An SM9 anonymous certificate generation method and system supporting key verification

Abstract

The application discloses a kind of SM9 anonymous credential generation method and system supporting key verification.The method includes seven stages of initialization, issuer key generation, user key generation, credential issuance, credential check, credential display and credential verification.The present application is based on the design of China's commercial cryptographic algorithm SM9 architecture, through cryptography commitment and zero-knowledge proof, so that users can only disclose part of the necessary attribute information according to business needs when performing identity verification, and the credentials displayed multiple times have unlinkability.In addition, the present application also sets up two types of pluggable expansion components that support third-party public verification and blind issuance of attribute plaintext to the issuer.The present application is free from the dependence on foreign specific signature construction of existing solutions, and is deeply compatible with domestic commercial encryption ecosystem, with the advantages of low computational overhead, flexible application scenarios, etc., and can be widely applied to various self-contained anonymous identity authentication scenarios.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically a method for generating SM9 anonymous credentials that supports key verification. Background Technology

[0002] With the continuous expansion of online service scenarios, the demand for user identity verification and permission determination is increasing, making identity authentication systems a crucial infrastructure for data element circulation. Users typically need to submit attribute information such as ID card number, mobile phone number, and level for verification before accessing various online services. Traditional identity authentication technologies often require users to disclose complete attribute information, exceeding the minimum information required for business authentication. This can easily lead to the leakage of sensitive information and cross-platform identity association, posing a serious threat to user privacy and security. Anonymous Credentials are a special identity authentication technology. Their core function is: the issuer issues credentials to the user, and the user only needs to disclose the necessary attributes for authentication during subsequent authentication processes and prove to the verifier that they possess valid credentials, thereby minimizing information disclosure. In traditional anonymous credential systems, the issuer, user, and verifier are independent of each other, and the credentials are publicly verifiable, making them suitable for identity authentication in open scenarios. In contrast, in closed scenarios such as bill services and enterprise management, the architecture where the same entity simultaneously undertakes the functions of issuance and verification is defined as Keyed-Verification Anonymous Credentials (KVAC). However, existing anonymous credential schemes are mostly based on signature constructions such as BBS, BBS+, and BBS#. Their underlying implementation relies on dedicated cryptographic tool libraries and additional credential parsing frameworks, and their overall technical approach suffers from insufficient compatibility with my country's commercial cryptographic algorithm system, making it difficult to meet the construction needs of my country's independent and controllable integrated cryptographic infrastructure. Summary of the Invention

[0003] The purpose of this invention is to design an anonymous credential scheme (SM9-KVAC) that supports key verification based on the SM9 identifier cryptographic algorithm, as well as its public verification and blind issuance extensions. This aims to address the current situation where mainstream anonymous credential schemes heavily rely on foreign cryptographic algorithms and are difficult to directly adapt to existing systems. While supporting selective disclosure and non-linkability, this invention reduces the computational overhead and communication costs for issuers and verifiers, thus meeting the development needs of domestically developed, secure, and efficient systems.

[0004] The technical solution to achieve the objective of this invention is as follows: On one hand, a method for generating SM9 anonymous credentials that supports key verification is provided, the method comprising:

[0005] Initialization phase: The identity authentication system determines the security parameters and the total number of attributes supported by the system, determines the cyclic group and its generator, defines the hash function, and outputs the common parameters;

[0006] Issuer key generation stage: The issuer selects a random number as the issuer private key based on the public parameters, and calculates the issuer public key based on the generator.

[0007] User key generation stage: The user selects a random number as the user private key based on the public parameters, and calculates the user public key based on the generator;

[0008] Certificate issuance stage: The issuer generates an attribute commitment that binds the user's public key and the attribute set based on the issuer's private key, the user's public key and the corresponding attribute set, and calculates and generates a certificate and a zero-knowledge proof to prove that the certificate was correctly generated based on the attribute commitment;

[0009] Credential verification phase: The user performs a credential verification based on the issuer's public key, the credential, and the zero-knowledge proof;

[0010] Credential Presentation Stage: Based on the user's private key, credentials, attribute set, and selected disclosure attribute index set, the user randomizes the user's public key and credentials, generates a randomized user public key, randomized credentials, and corresponding user-side zero-knowledge proof, and sends the disclosure attributes, randomized public key, randomized credentials, and user-side zero-knowledge proof to the verifier.

