to the following formula:

[0027]

[0028] in, Indicates the first The first appointment Each verification step corresponds to a single-use identifier. Represents a pseudo-random function. This indicates the holder's secret corresponding to the holder's key commitment of the privacy credential. Indicates the first The number of appointments per appointment is random. This indicates the verification step identifier determined based on the verification step information. Represents a hash function. Indicates data concatenation;

[0029] The one-time presentation certificate also includes a generation relationship certificate between the one-time use identifier and the holder's secret, the reservation random quantity, and the verification step identifier. The target visitor verification terminal verifies the generation relationship certificate without obtaining the holder's secret.

[0030] Furthermore, the first The first appointment Usage records corresponding to each verification step Including temporary access ID Single-use label Dynamic verification challenge Terminal identifier of the target visitor verification terminal Verification time Snapshot version number Summary of previous usage record and terminal signature ;

[0031] The terminal signature Generate according to the following formula:

[0032]

[0033] in, This indicates the signature operation performed by the target visitor verification terminal using the terminal's private key. This indicates the usage record corresponding to the previous verification step;

[0034] When the When the verification step is the first verification step Use a preset initial summary; when the first... When the verification step is not the first verification step, the target visitor verification terminal verifies the terminal signature of the previous usage record and the matching relationship between the previous usage record and the verification step information.

[0035] Furthermore, the target visitor verification terminal determines the maximum allowed usage time of the offline status snapshot based on the security level of its corresponding controlled area, and calculates the snapshot time distance between the current verification time and the offline status snapshot generation time.

[0036] When the snapshot time distance does not exceed the maximum allowed usage time, the offline snapshot is determined to be in an allowed usage state;

[0037] When the snapshot time exceeds the maximum allowed usage time, stop outputting the automatic identity verification result and output a manual review instruction or restrict visitors from entering the preset buffer area.

[0038] Furthermore, the enterprise visitor management server identifies reuse conflicts, access branch conflicts, and access order conflicts, including:

[0039] The usage records uploaded by multiple visitor verification terminals are merged according to the temporary access identifier, and the terminal signature of each usage record is verified.

[0040] When the same one-time use identifier corresponds to more than two valid use records, it is determined that there is a duplicate use conflict;

[0041] When the same previous usage record summary corresponds to two subsequent usage records that are mutually exclusive as defined by the verification step information, an access branch conflict is determined to exist;

[0042] When the order of visitor verification terminals corresponding to adjacent usage records is inconsistent with the verification step information, or when the verification time interval between adjacent visitor verification terminals is less than the shortest passage time determined based on the preset passage distance and preset maximum movement speed between visitor verification terminals, an access order conflict is determined.

[0043] The enterprise visitor management server updates conflicting appointments to a restricted use status or a pending review status, and generates an incremental status update that includes the previous snapshot version number, a summary of the newly added invalid appointment, and a newly added invalid one-time use identifier.

[0044] A privacy credential-based enterprise visitor identity verification system includes an enterprise visitor management server, a visitor terminal, and multiple visitor verification terminals;

[0045] The enterprise visitor management server is used to generate appointment authorization information based on visitor appointment information, generate offline status snapshots based on credential status data and appointment status data, and send the signed appointment authorization information and the signed offline status snapshots to the visitor terminal and the visitor verification terminal, respectively.

[0046] The visitor verification terminal is used to extract status verification parameters from the local offline status snapshot when the communication connection with the enterprise visitor management server is disconnected, generate a dynamic verification challenge, and send the dynamic verification challenge and status verification parameters to the visitor terminal.

[0047] The visitor terminal is used to generate a one-time presentation certificate and a one-time use identifier according to a preset zero-knowledge proof protocol, based on privacy credentials, reservation authorization information, dynamic verification challenge and status verification parameters, and to send the usage record corresponding to the previous verification step to the target visitor verification terminal when the current verification step is not the first verification step.

