CN110717760A - One-stop efficient PKI authentication service method based on block chain - Google Patents

Abstract

A one-stop efficient PKI authentication service method based on a block chain is characterized in that a miner node M1 carries out system initialization, corresponding system parameters are generated and published to the whole block chain, a user c initiates certificate registration/updating/revocation transaction to a supervision node, and the supervision node inquires and verifies a transaction initiator and then places qualified transactions into an unprocessed transaction Pool. And the miner node extracts corresponding transactions according to the sequence to finish the block-out operation, and correspondingly realizes the registration, updating or revocation of the user certificate. User c sends service id to miner node_VAnd witness W_cWhen the information is received, the miner node verifies and returns the session key and the service authorization ticket; then the user sends witness and service authorization bill to the third party service provider, namely initiates a service request, the session security between the user and the service provider is ensured by the session key, and the service provider verifiesAnd after the user identity passes the authentication, the user is provided with related services, and the one-stop authentication service is completed.

Description

One-stop efficient PKI authentication service method based on block chain

Technical Field

The invention relates to the technical field of block chain technology and public key identity authentication.

Background

Public Key Infrastructure (PKI) is a universal security Infrastructure that is established using the theory and technology of Public Key cryptosystems to provide information security services, enabling users to conduct communications and e-commerce transactions through a series of trust relationships based on certificates without knowing the identity of the other party or the distribution of the users. As the foundation and core of the current network security construction, PKI is the basic guarantee for the security development of electronic commerce. To ensure secure transmission of information, an effective PKI system must be secure and transparent. But the biggest problem faced by traditional centralized PKI in a distributed environment is the problem that the CA is not trusted, resulting in the identity of the entity being untrusted. The attack of the CA or the issuance of the certificate by the malicious CA brings about a great potential safety hazard to the information system, and a hacker can execute malicious operation by the CA trusted by the attack user so as to realize man-in-the-middle attack, such as the issuance of the user certificate containing false information. The user cannot verify the process of issuing the certificate by the CA, so that the problem of transparency of the certificate exists. In addition, due to the centralized CA management architecture, if a CA fails, the use of all user certificates is affected, and a single point of failure problem exists.

The block chain technology is an integrated application of distributed storage, point-to-point transmission, a consensus mechanism and an encryption algorithm. Through the block chain distributed node verification and consensus mechanism, trust establishment among decentralized system nodes can be achieved, meanwhile, a shared, determined and unchangeable record is provided for a public account book, and data consistency and tampering resistance are guaranteed. Therefore, the block chain technology is used for solving the problems of counterfeiting, centralization, key management, certificate distribution and the like in the traditional identity authentication system, and a new thought is brought to the realization of decentralized PKI.

Disclosure of Invention

The invention aims to provide a block chain-based one-stop efficient PKI authentication service method.

The invention relates to a block chain-based one-stop efficient PKI authentication service method, which comprises the following steps:

(1) initialization: first a group of nodes elects miners' nodes according to a consensus mechanism such as DPOS,the miner node M1 with the highest weight creates a safety parameter n with the length of k-bit and an empty set A_uLet us order

Setting initial participating member list L ═ { c ═ c₁,…,c_mAnd M is more than or equal to 1 and less than or equal to M, wherein M is a threshold value, namely at least one miner node is included. The following steps are then performed:

adaptive selection of miner node M1

Calculating β ═ σ λ mod Φ (n)²) And β ∈ T'. Uniform random selection

The public key PK of the dynamic accumulator is (n, beta), the private key SK is (sigma, lambda, gamma), and P is (PK, SK);

selecting

And (3) calculating:

outputting an initial accumulated value v₀Auxiliary information a_cAnd A_l＝(y₁,…,y_m) (ii) a Wherein f (x) is (x-1)/n;

will initially accumulate value v₀And auxiliary information a_c、A_lEqual-correlation parameter packingThe block is broadcasted to the whole network, other miner nodes and supervision nodes verify that the block is attached to the existing block chain, otherwise, the block-out right is continued to the next miner node M2, the whole node group achieves consensus, and initialization is completed;

(2) and (3) certificate generation: after the system is initialized, the accumulated users can calculate corresponding witnesses according to the information disclosed on the block chain, and can also initiate applications to the miners 'nodes, and the miners' nodes sign and issue corresponding witnesses, which comprises the following specific steps:

the miner node or the user queries to obtain the existing auxiliary information a_c、A_lThe parameter P is (PK, SK), and a set of m elements is randomly selected