[0011] Credential verification phase: The verifier performs legitimacy verification based on the issuer's private key, the received disclosure attributes, the randomized public key, the randomized credential, and the user-side zero-knowledge proof.

[0012] Furthermore, during the initialization phase, security parameters are input. and the number of attributes ,Sure Cyclic group and its generators , , Indicates the first Groups corresponding to each attribute Generator; Define hash function The common parameters output are ,in Includes from 1 to All positive integers, For model The set of non-zero integers.

[0013] Furthermore, in the issuer key generation stage, randomly select The output issuer's private key is The issuer's public key is ;

[0014] In the user key generation stage, randomly select The output user private key is The user's public key is .

[0015] Furthermore, in the certificate issuance stage, the specific calculation process includes:

[0016] Random selection ;

[0017] Calculate the attribute commitment :

[0018]

[0019] In the formula, This refers to the user's i-th attribute;

[0020] Calculate voucher items And B:

[0021]

[0022]

[0023] Generating zero-knowledge proofs :

[0024]

[0025] In the formula, This represents a non-interactive zero-knowledge proof function;

[0026] Output vouchers and zero-knowledge proof .

[0027] Furthermore, during the credential verification phase, the user receives the credential. and zero-knowledge proof Then, calculate:

[0028]

[0029] like If the verification passes, output 1 and save the voucher; otherwise, output 0.

[0030] Furthermore, in the certificate display stage, the specific calculation process includes:

[0031] Based on the disclosure attribute index set Random selection ;

[0032] calculate:

[0033]

[0034] Compute randomized public key :

[0035]

[0036] And generate the corresponding zero-knowledge proof. :

[0037]

[0038] In the formula, ;

[0039] Calculate randomized voucher items And let ;

[0040] Generate zero-knowledge proofs to demonstrate the correctness of attribute relationships. :

[0041]

[0042] Output disclosure attributes Randomized public key Randomized vouchers and proof .

[0043] Furthermore, in the credential verification phase, the verifier verifies the received credential. Verify and determine the equation. Whether it is true; if Verification passed and the equation If the certificate is valid, output 1 to confirm its validity; otherwise, output 0.

[0044] Furthermore, the method also includes supporting publicly verifiable extension mechanisms, allowing independent third parties to act as verifiers, whose modifications to the basic scheme include:

[0045] Replace the cyclic group and its generators with the group elements of the bilinear pairing group, i.e. , ,in , All three orders are large prime numbers The multiplicative cyclic group has a bilinear mapping. ;

[0046] Modify the issuer's public key to ;

[0047] During the certificate issuance phase, there is no need to calculate zero-knowledge proofs. ;

[0048] During the credential verification phase, the user uses a matching equation. Check the accuracy of the vouchers;

[0049] During the credential verification phase, the third-party verifier first checks the equation. Whether it holds true, further verification and proof are needed. .

[0050] Furthermore, the method also includes an extended mechanism supporting blind issuance, used to conceal the user's plaintext attributes from the issuer when issuing credentials, the specific steps of which include:

[0051] Users randomly select blinding factors Calculate blinded attribute commitments :

[0052]

[0053] In the formula, , For a large prime number Multiplication cyclic group;

[0054] Users use zero-knowledge proofs Prove to the issuer The correctness of the format;

[0055] Publisher After verification, based on Interactive issuance of blind certificates ,in ;

[0056] After receiving the blinded credential, the user calculates the following by removing the blinding factor:

[0057]

[0058]

[0059] Thus, the original voucher can be recovered. .

[0060] On the other hand, an SM9 anonymous credential generation system supporting key verification is provided, the system comprising:

[0061] The system administrator module is used to invoke the initialization algorithm to determine and share common system parameters;

[0062] Issuer network equipment is used to run the issuer key generation algorithm to generate key pairs and to run the credential issuance algorithm to generate credentials and corresponding zero-knowledge proofs for users.

[0063] User terminal equipment is used to run a user key generation algorithm to generate key pairs, run a credential verification algorithm to verify the received credentials, and in the credential display stage, call a display algorithm to generate a randomized user public key, randomized credentials, and corresponding zero-knowledge proofs to provide to the verifier.

[0064] The validator network device is used to receive disclosure attributes, randomized public keys, randomized credentials, and zero-knowledge proofs sent by user terminals, and to run credential verification algorithms to verify their legitimacy.