[0048] The target visitor verification terminal is used to verify the one-time proof based on the local offline status snapshot, query the local usage status of the one-time use identifier, verify the usage record corresponding to the previous verification step, and generate a usage record containing a temporary access identifier, a summary of the previous usage record and a terminal signature after the identity verification is passed.

[0049] The visitor verification terminal is also used to upload the usage records generated during the period of disconnection to the enterprise visitor management server after the communication connection with the enterprise visitor management server is restored.

[0050] The enterprise visitor management server is also used to merge usage records uploaded by multiple visitor verification terminals according to the sequential relationship between temporary access identifiers and usage records, identify duplicate usage conflicts and access order conflicts, update the reservation status and generate incremental status updates based on the identification results.

[0051] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method steps.

[0052] Compared with the prior art, the present invention has the following beneficial effects:

[0053] 1. By pre-distributing signed offline status snapshots to multiple visitor verification terminals, the visitor verification terminals can still complete identity verification based on credential status and appointment status without needing to communicate with the enterprise visitor management server in real time. Combining snapshot version, valid time period, and previous snapshot summary can improve the reliability and timeliness of offline status data.

[0054] 2. The visitor terminal generates a one-time presentation certificate according to the preset zero-knowledge proof protocol. It can prove the validity of the issuance of the privacy certificate, the certificate holding relationship, the satisfaction of the certificate attributes, and the validity of the certificate and appointment authorization status without disclosing the certificate attributes other than those required for verification. This reduces the transmission and exposure of visitor identity information.

[0055] 3. By binding a one-time certificate presentation with a dynamic verification challenge that includes the terminal identifier, snapshot version number, current verification period, and one-time random number, and by using a one-time use identifier generated based on the holder's secret, the reservation random quantity, and the verification step identifier for local querying, it is possible to identify certificate replay and repeated use of the same reservation verification step.

[0056] 4. By generating usage records that include temporary access identifiers, summaries of previous usage records, and terminal signatures, a reliable sequential relationship is formed between usage records of different verification steps. After communication is restored, the enterprise visitor management server merges the usage records uploaded by multiple visitor verification terminals, identifies duplicate usage conflicts, access branch conflicts, and access order conflicts, and updates the reservation status based on the identification results, forming a closed loop of offline verification and online status recovery. Attached Figure Description

[0057] Figure 1 This is a schematic diagram of the method flow of the present invention;

[0058] Figure 2 This is a schematic diagram of the system modules of the present invention. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0060] Example 1

[0061] like Figure 1-2 As shown, a method for verifying enterprise visitor identity based on privacy credentials is disclosed. This method is applied to an identity verification system, which includes an enterprise visitor management server, visitor terminals, and multiple visitor verification terminals deployed in different controlled areas of the enterprise. The visitor terminal can be a smartphone, smart card, or other electronic device with password processing and secure storage capabilities; the visitor verification terminal can be an access control controller, a turnstile terminal, or an identity verification device installed at the entrance of the controlled area.

[0062] The enterprise visitor management server and each visitor verification terminal are each configured with a signature key pair. The private key of each visitor verification terminal is stored in a secure chip or trusted execution environment, while the corresponding public key and terminal identifier are pre-registered with the enterprise visitor management server. Each visitor terminal stores a privacy credential issued by a trusted credential issuer, as well as the holder's secret bound to that privacy credential. The holder's secret Stored in the secure storage area of ​​the guest terminal, and not output in plaintext.

[0063] In one example, a hash function The SM3 algorithm is used, the HMAC-SM3 pseudo-random function is used, and the SM2 algorithm is used for the digital signatures of the enterprise visitor management server and visitor verification terminal. Privacy credentials can employ a signature credential structure that supports selective attribute disclosure, such as a BBS+signature credential structure. The above algorithms can also be replaced with other cryptographic algorithms with corresponding security features.