And (3) calculating:

note W_i＝(w_i,t_i) For user c_iThe finding of (i ═ 1, …, m). Will (c)_i＝h(id_i,AD_i),W_i＝(w_i,t_i),pk_i,v_i) Quadruplets as users c_iThe public key certificate of (1);

(3) and (3) verification: give user c_iAnd witness W_iAccumulated value v and accumulator public key PK, checking whetherAndif Yes, output Yes, i.e. verify user c_iHas indeed been accumulated in v, otherwise No is output;

(4) the new user credentials are registered. New user c_i ⁺Submitting its own encrypted identity information c_i、id_i、AD_iAnd the public key pk_iInitiating a registration transaction request to a supervisory node, the supervisory node coreTo c_A＝h(id_A,AD_A) And initiating confirmation to the network address, receiving confirmation information, namely performing digital signature on the confirmed transaction after verifying that the transaction is legal, then recording the transaction into an unprocessed transaction Pool, and selecting a certain number of new user certificate registration transactions from the unprocessed transaction Pool by the miner node, and recording as a user set to be added

Then select

And collectionsAnd (3) calculating:

let T equal T ∪ T⁺，A_u＝A_u∪{a_u}，a_c＝a_ca_umodn²Then a new accumulated value v' and new auxiliary information and new user c are obtained_i ⁺Witness of

Then, similar to the initialization, the miner node marks corresponding informationBroadcasting the packet, and adding the new block into the block chain by other miner nodes; in addition, in practical applications, it is recommended that T 'be a value of T' ═ 2¹⁶+1,…,n²}；

(5) User certificate revocation: pre-revocation of users

Presenting self witnesses W to a supervising node_i＝(w_i,t_i) And signing sigma, initiating an identity revocation transaction request, and after signature verification, also recording the identity revocation transaction request into an unprocessed transaction Pool; the miners node selects a certain amount of user identity revocation transactions from the unprocessed transaction Pool, and records the user identity revocation transactions as a set of users to be revoked

For a user identity revocation transaction, the supervision node firstly verifies the signature sigma to verify that the witness really belongs to the user, and then the step (3) is carried out to verify whether the user identity is accumulated;

if yes, selecting

And (3) calculating:

let a_c＝a_ca_umodn²，A_u＝A_u∪{a_uGet a new accumulated value v', a new auxiliary information a_cAnd a_u. Then, similarly to the initialization, the miner nodes pack and broadcast corresponding information, other miner nodes and the supervision node verify that the new blocks are added into the block chain, the certificate revocation affairs are recorded on the chain, and the W is witnessed_i＝(w_i,t_i) Expiration, i.e., the user credentials have expired;

(6) and (3) certificate updating: there are two methods for certificate renewal, the first is to renew only witnesses W, which is applicable to users who still use old keys but have a need for certificate renewal; at this time, user c is pre-updated_iPresenting self witnesses W to a supervising node_i＝(w_i,t_i) Signing sigma, initiating a certificate update transaction request, and counting the request into an unprocessed transaction Pool after verification; the miners node selects a certain amount of user certificate updating affairs from the unprocessed affair Pool and records the affairs as a user set to be updated

Then calculate w'_i＝w_ia_umod n²Get user c_iIs witnessed W'_i＝(w′_i,t_i) (ii) a Wherein the user c_iWitness of (W)_iSecond part t of_iIs generated when the user is added to the accumulator, and t_iThe value of (A) remains unchanged, only w_iWill change with witness updates and other transactions; thus, t_iCan also be used as c_iA substitute identifier in the accumulator;

it should be noted that each certificate carries corresponding timestamp and accumulator related information; parameter a whenever a miner performs a certificate registration or deletion_uIs updated once and is recorded in the set A_u(ii) a When a user initiates a certificate update transaction, miners need to inquire the last certificate update/registration time of the user and find the set A corresponding to the time till now_uElement (1) of

k is the time a between the last certificate update of the user and the certificate update transaction_uThe number of changes; computing

w′_i＝w_ia_umod n²Then the new witness W 'of the user'_i＝(w′_i,t_i) (ii) a Therefore, the user certificate updating is independent of the change of the accumulated value v, compared with other PKI systems applying accumulators, the scheme does not need to update the previous updating for all users according to the accumulated value updating every time when the certificate updating transaction is executed once, and the certificate updating efficiency is greatly improved;

