Reusable zero-knowledge authentication protocol generation method and apparatus, and storage medium

Abstract

Provided in the present invention are a reusable zero-knowledge authentication protocol generation method and apparatus, and a storage medium. The method comprises: acquiring a hash value of identity information of at least one authorized user, and storing the hash value as a user list; selecting a random number, and on the basis of the user list and the random number, using a high-level language code required by a zero-knowledge proof system to perform compilation and setting, so as to generate a verification key and a proof key for a smart contract; generating the smart contract on the basis of the verification key; on the basis of evidence provided by the user, calling the smart contract to transmit data, and recording the evidence; and if the evidence provided by the user has been recorded, returning to the execution of key pair generation to generate a new smart contract. The technical solution in the embodiments of the present invention can improve the reliability, stability and security of an identity authentication system, avoid the risk of identity leaks during authentication, realize multiple instances of calling of a contract by means of different evidence, reduce the usage rate of a CPU, and improve the execution efficiency.

Description

A reusable zero-knowledge authentication protocol generation method, device and storage medium Technical Field

[0001] The present invention relates to the field of identity authentication, and in particular to a reusable zero-knowledge authentication protocol generation method, device and storage medium. Background Art

[0002] In wireless data access networks, sensors, as the primary data source, are densely deployed in diverse environments, collecting and generating large amounts of valuable and sensitive data. This data is often shared with external parties to provide various services. Sensor node data typically uses a server-client model. Sensor nodes upload collected data to designated servers for storage, and third parties retrieve the data from the servers. Traditional data collection methods carry the security risk of user identity leakage during the authentication process.

[0003] Summary of the Invention

[0004] To achieve the above objectives, the present invention proposes a reusable zero-knowledge authentication protocol generation method, device and storage medium, which can improve the reliability, stability and security of the identity authentication system, avoid the risk of identity leakage during the authentication process, realize multiple calls to the contract with different evidence, reduce CPU usage and improve execution efficiency.

[0005] A reusable zero-knowledge authentication protocol generation method proposed in an embodiment of the present invention includes: generating a user list, obtaining a hash value of the identity information of at least one authorized user and saving it as a user list; generating a key pair, selecting a random number, compiling and setting the high-level language code required by the zero-knowledge proof system based on the user list and the random number, and generating a verification key and a proof key for the smart contract; generating a contract, generating a smart contract based on the verification key; calling and updating the contract, calling the smart contract to transmit data and record the evidence based on the evidence provided by the user; if the evidence provided by the user has been recorded, returning to execute the generated key pair to generate a new smart contract. By combining random numbers with zero-knowledge proof and smart contracts, the reliability, stability and security of the identity authentication system can be improved, the risk of identity leakage during the authentication process can be avoided, and multiple calls to the contract with different evidence can be realized.

[0006] A reusable zero-knowledge authentication protocol generation device proposed in an embodiment of the present invention includes: a user list generation module, configured to obtain the hash value of the identity information of at least one authorized user and save it as a user list; a key pair generation module, configured to select a random number, compile and set the high-level language code required by the zero-knowledge proof system based on the user list and the random number, and generate a verification key and a proof key for the smart contract; a contract generation module, configured to generate a smart contract based on the verification key; a contract call update module, configured to call the smart contract to transmit data and record the evidence based on the evidence provided by the user; if the evidence provided by the user has been recorded, return to execute the key pair generation to generate a new smart contract. By combining random numbers with zero-knowledge proof and smart contracts, the reliability, stability and security of the identity authentication system can be improved, the risk of identity leakage during the authentication process can be avoided, and multiple calls to the contract with different evidence can be realized.

[0007] An electronic device proposed in an embodiment of the present invention includes: at least one processor; and a memory coupled to the at least one processor, wherein the memory is used to store instructions, and when the instructions are executed by the at least one processor, the processor executes the method described above.

[0008] An embodiment of the present invention provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed, the method described in any of the above embodiments is executed.