[0064] A privacy credential includes at least a credential attribute commitment, a credential issuer signature, and a holder key commitment. Credential attributes include one or more of the following: visitor type, affiliated organization, document validity status, or security level. The credential attribute commitment is used to hide the credential attributes, and the holder key commitment is used to link the privacy credential with the holder's secret. Binding. The trusted credential issuer uses its issuing private key to sign the credential attribute commitment and the holder's key commitment, thereby obtaining the credential issuer's signature.

[0065] After receiving a visitor's appointment request, the enterprise visitor management server reviews the visitor's appointment information. Upon approval, the enterprise visitor management server generates a random number for the appointment. Temporary access identifier And verification steps information.

[0066] Temporary access identifier For the corresponding number The randomly generated identifier for each appointment does not directly contain visitor's name, ID number, or other identity information. Verification step information describes the visitor verification terminals allowed for this appointment, the order of access between these terminals, and their mutual exclusion relationships. For access scenarios requiring sequential access through the reception desk, office area entrance, and target meeting area, these three locations can be designated as the first, second, and third verification steps, respectively.

[0067] The enterprise visitor management server generates reservation authorization information. This information includes the target enterprise identifier. Reservation sign Valid reservation time slot Allowed access areas Verification strategy identifier , reservation random quantity Temporary access identifier And verification steps information.

[0068] The enterprise visitor management server standardizes the encoding of the above fields according to preset encoding rules and generates an appointment binding summary:

[0069]

[0070] in, This indicates data concatenation. The enterprise visitor management server writes the appointment binding summary into the appointment authorization information and signs the appointment authorization information using the server's private key. The signed appointment authorization information is sent to the visitor's terminal and stored there.

[0071] The trusted credential issuing terminal maintains credential status data, while the enterprise visitor management server maintains appointment status data. Credential status data indicates whether a privacy credential is valid, suspended, or revoked, while appointment status data indicates whether an appointment is valid, used, canceled, restricted, or pending review.

[0072] This embodiment uses a state hash tree to organize voucher status data and reservation status data. The leaf nodes of the voucher status hash tree are generated based on the voucher identifier and its status, and the root digest of the voucher status hash tree serves as the voucher status digest. The leaf nodes of the reservation status hash tree are generated based on the temporary access identifier, the reservation validity status, and the reservation validity period. The root digest of the reservation status hash tree serves as the reservation status digest. The enterprise visitor management server also generates verification policy summaries based on the verification policies of each controlled area. .

[0073] The enterprise visitor management server generates the first [item] based on the above summary. Offline state snapshot. This offline state snapshot includes the snapshot version number. Snapshot generation time Snapshot expiration time Voucher Status Summary Appointment Status Summary and the previous offline state snapshot summary .

[0074] No. The snapshot summary of the offline snapshot is generated according to the following formula:

[0075]

[0076] The enterprise visitor management server uses its private key to sign offline status snapshots and their snapshot digests, and then distributes the signed offline status snapshots to each visitor verification terminal. The visitor verification terminal uses its public key to verify the signature of the offline status snapshot and verifies the continuity of the snapshot version by comparing the previous offline status snapshot digest in the current snapshot with the previously saved snapshot digest.

[0077] When sending appointment authorization information to the visitor terminal, the enterprise visitor management server also provides the visitor terminal with the credential status verification path and appointment status verification path corresponding to the corresponding snapshot version. The visitor terminal saves the corresponding status verification path according to the snapshot version number. When the visitor verification terminal uses an offline status snapshot of a certain version for verification, the visitor terminal selects the status verification path corresponding to that snapshot version. If the visitor terminal does not have a status verification path for the corresponding version, the offline verification will fail, and the visitor terminal will be prompted to update the status verification data after restoring the network connection.

[0078] When the target visitor verification terminal disconnects from the enterprise visitor management server and receives a verification request, the target visitor verification terminal first reads the local offline status snapshot, extracts the snapshot version number, voucher status summary and appointment status summary from it, and uses the voucher status summary and appointment status summary as status verification parameters.