the second is certificate update proposed when the user needs to use a new public and private key; user submission c_i,W_i＝(w_i,t_i),pk_i,pk′_i,AD_i,v_iOf which is pk'_iIs a new public key; when the user sends out the request transaction of updating the key, the supervisory node firstly carries out the third step to verify whether the user is registered or not and verify the network address and the user c_iThe consistency of (2); then, the latest certificate of the user is searched, and the public keys pk and pk of the certificate are verified_iWhether the public keys are consistent or not is used for preventing an adversary from maliciously updating the user certificate by using the old public key which is leaked by the user before; the user witness W 'is updated by the miner after the verification is passed'_iThen, the new public key of the user and other information are packaged into blocks and then broadcast, and other nodes pass verification and uplink is carried out;

(7) user/service authentication exchange: service authorization Ticket exchange: user c sends c, service id hoped to access to TGS (Ticket-indexing Servers) Ticket authorization server_VAnd witness W_cRequesting a service authorization Ticket SGT (Server-Granting Ticket), and returning a session key K after the miner verifies the Ticket_c,VAnd service authorization Ticket Ticket_V(ii) a The specific description is as follows:

(1)c→Miner:c||W_c||id_V||Authenticator_c

(2)Miner→c:c||Ticket_V||E(pk_c,[K_c,V||id_V||TS₂])

Ticket_V＝E(pk_V,[K_c,V||id_c||AD_c||TS₂||Lifetime])

Authenticator_c＝E(sk_c,[AD_c||TS₁])

wherein the Authenticator_cThe method comprises the steps that a legal authentication bill generated for a user ensures that a bill owner is the same as an owner when the bill is issued to the TGS, and the legal authentication bill can be used only once and has a very short life cycle; TGS according to id_cAnd W_cQuerying to obtain corresponding pk_cDecrypting the authentication ticket; k_c,VThe session key is used for ensuring the safe information exchange between the user and the third-party service provider; AD_cThe network address is used for preventing the bill from being used on a different workstation when the bill is applied; the Lifetime is used for preventing the bill from being used continuously after being expired; TS is a ticket issuing time stamp;

user/service authentication exchange: user c initiates a service request to a third party service provider and sends a Ticket_VAnd Authenticator_cThe third party service provider provides service after verification; the specific description is as follows:

(3)c→V:c||W_c||Ticket_V||Authenticator_c

(4)V→c:E(K_c,V,[W_V||TS₃+1])

Ticket_V＝E(pk_V,[K_c,V||id_c||AD_c||TS₂||Lifetime])

Authenticator_c＝E(sk_c,[AD_c||TS₃])

if mutual authentication is required, V should send a response message to c according to message (4); it is clear that the message is composed of a session key K_c,VEncryption, capable of ensuring that the message is generated only by V, and at the same time, capable of passing authentication W_VAnd realizing the confirmation of the message source.

The invention has the advantages that:

(1) defending against selective element attacks by malicious adversaries: the invention can effectively defend against attack of selected elements of malicious enemies. The block chain-based one-stop efficient PKI authentication service method is based on the cryptology difficulty hypothesis es-RSA, is high in safety, and can prevent malicious adversaries from forging certificates, namely forging identities and witnesses.

(2) Resistance to Sybil attack: the Sybil attack refers to an attack that by creating multiple account identities in a malicious node, an adversary can control most of a network with few nodes to realize denial of transaction, forking, double payment and the like. The invention binds the user network address and the user identity, and meanwhile, the addition of the new node needs to be authenticated by the supervision node, so that an adversary cannot create a plurality of identities in one node, and Sybil attack cannot be carried out.

(3) Efficient one-stop authentication services; the invention realizes the high-efficiency updating and revocation of the user certificate by utilizing the block chain technology and the dynamic accumulator, so that the management of the certificate is more convenient and efficient. And further, the efficient one-stop authentication service can be provided for the user and the third-party service provider.