[0065] Compared with the prior art, the significant advantages of this invention are:

[0066] (1) This scheme is designed based on the SM9 identifier cryptographic algorithm promulgated by the State Cryptography Administration. It belongs to the domestic independent commercial cryptographic system, which gets rid of the serious dependence of the existing mainstream schemes on foreign signature construction such as BBS, BBS+, and BBS#. It can better meet the construction needs of my country's independent and controllable integrated cryptographic infrastructure.

[0067] (2) The SM9 public key encryption algorithm used in this scheme can be accessed through cryptographic tool libraries that are compatible with the OpenSSL ecosystem, such as GmSSL. Therefore, it can be directly adapted to and compatible with existing online service systems and widely deployed identity infrastructure, without relying on dedicated cryptographic tool libraries and additional credential parsing frameworks as foreign schemes do.

[0068] (3) Compared with similar schemes based on BBS signature families widely used internationally, the zero-knowledge proof relationship involved in this scheme is simpler, and the computational and communication overhead in actual operation is lower, which can significantly improve the processing efficiency of issuers and verifiers.

[0069] (4) The present invention can achieve selective disclosure of multiple attributes (users only need to disclose the necessary attributes required for authentication), and can ensure the non-linkability of multiple credential displays, effectively prevent cross-platform identity association, avoid leakage of sensitive information, and protect the privacy and security of users.

[0070] (5) This invention natively supports two types of pluggable extension components: publicly verifiable and blind issuance. In open scenarios where the issuing and verification entities do not need to be the same, the mechanism that supports independent third-party verification can be freely switched; in scenarios where the issuer needs to obtain plaintext user attributes, the blind issuance mechanism can be directly enabled; it can be adapted to various privacy authentication scenarios such as closed and open scenarios according to actual needs, and has a wide range of applications.

[0071] The present invention will now be described in further detail with reference to the accompanying drawings. Attached Figure Description

[0072] Figure 1 This is a flowchart illustrating an implementation of an SM9 anonymous credential generation method that supports key verification in one embodiment. Detailed Implementation

[0073] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0074] It should be noted that if the embodiments of the present invention involve descriptions such as "first" and "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" and "second" may explicitly or implicitly include at least one of those features. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0075] To address the problems of the existing technologies mentioned above, this invention proposes an SM9 anonymous credential generation method (SM9-KVAC) that supports key verification, and provides two extensions: publicly verifiable and blind issuance. The SM9 identifier cryptography algorithm is an identifier-based public-key cryptography algorithm promulgated by the State Cryptography Administration (see the "SM9 Identifier Cryptography Algorithm" specification, State Cryptography Administration, March 2016). The algorithm defines algorithms or protocols including digital signatures, key exchange, key encapsulation, and public-key encryption. The SM9 public-key encryption algorithm is widely used for data confidentiality protection due to its high security and efficiency, and can be integrated into existing online service systems through cryptographic toolkits compatible with the OpenSSL ecosystem, such as GmSSL.

[0076] The SM9-KVAC scheme designed based on the SM9 identifier cryptography algorithm can achieve selective disclosure of multiple attributes and non-linkability between multiple credential presentations. It supports two pluggable extension components: public verification and blind issuance. The computational and communication overhead required is lower than that of similar schemes based on the BBS signature family.

[0077] In one embodiment, an SM9 anonymous credential generation method (SM9-KVAC) supporting key verification is proposed, which generally includes three entities: system administrator, user, and issuer (who is also the verifier). The method includes:

[0078] Initialization phase: The identity authentication system determines the security parameters and the total number of attributes supported by the system, determines the cyclic group and its generator, defines the hash function, and outputs the common parameters;

[0079] Issuer key generation stage: The issuer selects a random number as the issuer private key based on the public parameters, and calculates the issuer public key based on the generator.

[0080] User key generation stage: The user selects a random number as the user private key based on the public parameters, and calculates the user public key based on the generator;

[0081] Certificate issuance stage: The issuer generates an attribute commitment that binds the user's public key and the attribute set based on the issuer's private key, the user's public key and the corresponding attribute set, and calculates and generates a certificate and a zero-knowledge proof to prove that the certificate was correctly generated based on the attribute commitment;

[0082] Credential verification phase: The user performs a credential verification based on the issuer's public key, the credential, and the zero-knowledge proof;

[0083] Credential Presentation Stage: Based on the user's private key, credentials, attribute set, and selected disclosure attribute index set, the user randomizes the user's public key and credentials, generates a randomized user public key, randomized credentials, and corresponding user-side zero-knowledge proof, and sends the disclosure attributes, randomized public key, randomized credentials, and user-side zero-knowledge proof to the verifier.