[0079] The target visitor verification terminal generates a one-time random number. And convert the current time into a verification period of a preset length. The target visitor verification terminal verifies the information based on the terminal identifier. Snapshot version number Current verification period and one-time random numbers Generate dynamic verification challenges:

[0080]

[0081] The target visitor verification terminal sends the dynamic verification challenge, snapshot version number, status verification parameters, and step identifier of this verification step to the visitor terminal. This data can be transmitted via near-field communication, Bluetooth, QR code, or local area network communication.

[0082] The target visitor verification terminal sets three states for one-time random numbers: "Generated," "Used," and "Expired." When the dynamic verification challenge corresponding to the one-time random number is successfully verified, the one-time random number is updated to the "Used" state; when the dynamic verification challenge exceeds a preset validity period, the one-time random number is updated to the "Expired" state. In this embodiment, the preset validity period of the dynamic verification challenge can be set to 30 seconds.

[0083] After receiving the dynamic verification challenge and status verification parameters, the visitor terminal generates a one-time use identifier based on the step identifier 's' of the current verification step.

[0084]

[0085] in, Indicates that the holder's secret As the key, with a reserved random quantity A pseudo-random function is performed on the input. For the same verification step within the same reservation, the one-time use identifier generated by the same holder's secret and the reservation random quantity remains consistent, so that the visitor verification terminal can determine whether the device can be reused; for different reservations or different verification steps, different one-time use identifiers are generated.

[0086] The visitor terminal generates a one-time presentation proof according to a preset zero-knowledge proof protocol. The preset zero-knowledge proof protocol can be a non-interactive zero-knowledge proof protocol constructed based on commitment proof and signature knowledge proof, and uses dynamic verification challenges as proof input through the Fiat-Shamir transformation.

[0087] The public input for presenting proof in a one-time transaction must include at least: the public key of the trusted credential issuer, the public key of the enterprise visitor management server, and a dynamic verification challenge. Snapshot version number Voucher Status Summary Appointment Status Summary Reservation Binding Summary Single-use label Verification step identification And the attributes of the credentials required to be disclosed in this verification.

[0088] Private inputs for one-time proof presentation include at least: undisclosed credential attributes, holder secrets, etc. , Certificate issuing end signature, reservation random quantity The server's signature of the reservation authorization information, the credential status verification path, and the reservation status verification path.

[0089] The visitor terminal proves that the following relationships are simultaneously established by presenting proof in a single transaction:

[0090] The signature of the credential issuer can be verified through the public key of the trusted credential issuer, proving that the privacy credential was issued by the trusted credential issuer.

[0091] The visitor terminal knows the holder secret x corresponding to the holder key commitment, proving that the current visitor terminal is the holder of the privacy credential;

[0092] The corresponding attributes in the privacy credential satisfy the verification policy corresponding to the current controlled area, but other credential attributes other than those required for verification are not disclosed.

[0093] The server signature of the reservation authorization information is valid, and the reservation binding summary matches the target enterprise, the valid reservation period, and the allowed access area;

[0094] The leaf node representing the credential status of a privacy credential can obtain a credential status digest through the credential status verification path. The leaf node corresponding to the reservation authorization information can obtain the reservation status summary through the reservation status verification path. ;

[0095] Dynamic verification challenge As a public input for this proof, it participates in the proof calculation, thus binding the generated proof to this verification process;

[0096] Single-use label Secretly held by the same holder , reservation random quantity and verification step identification Generate according to preset relationships.

[0097] After generating a one-time presentation certificate, the visitor terminal sends the certificate and a one-time use identifier to the target visitor verification terminal. If the current verification step is not the first verification step, the visitor terminal also sends the usage record corresponding to the previous verification step to the target visitor verification terminal.