Detailed Description

The invention relates to a block chain-based one-stop efficient PKI authentication service method, which comprises the following steps:

(1) initialization: firstly, a node group elects miner nodes according to a consensus mechanism such as DPOS, and the miner node M1 with the highest weight creates a safety parameter n with the length of k-bit and an empty set A_uLet us order

Setting initial participating member list L ═ { c ═ c₁,...,c_mAnd M is more than or equal to 1 and less than or equal to M, wherein M is a threshold value, namely at least one miner node is included. The following steps are then performed:

adaptive selection of miner node M1

Calculating β ═ σ λ mod Φ (n)²) And β ∈ T'. Uniform random selection

Let public key PK ═ n, β of dynamic accumulator, privateThe key SK ═ (σ, λ, γ), P ═ PK, SK;

selecting

And (3) calculating:

outputting an initial accumulated value v₀Auxiliary information a_cAnd A_l＝(y₁,…,y_m) (ii) a Wherein f (x) is (x-1)/n;

will initially accumulate value v₀And auxiliary information a_c、A_lThe related parameters are packaged into blocks to be broadcast to the whole network, other miner nodes and supervision nodes verify that the blocks are attached to the existing block chain, otherwise, the block-out right is continued to the next miner node M2, the whole node group achieves consensus, and initialization is completed;

(2) and (3) certificate generation: after the system is initialized, the accumulated users can calculate corresponding witnesses according to the information disclosed on the block chain, and can also initiate applications to the miners 'nodes, and the miners' nodes sign and issue corresponding witnesses, which comprises the following specific steps:

the miner node or the user queries to obtain the existing auxiliary information a_c、A_lThe parameter P is (PK, SK), and a set of m elements is randomly selected

And (3) calculating:

note W_i＝(w_i,t_i) For user c_iThe finding of (i ═ 1, …, m). Will (c)_i＝h(id_i,AD_i),W_i＝(w_i,t_i),pk_i,v_i) Quadruplets as users c_iThe public key certificate of (1);

(3) and (3) verification: give user c_iAnd witness W_iAccumulated value v and accumulator public key PK, checking whether

And

if Yes, output Yes, i.e. verify user c_iHas indeed been accumulated in v, otherwise No is output;

(4) the new user credentials are registered. New user c_i ⁺Submitting its own encrypted identity information c_i、id_i、AD_iAnd the public key pk_iInitiating a registration transaction request to a supervisory node, the supervisory node checking c_A＝h(id_A,AD_A) And initiating confirmation to the network address, receiving confirmation information, namely performing digital signature on the confirmed transaction after verifying that the transaction is legal, then recording the transaction into an unprocessed transaction Pool, and selecting a certain number of new user certificate registration transactions from the unprocessed transaction Pool by the miner node, and recording as a user set to be added

Then select

And collections

And (3) calculating:

let T equal T ∪ T⁺，A_u＝A_u∪{a_u}，a_c＝a_ca_umodn²Then a new accumulated value v' and new auxiliary information and new user c are obtained_i ⁺Witness of

Then, similarly to the initialization, the miner nodes pack and broadcast corresponding information, and other miner nodes add new blocks into the block chain; in addition, in practical applications, it is recommended that T 'be a value of T' ═ 2¹⁶+1,…,n²}；

(5) User certificate revocation: pre-revocation of users

Presenting self witnesses W to a supervising node_i＝(w_i,t_i) And signing sigma, initiating an identity revocation transaction request, and after signature verification, also recording the identity revocation transaction request into an unprocessed transaction Pool; the miners node selects a certain amount of user identity revocation transactions from the unprocessed transaction Pool, and records the user identity revocation transactions as a set of users to be revokedFor a user identity revocation transaction, the supervisory node first verifies the signatureSigma, verifying that the witness really belongs to the user, and then carrying out the step (3) to verify whether the user identity is accumulated;

if yes, selectingAnd (3) calculating:

let a_c＝a_ca_umodn²，A_u＝A_u∪{a_uGet a new accumulated value v', a new auxiliary information a_cAnd a_u. Then, similarly to the initialization, the miner nodes pack and broadcast corresponding information, other miner nodes and the supervision node verify that the new blocks are added into the block chain, the certificate revocation affairs are recorded on the chain, and the W is witnessed_i＝(w_i,t_i) Expiration, i.e., the user credentials have expired;

(6) and (3) certificate updating: there are two methods for certificate renewal, the first is to renew only witnesses W, which is applicable to users who still use old keys but have a need for certificate renewal; at this time, user c is pre-updated_iPresenting self witnesses W to a supervising node_i＝(w_i,t_i) Signing sigma, initiating a certificate update transaction request, and counting the request into an unprocessed transaction Pool after verification; the miners node selects a certain amount of user certificate updating affairs from the unprocessed affair Pool and records the affairs as a user set to be updated