[0084] Credential verification phase: The verifier performs legitimacy verification based on the issuer's private key, the received disclosure attributes, the randomized public key, the randomized credential, and the user-side zero-knowledge proof.

[0085] Furthermore, in one embodiment, during the initialization phase, security parameters are input. Given the number of attributes n, determine the p-order cyclic group. and its generators , , Indicates the first Groups corresponding to each attribute Generator; Define hash function The common parameters output are ,in Includes from 1 to All positive integers, For model The set of non-zero integers.

[0086] Furthermore, in one embodiment, during the issuer key generation phase, a random selection is made. The output issuer's private key is The issuer's public key is ;

[0087] In the user key generation stage, randomly select The output user private key is The user's public key is .

[0088] Furthermore, in one embodiment, the specific calculation process during the certificate issuance stage includes:

[0089] Random selection ;

[0090] Calculate the attribute commitment :

[0091]

[0092] In the formula, This refers to the user's i-th attribute;

[0093] Calculate voucher items And B:

[0094]

[0095]

[0096] Generating zero-knowledge proofs :

[0097]

[0098] In the formula, This represents a non-interactive zero-knowledge proof function;

[0099] Output vouchers and zero-knowledge proof .

[0100] Furthermore, in one embodiment, during the credential verification phase, the user receives the credential. and zero-knowledge proof Then, calculate:

[0101]

[0102] like If the verification passes, output 1 and save the voucher; otherwise, output 0.

[0103] Furthermore, in one embodiment, the specific calculation process during the credential presentation stage includes:

[0104] Based on the disclosure attribute index set Random selection ;

[0105] calculate:

[0106]

[0107] Compute randomized public key :

[0108]

[0109] And generate the corresponding zero-knowledge proof. :

[0110]

[0111] In the formula, ;

[0112] Calculate randomized voucher items And let ;

[0113] Generate zero-knowledge proofs to demonstrate the correctness of attribute relationships. :

[0114]

[0115] Output disclosure attributes Randomized public key Randomized vouchers and proof .

[0116] Furthermore, in one embodiment, during the credential verification phase, the verifier verifies the received proof. Verify and determine the equation. Whether it is true; if Verification passed and the equation If the certificate is valid, output 1 to confirm its validity; otherwise, output 0.

[0117] Furthermore, in one embodiment, the method also includes supporting publicly verifiable extension mechanisms that allow independent third parties to act as verifiers, whose modifications to the basic scheme include:

[0118] Replace the cyclic group and its generators with the group elements of the bilinear pairing group, i.e. , ,in , All three orders are large prime numbers The multiplicative cyclic group has a bilinear mapping. ;

[0119] Modify the issuer's public key to ;

[0120] During the certificate issuance phase, there is no need to calculate zero-knowledge proofs. ;

[0121] During the credential verification phase, the user uses a matching equation. Check the accuracy of the vouchers;

[0122] During the credential verification phase, the third-party verifier first checks the equation. Whether it holds true, further verification and proof are needed. .

[0123] Here, the definition of bilinear pairing is explained: Let... All three orders are large prime numbers Multiplicative cyclic group, mapping A pair is called a bilinear pairing if and only if it simultaneously satisfies the following three properties:

[0124] 1. Bilinearity: For any group of elements and and any integer All satisfy ;

[0125] 2. Non-degeneracy: Existence of group elements and , making ,in For target group The unit is yuan;

[0126] 3. Computability: For any group of elements and The pairing results can be obtained by using efficient polynomial-time algorithms. .

[0127] In supporting publicly verifiable extensions, this invention removes the restriction that the issuance and verification of credentials must be performed by the same entity, allowing the verifier to be any independent third party. This extension is based on SM9-KVAC and includes the above modifications.

[0128] Furthermore, in one embodiment, the method also includes an extended mechanism supporting blind issuance, used to conceal the user's plaintext attributes from the issuer when issuing credentials, the specific steps of which include:

[0129] Users randomly select blinding factors Calculate blinded attribute commitments :

[0130]

[0131] In the formula, , For a large prime number Multiplication cyclic group;

[0132] Users use zero-knowledge proofs Prove to the issuer The correctness of the format;

[0133] Publisher After verification, based on Interactive issuance of blind certificates ,in ;

[0134] After receiving the blinded credential, the user calculates the following by removing the blinding factor:

[0135]

[0136]

[0137] Thus, the original voucher can be recovered. .