[0098] After receiving the above data, the target visitor verification terminal first verifies the server signature, snapshot version, and usage duration of the local offline snapshot, and then determines whether the dynamic verification challenge bound to the one-time proof is consistent with the dynamic verification challenge generated this time. If the dynamic verification challenge is inconsistent, the corresponding one-time random number has been used, or the dynamic verification challenge exceeds the preset valid duration, the one-time proof verification is deemed to have failed.

[0099] After the dynamic verification challenge is passed, the target visitor verification terminal performs zero-knowledge proof verification based on the public input of the one-time presentation of proof to verify the certificate issuance relationship, the holder's secret holding relationship, the certificate attribute conditions, the reservation authorization relationship, the status validity, and the one-time use identifier generation relationship.

[0100] The target visitor verification terminal also queries the local usage record database for a one-time use identifier. If a usage record with the same one-time use identifier exists locally and the identity verification result is successful, it is determined that there is local duplicate use, and no identity verification result will be output.

[0101] When the current verification step is not the first verification step, the target visitor verification terminal uses the public key of the previous visitor verification terminal to verify the terminal signature of the previous usage record, and determines whether the verification terminal corresponding to the previous usage record is a preceding verification terminal allowed by the current verification step based on the verification step information. After successful verification, the target visitor verification terminal calculates the hash value of the previous usage record to obtain the digest of the previous usage record.

[0102] When the verification of the proof is passed in one go, the offline snapshot is in the allowed use state, there is no identical one-time use identifier locally, and the current verification step is the first verification step or the previous use record verification is passed, the target visitor verification terminal outputs the identity verification result and controls the corresponding access control device or gate device to perform the release operation.

[0103] The target visitor verification terminal simultaneously generates a usage record corresponding to this verification step. The first appointment Usage records corresponding to each verification step Including temporary access ID Single-use label Dynamic verification challenge Terminal Identification Verification time Snapshot version number Summary of previous usage record and terminal signature .

[0104] Terminal signatures are generated according to the following formula:

[0105]

[0106] When the current verification step is the first verification step, the previous access record summary uses a preset initial summary, such as a temporary access identifier. The digest obtained by hashing with the preset starting marker; when the current verification step is not the first verification step, the previous usage record digest is the hash value of the previous usage record provided by the visitor terminal.

[0107] The target visitor verification terminal uses atomic operations to mark a one-time use identifier as used and a one-time random number as used, and writes them into the current usage record to avoid the same one-time use identifier being accepted repeatedly due to concurrent verification requests. After the usage record is written locally, the target visitor verification terminal sends it to the visitor terminal, which saves it and provides it in the next verification step.

[0108] Different controlled areas can be configured with different maximum snapshot usage durations. The target visitor verification terminal is configured based on the security level of its corresponding controlled area. Determine the maximum allowed usage time And calculate the snapshot time distance between the current verification time and the snapshot generation time.

[0109] For core areas with high security levels, a shorter maximum allowed usage time can be set; for ordinary office areas, a longer maximum allowed usage time can be set. Automatic identity verification continues as long as the snapshot time interval does not exceed the maximum allowed usage time; when the snapshot time interval exceeds the maximum allowed usage time, the automatic identity verification pass result is stopped, and a manual review instruction is issued, or visitors are only allowed to enter a preset buffer area.

[0110] After the visitor verification terminal re-establishes communication with the enterprise visitor management server, it uploads the usage records generated during the offline period that have not yet been successfully uploaded to the enterprise visitor management server. To avoid errors and conflicts caused by duplicate uploads, the enterprise visitor management server first deduplicates identical usage records based on their complete hash values. Identical usage records are treated as duplicate transmissions of the same record and are not considered as duplicate usage conflicts.

[0111] The enterprise visitor management server verifies the terminal signature for each usage record and determines the temporary access identifier accordingly. The usage records are merged. The server establishes the sequential relationship between usage records based on the summary of the previous usage record in each usage record, and performs the following conflict identification:

[0112] When the same one-time use identifier corresponds to two use records with different content and both of which have passed identity verification, a duplicate use conflict is identified.