Then calculate w'_i＝w_ia_umod n²Get user c_iIs witnessed W'_i＝(w′_i,t_i) (ii) a Wherein the user c_iWitness of (W)_iSecond part t of_iIs generated when the user is added to the accumulator, and t_iThe value of (A) remains unchanged, only w_iWill change with witness updates and other transactions; thus, t_iCan also be used as c_iA substitute identifier in the accumulator;

it should be noted that each certificate carries corresponding timestamp and accumulator related information; parameter a whenever a miner performs a certificate registration or deletion_uIs updated once and is recorded in the set A_u(ii) a When a user initiates a certificate update transaction, miners need to inquire the last certificate update/registration time of the user and find the set A corresponding to the time till now_uElement (1) of

k is the time a between the last certificate update of the user and the certificate update transaction_uThe number of changes; computingw′_i＝w_ia_umod n²Then the new witness W 'of the user'_i＝(w′_i,t_i) (ii) a Therefore, the user certificate updating is independent of the change of the accumulated value v, compared with other PKI systems applying accumulators, the scheme does not need to update the previous updating for all users according to the accumulated value updating every time when the certificate updating transaction is executed once, and the certificate updating efficiency is greatly improved;

the second is certificate update proposed when the user needs to use a new public and private key; user submission c_i,W_i＝(w_i,t_i),pk_i,pk′_i,AD_i,v_iOf which is pk'_iIs newA public key; when the user sends out the request transaction of updating the key, the supervisory node firstly carries out the third step to verify whether the user is registered or not and verify the network address and the user c_iThe consistency of (2); then, the latest certificate of the user is searched, and the public keys pk and pk of the certificate are verified_iWhether the public keys are consistent or not is used for preventing an adversary from maliciously updating the user certificate by using the old public key which is leaked by the user before; the user witness W 'is updated by the miner after the verification is passed'_iThen, the new public key of the user and other information are packaged into blocks and then broadcast, and other nodes pass verification and uplink is carried out;

(7) user/service authentication exchange: service authorization Ticket exchange: user c sends c, service id hoped to access to TGS (Ticket-indexing Servers) Ticket authorization server_VAnd witness W_cRequesting a service authorization Ticket SGT (Server-Granting Ticket), and returning a session key K after the miner verifies the Ticket_c,VAnd service authorization Ticket Ticket_V(ii) a The specific description is as follows:

(1)c→Miner:c||W_c||id_V||Authenticator_c

(2)Miner→c:c||Ticket_V||E(pk_c,[K_c,V||id_V||TS₂])

Ticket_V＝E(pk_V,[K_c,V||id_c||AD_c||TS₂||Lifetime])

Authenticator_c＝E(sk_c,[AD_c||TS₁])

wherein the Authenticator_cThe method comprises the steps that a legal authentication bill generated for a user ensures that a bill owner is the same as an owner when the bill is issued to the TGS, and the legal authentication bill can be used only once and has a very short life cycle; TGS according to id_cAnd W_cQuerying to obtain corresponding pk_cDecrypting the authentication ticket; k_c,VThe session key is used for ensuring the safe information exchange between the user and the third-party service provider; AD_cThe network address is used for preventing the bill from being used on a different workstation when the bill is applied; the Lifetime is used for preventing the bill from being used continuously after being expired; TS is a ticket issuing time stamp; user/service authenticationExchange of certificates: user c initiates a service request to a third party service provider and sends a Ticket_VAnd Authenticator_cThe third party service provider provides service after verification; the specific description is as follows:

(3)c→V:c||W_c||Ticket_V||Authenticator_c

(4)V→c:E(K_c,V,[W_V||TS₃+1])

Ticket_V＝E(pk_V,[K_c,V||id_c||AD_c||TS₂||Lifetime])

Authenticator_c＝E(sk_c,[AD_c||TS₃])

if mutual authentication is required, V should send a response message to c according to message (4); it is clear that the message is composed of a session key K_c,VEncryption, capable of ensuring that the message is generated only by V, and at the same time, capable of passing authentication W_VAnd realizing the confirmation of the message source.

Description of the symbols:

W_cwitness to witness

c: user' s

σ: signature

K_c,V: session key

v: accumulated value

id_V: service ID AD_c: network address

TS time stamp for issuing bill

Life time: preventing the bill from being used after being expired

Authenticator_c: user generated legality authentication ticket

Ticket_V: service authorization ticket

PK: accumulator public key

SK: private key

a_c: additional messages

The following examples are used to further develop the invention.