[0009] A computer program product provided in an embodiment of the present invention includes a computer program. When the computer program is executed by a processor, the method described in any one of the above embodiments is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The following drawings are only intended to illustrate and explain the present invention, and do not limit the scope of the present invention.

[0011] FIG1 is a flow chart of a reusable zero-knowledge authentication protocol generation method 100 according to an embodiment of the present invention.

[0012] FIG2 is a schematic structural diagram of a reusable zero-knowledge authentication protocol generation device 200 according to an embodiment of the present invention.

[0013] Figure 3 is a schematic diagram of an electronic device 300 according to an embodiment of the present invention.

[0014] The following are the descriptions of the reference numerals: DETAILED DESCRIPTION

[0015] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, specific embodiments of the present invention are now described with reference to the accompanying drawings.

[0016] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0017] As used in this application and the claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not intended to refer to the singular but may include the plural. Generally speaking, the terms "comprises" and "include" only indicate the inclusion of the steps and elements specifically identified, and these steps and elements do not constitute an exclusive list. A method or apparatus may also include other steps or elements.

[0018] Generally speaking, identity authentication solutions include password authentication, token authentication, user feature authentication, and SMS authentication. These methods can be further categorized into "what you know," such as passwords and PIN codes; "what you have," such as smart cards, hardware tokens, memory cards, and USB flash drives; and "who you are," i.e., biometrics: fingerprints, voiceprints, irises, faces, and palm prints.

[0019] On the other hand, identity management technologies such as SSO, IDaaS, and TACACS+ can be introduced to facilitate the authentication server to manage user identities.

[0020] Asymmetric blockchain-based identity authentication technology is used to prevent data leaks through private keys and encryption. Only authorized personnel can verify and access data. Blockchain technology inherently ensures data tamper-proofing, decentralized storage, traceability, and trust. It guarantees openness, effectiveness, and security of authentication.

[0021] In sensor networks, the user's identity information is used as input to interact with blockchain smart contracts. If the identity information is then disclosed to the public during the authentication process, it will also cause identity leakage.

[0022] Therefore, in order to provide a more optimized identity authentication method, an embodiment of the present invention proposes a reusable zero-knowledge authentication protocol generation method, device and storage medium. The method includes: obtaining the hash value of the identity information of at least one authorized user and saving it as a user list; selecting a random number, compiling and setting it based on the user list and the random number using the high-level language code required by the zero-knowledge proof system to generate a verification key and a proof key for the smart contract; generating a smart contract based on the verification key; calling the smart contract to transmit data based on the evidence provided by the user and recording the evidence; if the evidence provided by the user has been recorded, returning to execute the generated key pair to generate a new smart contract. The technical solution in the embodiment of the present invention can improve the reliability, stability and security of the identity authentication system, avoid the risk of identity leakage during the authentication process, realize multiple calls to the contract with different evidence, reduce CPU usage, and improve execution efficiency.

[0023] FIG1 is a flow chart of a reusable zero-knowledge authentication protocol generation method 100 according to an embodiment of the present invention. As shown in FIG1 , the method 100 may include:

[0024] Step S101: Generate a user list, obtain a hash value of identity information of at least one authorized user and save it as a user list.

[0025] Specifically, the hash value of the user identity information can be calculated using the SHA256 and SHA3 hash functions.

[0026] Step S102: Generate a key pair, select a random number, compile and set the high-level language code required by the zero-knowledge proof system based on the user list and the random number, and generate a verification key and a proof key for the smart contract.

[0027] Specifically, the smart contract can be updated by changing the random number. By modifying the logic of the smart contract, the smart contract can be used to record the accessed evidence. If it is accessed again, the verification fails. Finally, the used evidence cannot be used again.

[0028] Specifically, the zero-knowledge proof system can be ZK-SNARKs, ZK-STARKs or Bulletproofs.

[0029] Step S103: Generate a contract, and generate a smart contract based on the verification key.