[0138] In one embodiment, an SM9 anonymous credential generation system supporting key verification is provided, the system comprising:

[0139] The system administrator module is used to invoke the initialization algorithm to determine and share common system parameters;

[0140] Issuer network equipment is used to run the issuer key generation algorithm to generate key pairs and to run the credential issuance algorithm to generate credentials and corresponding zero-knowledge proofs for users.

[0141] User terminal equipment is used to run a user key generation algorithm to generate key pairs, run a credential verification algorithm to verify the received credentials, and in the credential display stage, call a display algorithm to generate a randomized user public key, randomized credentials, and corresponding zero-knowledge proofs to provide to the verifier.

[0142] The validator network device is used to receive disclosure attributes, randomized public keys, randomized credentials, and zero-knowledge proofs sent by user terminals, and to run credential verification algorithms to verify their legitimacy.

[0143] For specific limitations of the system, please refer to the limitations of the SM9 anonymous credential generation method that supports key verification mentioned above, which will not be repeated here.

[0144] In one embodiment, an SM9 anonymous credential generation apparatus supporting key verification is provided, the apparatus comprising:

[0145] The first module is used to implement the initialization phase: the identity authentication system determines the security parameters and the total number of attributes supported by the system, determines the cyclic group and its generator, defines the hash function, and outputs the common parameters;

[0146] The second module is used to implement the issuer key generation stage: the issuer selects a random number as the issuer private key according to the public parameters, and calculates the issuer public key based on the generator;

[0147] The third module is used to implement the user key generation stage: the user selects a random number as the user private key according to the public parameters, and calculates the user public key based on the generator;

[0148] The fourth module is used to implement the certificate issuance stage: the issuer generates an attribute commitment that binds the user's public key and the attribute set based on the issuer's private key, the user's public key and the corresponding attribute set, and calculates and generates a certificate and a zero-knowledge proof for proving that the certificate is correctly generated based on the attribute commitment;

[0149] The fifth module is used to implement the credential verification stage: the user performs a credential correctness check based on the issuer's public key, the credential, and the zero-knowledge proof;

[0150] The sixth module is used to implement the credential display stage: the user randomizes the user public key and credential based on the user private key, credential, attribute set and selected disclosure attribute index set, generates a randomized user public key, randomized credential and corresponding user-side zero-knowledge proof, and sends the disclosure attribute, randomized public key, randomized credential and user-side zero-knowledge proof to the verifier.

[0151] The seventh module is used to implement the credential verification stage: the verifier performs legality verification based on the issuer's private key, the received disclosure attribute, the randomized public key, the randomized credential, and the user-side zero-knowledge proof.

[0152] Furthermore, the device also includes:

[0153] The eighth module is used to implement: support for publicly verifiable extension mechanisms;

[0154] The ninth module is used to implement an extension mechanism that supports blind release.

[0155] Specific limitations regarding the SM9 anonymous credential generation device supporting key verification can be found in the limitations of the SM9 anonymous credential generation method supporting key verification described above, and will not be repeated here. Each module in the aforementioned SM9 anonymous credential generation device supporting key verification can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0156] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements:

[0157] Initialization phase: The identity authentication system determines the security parameters and the total number of attributes supported by the system, determines the cyclic group and its generator, defines the hash function, and outputs the common parameters;

[0158] Issuer key generation stage: The issuer selects a random number as the issuer private key based on the public parameters, and calculates the issuer public key based on the generator.

[0159] User key generation stage: The user selects a random number as the user private key based on the public parameters, and calculates the user public key based on the generator;

[0160] Certificate issuance stage: The issuer generates an attribute commitment that binds the user's public key and the attribute set based on the issuer's private key, the user's public key and the corresponding attribute set, and calculates and generates a certificate and a zero-knowledge proof to prove that the certificate was correctly generated based on the attribute commitment;

[0161] Credential verification phase: The user performs a credential verification based on the issuer's public key, the credential, and the zero-knowledge proof;

[0162] Credential Presentation Stage: Based on the user's private key, credentials, attribute set, and selected disclosure attribute index set, the user randomizes the user's public key and credentials, generates a randomized user public key, randomized credentials, and corresponding user-side zero-knowledge proof, and sends the disclosure attributes, randomized public key, randomized credentials, and user-side zero-knowledge proof to the verifier.