The invention relates to a block chain-based one-stop efficient PKI authentication service method, which comprises the following specific implementation mode that firstly, a miner node initializes (k, M, L) → (P, a) a system_c,v₀,A_lThen, the new user initiates registration, the supervision node checks the registration transaction, the supervision node selects some transaction things from the pool through post-placement in the pool, and the miner node runs corresponding registration updating or revocation algorithm to complete registration of the user certificate (c)_i ⁺,id_i,AD_i,pk_i)→(a_u,a_c,v′,W_i ⁺) Update (c)_i,W_i,σ)→(W_i') undo transaction (c)_i ^-,W_i ^-,σ)→(a_u,a_cV'), the user may then initiate a corresponding authentication or service request (c, W)_c,id_V,Authenticator_c)→(K_c,V,Ticket_V) The service request is to request the miner node to obtain a service authorization ticket and a session key, and then the service request is initiated to a third-party service provider by using the session key and the service authorization ticket, and the third-party authentication passes the provision of the corresponding service.

Claims (1)

1. A block chain-based one-stop efficient PKI authentication service method is characterized by comprising the following steps:

(1) initialization: firstly, a node group elects miner nodes according to a consensus mechanism such as DPOS, and the miner node M1 with the highest weight creates a safety parameter n with the length of k-bit and an empty set A_uLet us orderT′＝{3,…,n²And setting an initial participating member list L ═ c₁,...,c_mAnd M is more than or equal to 1 and less than or equal to M, wherein M is a threshold value, namely at least one miner node is included. The following steps are then performed:

adaptive selection of miner node M1

Calculating β ═ σ λ mod Φ (n)²) And β ∈ T'. Uniform random selection

The public key PK of the dynamic accumulator is (n, beta), the private key SK is (sigma, lambda, gamma), and P is (PK, SK);

selecting

And (3) calculating:

outputting an initial accumulated value v₀Auxiliary information a_cAnd A_l＝(y₁,…,y_m) (ii) a Wherein f (x) is (x-1)/n;

will initially accumulate value v₀And auxiliary information a_c、A_lThe related parameters are packaged into blocks to be broadcast to the whole network, other miner nodes and supervision nodes verify that the blocks are attached to the existing block chain, otherwise, the block-out right is continued to the next miner node M2, the whole node group achieves consensus, and initialization is completed;

(2) and (3) certificate generation: after the system is initialized, the accumulated users can calculate corresponding witnesses according to the information disclosed on the block chain, and can also initiate applications to the miners 'nodes, and the miners' nodes sign and issue corresponding witnesses, which comprises the following specific steps:

the miner node or the user queries to obtain the existing auxiliary information a_c、A_lThe parameter P is (PK, SK), and a set of m elements is randomly selectedAnd (3) calculating:

note W_i＝(w_i,t_i) For user c_iThe finding of (i ═ 1, …, m). Will (c)_i＝h(id_i,AD_i),W_i＝(w_i,t_i),pk_i,v_i) Quadruplets as users c_iThe public key certificate of (1);

(3) and (3) verification: give user c_iAnd witness W_iAccumulated value v and accumulator public key PK, checking whether

And

if Yes, output Yes, i.e. verify user c_iHas indeed been accumulated in v, otherwise No is output;

(4) the new user credentials are registered. New user c_i ⁺Submitting its own encrypted identity information c_i、id_i、AD_iAnd the public key pk_iInitiating a registration transaction request to a supervisory node, the supervisory node checking c_A＝h(id_A,AD_A) And initiating confirmation to the network address, receiving confirmation information, namely performing digital signature on the confirmed transaction after verifying that the transaction is legal, then recording the transaction into an unprocessed transaction Pool, and selecting a certain number of new user certificate registration transactions from the unprocessed transaction Pool by the miner node, and recording as a user set to be addedThen select

And collectionsAnd (3) calculating:

let T equal T ∪ T⁺，A_u＝A_u∪{a_u}，a_c＝a_ca_umod n²Then a new accumulated value v' and new auxiliary information and new user c are obtained_i ⁺Witness of

Then, similarly to the initialization, the miner nodes pack and broadcast corresponding information, and other miner nodes add new blocks into the block chain; in addition, in practical applications, it is recommended that T 'be a value of T' ═ 2¹⁶+1,…,n²}；