[0030] Step S104: Call the update contract, call the smart contract to transmit data based on the evidence provided by the user and record the evidence; if the evidence provided by the user has been recorded, return to execute the key pair generation to generate a new smart contract.

[0031] Specifically, the external interface of the smart contract takes as input the visitor's proof of use and a random number from the public input. Finally, it returns a Boolean value. If true, the user can finally obtain the data through verification.

[0032] Specifically, smart contracts are used to record access evidence to prevent identity leaks and duplicate calls. If the caller of a contract uses different evidence each time, the contract can be reused multiple times, reducing the cost of contract updates. Even if a malicious node calls the contract using the evidence recorded in the smart contract, the worst-case scenario is that the node updates the contract after each call. This ensures that the malicious node cannot obtain data while consuming its tokens.

[0033] Step S105: Generate a certificate based on the identity information of the user to be authenticated and the random number.

[0034] In one embodiment, the hash value of the identity information of the user to be authenticated is compared with the user list. If the hash value of the identity information of the user to be authenticated exists in the user list, the certificate may be generated.

[0035] Step S106: Generate evidence based on the certification key and the certification.

[0036] FIG2 is a schematic diagram of the structure of a reusable zero-knowledge authentication protocol generation device 200 according to an embodiment of the present invention. As shown in FIG2 , the device 200 may include:

[0037] The user list generating module 201 is configured to obtain a hash value of identity information of at least one authorized user and save the hash value as a user list.

[0038] Specifically, the hash value of the user identity information can be calculated using the SHA256 and SHA3 hash functions.

[0039] The key pair generation module 202 is configured to: select a random number, compile and set the high-level language code required by the zero-knowledge proof system based on the user list and the random number, and generate a verification key and a proof key for the smart contract.

[0040] Specifically, the smart contract can be updated by changing the random number. By modifying the logic of the smart contract, the smart contract can be used to record the accessed evidence. If it is accessed again, the verification fails. Finally, the used evidence cannot be used again.

[0041] Specifically, the zero-knowledge proof system can be ZK-SNARKs, ZK-STARKs or Bulletproofs.

[0042] The contract generation module 203 is configured to generate a smart contract based on the verification key.

[0043] The call update contract module is configured to: call the smart contract to transmit data and record the evidence based on the evidence provided by the user; if the evidence provided by the user has been recorded, return to execute the key pair generation to generate a new smart contract.

[0044] Specifically, the external interface of the smart contract takes as input the visitor's proof of use and a random number from the public input. Finally, it returns a Boolean value. If true, the user can finally obtain the data through verification.

[0045] Specifically, smart contracts are used to record access evidence to prevent identity leaks and duplicate calls. If the caller of a contract uses different evidence each time, the contract can be reused multiple times, reducing the cost of contract updates. Even if a malicious node calls the contract using the evidence recorded in the smart contract, the worst-case scenario is that the node updates the contract after each call. This ensures that the malicious node cannot obtain data while consuming its tokens.

[0046] The certificate generation module 205 is configured to generate a certificate based on the identity information of the user to be authenticated and the random number.

[0047] In one embodiment, the hash value of the identity information of the user to be authenticated is compared with the user list. If the hash value of the identity information of the user to be authenticated exists in the user list, the certificate may be generated.

[0048] The evidence generation module 206 is configured to generate evidence based on the certification key and the certification.

[0049] Specifically, the user-generated identity evidence is based on private input and public input, and can be generated using elliptic curve technology.

[0050] The present invention also provides an electronic device 300. FIG3 is a schematic diagram of an electronic device 300 according to an embodiment of the present invention. As shown in FIG3 , the electronic device 300 includes a processor 310 and a memory 320. The memory 320 stores instructions, wherein the instructions, when executed by the processor 310, implement the method 100 described above.

[0051] The present invention further provides a computer-readable storage medium having computer instructions stored thereon. When the computer instructions are executed, the method described above is executed.

[0052] The present invention also provides a computer program product, comprising a computer program, which implements the above-mentioned method when executed by a processor.