[0163] Credential verification phase: The verifier performs legitimacy verification based on the issuer's private key, the received disclosure attributes, the randomized public key, the randomized credential, and the user-side zero-knowledge proof.

[0164] For specific limitations on each step, please refer to the limitations on the SM9 anonymous credential generation method that supports key verification mentioned above, which will not be repeated here.

[0165] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program being implemented when executed by a processor:

[0166] Initialization phase: The identity authentication system determines the security parameters and the total number of attributes supported by the system, determines the cyclic group and its generator, defines the hash function, and outputs the common parameters;

[0167] Issuer key generation stage: The issuer selects a random number as the issuer private key based on the public parameters, and calculates the issuer public key based on the generator.

[0168] User key generation stage: The user selects a random number as the user private key based on the public parameters, and calculates the user public key based on the generator;

[0169] Certificate issuance stage: The issuer generates an attribute commitment that binds the user's public key and the attribute set based on the issuer's private key, the user's public key and the corresponding attribute set, and calculates and generates a certificate and a zero-knowledge proof to prove that the certificate was correctly generated based on the attribute commitment;

[0170] Credential verification phase: The user performs a credential verification based on the issuer's public key, the credential, and the zero-knowledge proof;

[0171] Credential Presentation Stage: Based on the user's private key, credentials, attribute set, and selected disclosure attribute index set, the user randomizes the user's public key and credentials, generates a randomized user public key, randomized credentials, and corresponding user-side zero-knowledge proof, and sends the disclosure attributes, randomized public key, randomized credentials, and user-side zero-knowledge proof to the verifier.

[0172] Credential verification phase: The verifier performs legitimacy verification based on the issuer's private key, the received disclosure attributes, the randomized public key, the randomized credential, and the user-side zero-knowledge proof.

[0173] For specific limitations on each step, please refer to the limitations on the SM9 anonymous credential generation method that supports key verification mentioned above, which will not be repeated here.

[0174] Figure 1 This is a flowchart of one embodiment of the present invention, including two entities: a user and an issuer / verifier. First, the system administrator calls the initialization Setup algorithm to determine system parameters. , system parameters Shared with other entities; the issuer and user respectively call IssKeyGen and UserKeyGen to generate public and private keys. and Then, the issuer uses the user's public key and attribute set to invoke the Issue function to generate credentials. and zero-knowledge proof If the user successfully verifies the credentials using the Check function, the credentials are saved. The user can then freely choose a set of disclosure attributes. Call Show to obtain the randomized user public key. and randomized credentials At the same time, generate the corresponding proof. Finally, the verifier calls Verify to verify the user-provided verification. If all passes, it confirms that the disclosed attributes correspond to a valid certificate.

[0175] In summary, this invention eliminates the dependence of existing solutions on specific foreign signature constructions, is deeply compatible with the domestic commercial cryptography ecosystem, and has advantages such as low computational overhead and flexible application scenarios. It can be widely used in various self-controllable anonymous identity authentication scenarios.

[0176] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention without departing from its spirit and scope should be included within the protection scope of the present invention.

Claims

1. A method for generating SM9 anonymous credentials that supports key verification, characterized in that, The method includes: Initialization phase: The identity authentication system determines the security parameters and the total number of attributes supported by the system, determines the cyclic group and its generator, defines the hash function, and outputs common parameters; Issuer key generation stage: The issuer selects a random number as the issuer private key based on the public parameters, and calculates the issuer public key based on the generator. User key generation stage: The user selects a random number as the user private key based on the public parameters, and calculates the user public key based on the generator; Certificate issuance stage: The issuer generates an attribute commitment that binds the user's public key and the attribute set based on the issuer's private key, the user's public key and the corresponding attribute set, and calculates and generates a certificate and a zero-knowledge proof to prove that the certificate was correctly generated based on the attribute commitment; Credential verification phase: The user performs a credential verification based on the issuer's public key, the credential, and the zero-knowledge proof; Credential Presentation Stage: Based on the user's private key, credentials, attribute set, and selected disclosure attribute index set, the user randomizes the user's public key and credentials, generates a randomized user public key, randomized credentials, and corresponding user-side zero-knowledge proof, and sends the disclosure attributes, randomized public key, randomized credentials, and user-side zero-knowledge proof to the verifier. Credential verification phase: The verifier performs legitimacy verification based on the issuer's private key, the received disclosure attributes, the randomized public key, the randomized credential, and the user-side zero-knowledge proof.