[0113] When the same previous usage record summary corresponds to two subsequent usage records, and the verification steps corresponding to the two subsequent usage records are restricted to a mutually exclusive relationship by the verification step information, an access branch conflict is determined to exist.

[0114] When the order of visitor verification terminals corresponding to adjacent usage records is inconsistent with the access order specified in the verification step information, an access order conflict is determined. The enterprise visitor management server can also determine the shortest passage time based on the preset passage distance and preset maximum movement speed between adjacent visitor verification terminals; when the time interval between two verifications is less than the shortest passage time, an access order conflict is also determined.

[0115] Based on the conflict type, the enterprise visitor management server updates the corresponding reservation to a restricted use status or a pending review status, and generates an incremental status update. The incremental status update includes the previous snapshot version number, the newly added invalid reservation summary, the newly added invalid one-time use identifier, and the incremental data hash value, and is signed by the enterprise visitor management server.

[0116] After receiving an incremental status update, the visitor verification terminal verifies whether the server signature and the previous snapshot version number match the local snapshot version number. If the verification is successful, the newly added expired appointment and the newly added expired one-time use identifier are written to the local status database for subsequent offline verification. If the verification fails, the corresponding incremental status update is not applied, and a complete offline status snapshot is requested from the enterprise visitor management server.

[0117] Through the above process, offline status snapshot distribution, dynamic challenge generation, one-time presentation of privacy credentials, local reuse judgment, correlation of usage records before and after, cross-terminal conflict identification after network restoration, and status increment replenishment are realized, thus forming a complete closed loop for offline identity verification of enterprise visitors.

[0118] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A method for verifying the identity of enterprise visitors based on privacy credentials, characterized in that, An identity verification system applicable to an enterprise visitor management server, visitor terminals, and multiple visitor verification terminals, wherein the visitor terminals store a privacy credential issued by a trusted credential issuer, the privacy credential including at least a credential attribute commitment, a credential issuer signature, and a holder key commitment, the method comprising the following steps: S1. The enterprise visitor management server obtains visitor reservation information, generates reservation authorization information containing reservation random quantity, temporary access identifier and verification step information, and generates an offline status snapshot based on the credential status data issued by the trusted credential issuing terminal and the reservation status data maintained by the enterprise visitor management server; the enterprise visitor management server signs the reservation authorization information and the offline status snapshot respectively, sends the signed reservation authorization information to the visitor terminal, and distributes the signed offline status snapshot to multiple visitor verification terminals; S2. When the target visitor verification terminal disconnects from the enterprise visitor management server, it extracts the voucher status summary and appointment status summary from the local offline status snapshot as status verification parameters, and generates a dynamic verification challenge based on its own terminal identifier, the snapshot version number of the local offline status snapshot, the current verification period and a one-time random number, and sends the dynamic verification challenge and status verification parameters to the visitor terminal. S3. The visitor terminal generates a one-time presentation certificate and a one-time use identifier according to a preset zero-knowledge proof protocol, based on the privacy certificate, reservation authorization information, dynamic verification challenge, and status verification parameters. The one-time presentation certificate includes a certificate issuance relationship certificate, a holder's secret holding relationship certificate, a certificate attribute condition certificate, a dynamic verification challenge binding certificate, and a status validity certificate relative to the status verification parameters. This is used to prove the validity of the privacy certificate issuance, the visitor terminal's holding relationship with the privacy certificate, the satisfaction of the verification requirements by the certificate attributes, and the status validity of the privacy certificate and reservation authorization information relative to the offline status snapshot, without disclosing certificate attributes other than those required for verification. The visitor terminal sends the one-time presentation certificate and the one-time use identifier to the target visitor verification terminal. If the current verification step is not the first verification step, the visitor terminal also sends the usage record corresponding to the previous verification step it saved to the target visitor verification terminal. S4. The target visitor verification terminal verifies the one-time presentation certificate based on the local offline status snapshot and queries whether the one-time use identifier exists in the local usage record. When the current verification step is not the first verification step, the target visitor verification terminal also verifies the usage record corresponding to the previous verification step. When the one-time presentation certificate verification is successful, the offline status snapshot is in an allowed usage state, the one-time use identifier does not exist in the local usage record, and the current verification step is the first verification step or the usage record corresponding to the previous verification step is verified, the identity verification success result is output, a usage record containing the temporary access identifier and the previous usage record summary is generated, the usage record is written locally and sent to the visitor terminal. Wherein, when the current verification step is the first verification step, the previous usage record summary adopts a preset initial summary. S5. After the target visitor verification terminal restores its communication connection with the enterprise visitor management server, it uploads the usage records generated during the period of disconnection to the enterprise visitor management server. S6. The enterprise visitor management server merges the usage records uploaded by multiple visitor verification terminals according to the sequential relationship between temporary access identifiers and usage records, identifies the repeated use conflicts of one-time use identifiers and the access order conflicts between usage records and verification step information, updates the reservation status according to the identification results, generates incremental status updates and sends them to the corresponding visitor verification terminals.