[0053] Some aspects of the methods and apparatus of the present invention may be performed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The above hardware or software may be referred to as "data blocks," "modules," "engines," "units," "components," or "systems." The processor may be one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DAPDs), programmable logic devices (PLCs), field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, or combinations thereof. In addition, various aspects of the present invention may be embodied as computer products in one or more computer-readable media, the product including computer-readable program code. For example, computer-readable media may include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, tapes, etc.), optical disks (e.g., compact disks (CDs), digital versatile disks (DVDs), etc.), smart cards, and flash memory devices (e.g., cards, sticks, key drives, etc.).

[0054] Flowcharts are used herein to illustrate the operations performed by the methods according to the embodiments of the present application. It should be understood that the preceding operations are not necessarily performed in exact order. Instead, the various steps may be performed in reverse order or simultaneously. Furthermore, other operations may be added to these processes, or one or more operations may be removed from these processes.

[0055] It should be understood that although this specification is described according to various embodiments, not every embodiment contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

[0056] The above description is only an illustrative embodiment of the present invention and is not intended to limit the scope of the present invention. Any equivalent changes, modifications and combinations made by those skilled in the art without departing from the concept and principle of the present invention shall fall within the scope of protection of the present invention.

Claims

1. A reusable zero-knowledge authentication protocol generation method (100), characterized in that: The method comprises: Generate a user list (S101), obtain a hash value of identity information of at least one authorized user and save it as a user list; Generate a key pair (S102), select a random number, compile and set the high-level language code required by the zero-knowledge proof system based on the user list and the random number, and generate a verification key and a proof key for the smart contract; Generate a contract (S103), generating a smart contract based on the verification key; Call the updated contract (S104), call the smart contract to transmit data and record the evidence based on the evidence provided by the user; if the evidence provided by the user has been recorded, return to execute the key pair generation to generate a new smart contract.

2. The method according to claim 1, characterized in that Before calling the contract update, the method further comprises: Generate a certificate (S105), based on the identity information of the user to be authenticated and the random number; Generate evidence (S106), generate evidence based on the certification key and the certification.

3. The method according to claim 2, characterized in that The generating proof further comprises: The hash value of the identity information of the user to be authenticated is compared with the user list. If the hash value of the identity information of the user to be authenticated exists in the user list, the certificate can be generated.

4. A reusable zero-knowledge authentication protocol generation device (200), characterized in that: The device comprises: A user list generating module (201) is configured to: obtain a hash value of identity information of at least one authorized user and save it as a user list; A key pair generation module (202) is configured to: select a random number, compile and set the high-level language code required by the zero-knowledge proof system based on the user list and the random number, and generate a verification key and a proof key for the smart contract; A contract generation module (203) is configured to: generate a smart contract based on the verification key; The call update contract module (204) is configured to: call the smart contract to transmit data and record the evidence based on the evidence provided by the user; if the evidence provided by the user has been recorded, return to execute the key pair generation to generate a new smart contract.

5. The device according to claim 4, characterized in that Before executing the call to update the contract module, the device further includes: A certificate generation module (205) is configured to: generate a certificate based on the identity information of the user to be authenticated and the random number; The evidence generation module (206) is configured to generate evidence based on the proof key and the proof.

6. The device according to claim 5, characterized in that The proof generation module is further configured to: The hash value of the identity information of the user to be authenticated is compared with the user list. If the hash value of the identity information of the user to be authenticated exists in the user list, the certificate can be generated.

7. An electronic device (300), comprising: at least one processor (310); as well as A memory (320) coupled to the at least one processor (310), the memory (320) being used to store instructions, which, when executed by the at least one processor (310), causes the processor (310) to perform the method according to any one of claims 1 to 3.

8. A computer-readable storage medium having computer instructions stored thereon, wherein the computer instructions, when executed, execute the method according to any one of claims 1 to 3.

9. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 3 when being executed by a processor.

Images