2. The SM9 anonymous credential generation method supporting key verification according to claim 1, characterized in that, During the initialization phase, security parameters are input. and the number of attributes ,Sure Cyclic group and its generators , , Indicates the first Groups corresponding to each attribute Generator; Define hash function The output common parameters are ,in Includes from 1 to All positive integers, For model The set of non-zero integers.

3. The SM9 anonymous credential generation method supporting key verification according to claim 2, characterized in that, During the issuer key generation phase, randomly select The output issuer's private key is The issuer's public key is ; In the user key generation stage, randomly select The output user private key is The user's public key is .

4. The SM9 anonymous credential generation method supporting key verification according to claim 3, characterized in that, The specific calculation process during the certificate issuance stage includes: Random selection ; Calculate the attribute commitment : In the formula, For the user's first One attribute; Calculate voucher items And B: Generating zero-knowledge proofs : In the formula, This represents a non-interactive zero-knowledge proof function; Output vouchers and zero-knowledge proof .

5. The SM9 anonymous credential generation method supporting key verification according to claim 4, characterized in that, During the credential verification phase, the user receives the credential. and zero-knowledge proof Then, calculate: like If the verification passes, output 1 and save the voucher; otherwise, output 0.

6. The SM9 anonymous credential generation method supporting key verification according to claim 4, characterized in that, During the voucher display phase, the specific calculation process includes: Based on the disclosure attribute index set Random selection ; calculate: Compute randomized public key : And generate the corresponding zero-knowledge proof. : In the formula, ; Calculate randomized voucher items And let ; Generate zero-knowledge proofs to demonstrate the correctness of attribute relationships. : Output disclosure attributes Randomized public key Randomized vouchers and proof .

7. The SM9 anonymous credential generation method supporting key verification according to claim 6, characterized in that, During the credential verification phase, the verifier verifies the received credentials. Verify and determine the equation. Whether it is true; if Verification passed and the equation If the certificate is valid, output 1 to confirm its validity; otherwise, output 0.

8. The SM9 anonymous credential generation method supporting key verification according to any one of claims 7, characterized in that, The method also includes supporting publicly verifiable extension mechanisms that allow independent third parties to act as verifiers, whose modifications to the basic scheme include: Replace the cyclic group and its generators with the group elements of the bilinear pairing group, i.e. , ,in , All three orders are large prime numbers The multiplicative cyclic group has a bilinear mapping. ; Modify the issuer's public key to ; During the certificate issuance phase, there is no need to calculate zero-knowledge proofs. ; During the credential verification phase, the user uses a matching equation. Check the accuracy of the vouchers; During the credential verification phase, the third-party verifier first checks the equation. Whether it holds true, further verification and proof are needed. .

9. The method for generating SM9 anonymous credentials supporting key verification according to claim 7, characterized in that, The method also includes an extended mechanism to support blind issuance, used to conceal the user's plaintext attributes from the issuer when issuing credentials, the specific steps of which include: Users randomly select blinding factors Calculate blinded attribute commitment : In the formula, , For a large prime number Multiplication cyclic group; Users use zero-knowledge proofs Prove to the issuer The correctness of the format; Publisher After verification, based on Interactive issuance of blind certificates ,in ; After receiving the blinded credential, the user calculates the following by removing the blinding factor: Thus, the original voucher can be recovered. .

10. An SM9 anonymous credential generation system supporting key verification based on the method of any one of claims 1 to 9, characterized in that, The system includes: The system administrator module is used to invoke the initialization algorithm to determine and share common system parameters; Issuer network equipment is used to run the issuer key generation algorithm to generate key pairs and to run the credential issuance algorithm to generate credentials and corresponding zero-knowledge proofs for users. User terminal equipment is used to run a user key generation algorithm to generate key pairs, run a credential verification algorithm to verify the received credentials, and in the credential display stage, call a display algorithm to generate a randomized user public key, randomized credentials, and corresponding zero-knowledge proofs to provide to the verifier. The validator network device is used to receive disclosure attributes, randomized public keys, randomized credentials, and zero-knowledge proofs sent by user terminals, and to run credential verification algorithms to verify their legitimacy.

Images