2. The enterprise visitor identity verification method based on privacy credentials according to claim 1, characterized in that, The reservation authorization information also includes the target enterprise identifier, reservation identifier, reservation validity period, allowed access area, and verification strategy identifier; The enterprise visitor management server concatenates and hashes the target enterprise identifier, reservation identifier, reservation valid time period, allowed access area, verification policy identifier, and reservation random quantity in a preset order to obtain a reservation binding summary, and writes the reservation binding summary into the reservation authorization information. The one-time presentation of proof is associated with the appointment binding summary to verify the consistency between the privacy credential presentation and the target company, the valid appointment period, and the allowed access area.

3. The enterprise visitor identity verification method based on privacy credentials according to claim 1, characterized in that, The offline status snapshot includes the snapshot version number, snapshot generation time, snapshot expiration time, credential status summary, appointment status summary, verification strategy summary, previous offline status snapshot summary, and signature of the enterprise visitor management server. No. The snapshot summary of the offline snapshot is determined according to the following formula: in, Indicates the first A snapshot summary of the offline status snapshot. Indicates the snapshot version number. Indicates the snapshot generation time. Indicates the time when the snapshot expires. This indicates a summary of the voucher status. This indicates a summary of the appointment status. This represents a summary of the verification strategy. This represents a summary of the previous offline snapshot. Represents a hash function. Indicates data concatenation; The visitor verification terminal verifies the source and version continuity of the offline status snapshot by using the signature of the enterprise visitor management server and the snapshot digest of the previous and subsequent offline status snapshots.

4. The enterprise visitor identity verification method based on privacy credentials according to claim 1, characterized in that, The target visitor verification terminal concatenates and hashes the terminal identifier, snapshot version number, current verification time period and one-time random number in a preset order to generate the dynamic verification challenge. The target visitor verification terminal records the usage status of the one-time random number, and determines that the verification of the one-time proof presentation has failed when the one-time proof presentation is not bound to the current dynamic verification challenge, the one-time random number has been used, or the dynamic verification challenge exceeds the preset valid duration.

5. The enterprise visitor identity verification method based on privacy credentials according to claim 4, characterized in that, The single-use identifier is generated according to the following formula: in, Indicates the first The first appointment Each verification step corresponds to a single-use identifier. Represents a pseudo-random function. This indicates the holder's secret corresponding to the holder's key commitment of the privacy credential. Indicates the first The number of appointments per appointment is random. This indicates the verification step identifier determined based on the verification step information. Represents a hash function. Indicates data concatenation; The one-time presentation certificate also includes a generation relationship certificate between the one-time use identifier and the holder's secret, the reservation random quantity, and the verification step identifier. The target visitor verification terminal verifies the generation relationship certificate without obtaining the holder's secret.

6. The enterprise visitor identity verification method based on privacy credentials according to claim 5, characterized in that, No. The first appointment Usage records corresponding to each verification step Including temporary access ID Single-use label Dynamic verification challenge Terminal identifier of the target visitor verification terminal Verification time Snapshot version number Summary of previous usage record and terminal signature ; The terminal signature Generate according to the following formula: in, This indicates the signature operation performed by the target visitor verification terminal using the terminal's private key. This indicates the usage record corresponding to the previous verification step; When the When the verification step is the first verification step Use a preset initial summary; when the first... When the verification step is not the first verification step, the target visitor verification terminal verifies the terminal signature of the previous usage record and the matching relationship between the previous usage record and the verification step information.

7. The enterprise visitor identity verification method based on privacy credentials according to claim 1, characterized in that, The target visitor verification terminal determines the maximum allowed usage time of the offline status snapshot based on the security level of its corresponding controlled area, and calculates the snapshot time distance between the current verification time and the offline status snapshot generation time. When the snapshot time distance does not exceed the maximum allowed usage time, the offline snapshot is determined to be in an allowed usage state; When the snapshot time exceeds the maximum allowed usage time, stop outputting the automatic identity verification result and output a manual review instruction or restrict visitors from entering the preset buffer area.

8. The enterprise visitor identity verification method based on privacy credentials according to claim 6, characterized in that, The enterprise visitor management server identifies reuse conflicts, access branch conflicts, and access order conflicts, including: The usage records uploaded by multiple visitor verification terminals are merged according to the temporary access identifier, and the terminal signature of each usage record is verified. When the same one-time use identifier corresponds to more than two valid use records, it is determined that there is a duplicate use conflict; When the same previous usage record summary corresponds to two subsequent usage records that are mutually exclusive as defined by the verification step information, an access branch conflict is determined to exist; When the order of visitor verification terminals corresponding to adjacent usage records is inconsistent with the verification step information, or when the verification time interval between adjacent visitor verification terminals is less than the shortest passage time determined based on the preset passage distance and preset maximum movement speed between visitor verification terminals, an access order conflict is determined. The enterprise visitor management server updates conflicting appointments to a restricted use status or a pending review status, and generates an incremental status update that includes the previous snapshot version number, a summary of the newly added invalid appointment, and a newly added invalid one-time use identifier.

9. A corporate visitor identity verification system based on privacy credentials, characterized in that, This includes an enterprise visitor management server, visitor terminals, and multiple visitor verification terminals; The enterprise visitor management server is used to generate appointment authorization information based on visitor appointment information, generate offline status snapshots based on credential status data and appointment status data, and send the signed appointment authorization information and the signed offline status snapshots to the visitor terminal and the visitor verification terminal, respectively. The visitor verification terminal is used to extract status verification parameters from the local offline status snapshot when the communication connection with the enterprise visitor management server is disconnected, generate a dynamic verification challenge, and send the dynamic verification challenge and status verification parameters to the visitor terminal. The visitor terminal is used to generate a one-time presentation certificate and a one-time use identifier according to a preset zero-knowledge proof protocol, based on privacy credentials, reservation authorization information, dynamic verification challenge and status verification parameters, and to send the usage record corresponding to the previous verification step to the target visitor verification terminal when the current verification step is not the first verification step. The target visitor verification terminal is used to verify the one-time proof based on the local offline status snapshot, query the local usage status of the one-time use identifier, verify the usage record corresponding to the previous verification step, and generate a usage record containing a temporary access identifier, a summary of the previous usage record and a terminal signature after the identity verification is passed. The visitor verification terminal is also used to upload the usage records generated during the period of disconnection to the enterprise visitor management server after the communication connection with the enterprise visitor management server is restored. The enterprise visitor management server is also used to merge usage records uploaded by multiple visitor verification terminals according to the sequential relationship between temporary access identifiers and usage records, identify duplicate usage conflicts and access order conflicts, update the reservation status and generate incremental status updates based on the identification results.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method described in any one of claims 1 to 8.

Images