(5) User certificate revocation: pre-revocation of users

Presenting self witnesses W to a supervising node_i＝(w_i,t_i) And signing sigma, initiating an identity revocation transaction request, and after signature verification, also recording the identity revocation transaction request into an unprocessed transaction Pool; the miners node selects a certain amount of user identity revocation transactions from the unprocessed transaction Pool, and records the user identity revocation transactions as a set of users to be revoked

For a user identity revocation transaction, the supervision node firstly verifies the signature sigma to verify that the witness really belongs to the user, and then the step (3) is carried out to verify whether the user identity is accumulated;

if yes, selecting

And (3) calculating:

let a_c＝a_ca_umod n²，A_u＝A_u∪{a_uGet a new accumulated value v', a new auxiliary information a_cAnd a_u. Then, similarly to the initialization, the miner nodes pack and broadcast corresponding information, other miner nodes and the supervision node verify that the new blocks are added into the block chain, the certificate revocation affairs are recorded on the chain, and the W is witnessed_i＝(w_i,t_i) Fail, i.e. useThe user credential has failed;

(6) and (3) certificate updating: there are two methods for certificate renewal, the first is to renew only witnesses W, which is applicable to users who still use old keys but have a need for certificate renewal; at this time, user c is pre-updated_iPresenting self witnesses W to a supervising node_i＝(w_i,t_i) Signing sigma, initiating a certificate update transaction request, and counting the request into an unprocessed transaction Pool after verification; the miners node selects a certain amount of user certificate updating affairs from the unprocessed affair Pool and records the affairs as a user set to be updated

Then calculate w'_i＝w_ia_umod n²Get user c_iUpdate witness W_i′＝(w′_i,t_i) (ii) a Wherein the user c_iWitness of (W)_iSecond part t of_iIs generated when the user is added to the accumulator, and t_iThe value of (A) remains unchanged, only w_iWill change with witness updates and other transactions; thus, t_iCan also be used as c_iA substitute identifier in the accumulator;

it should be noted that each certificate carries corresponding timestamp and accumulator related information; parameter a whenever a miner performs a certificate registration or deletion_uIs updated once and is recorded in the set A_u(ii) a When a user initiates a certificate update transaction, miners need to inquire the last certificate update/registration time of the user and find the set A corresponding to the time till now_uElement (1) of

k is the time a between the last certificate update of the user and the certificate update transaction_uThe number of changes; computing

w′_i＝w_ia_umod n²Then it is toNew witness W of user_i′＝(w′_i,t_i) (ii) a Therefore, the user certificate updating is independent of the change of the accumulated value v, compared with other PKI systems applying accumulators, the scheme does not need to update the previous updating for all users according to the accumulated value updating every time when the certificate updating transaction is executed once, and the certificate updating efficiency is greatly improved;

the second is certificate update proposed when the user needs to use a new public and private key; user submission c_i,W_i＝(w_i,t_i),pk_i,pk_i′,AD_i,v_iWherein pk_i' is a new public key; when the user sends out the request transaction of updating the key, the supervisory node firstly carries out the third step to verify whether the user is registered or not and verify the network address and the user c_iThe consistency of (2); then, the latest certificate of the user is searched, and the public keys pk and pk of the certificate are verified_iWhether the public keys are consistent or not is used for preventing an adversary from maliciously updating the user certificate by using the old public key which is leaked by the user before; the miners update the user witness W after the verification is passed_i' then packaging the new public key of the user and other information into blocks and broadcasting the blocks, and enabling other nodes to pass verification and uplink;

(7) user/service authentication exchange: service authorization Ticket exchange: user c sends c, service id hoped to access to TGS (Ticket-indexing Servers) Ticket authorization server_VAnd witness W_cRequesting a service authorization Ticket SGT (Server-Granting Ticket), and returning a session key K after the miner verifies the Ticket_c,VAnd service authorization Ticket Ticket_V(ii) a The specific description is as follows:

(1)c→Miner:c||W_c||id_V||Authenticator_c

(2)Miner→c:c||Ticket_V||E(pk_c,[K_c,V||id_V||TS₂])

Ticket_V＝E(pk_V,[K_c,V||id_c||AD_c||TS₂||Lifetime])

Authenticator_c＝E(sk_c,[AD_c||TS₁])

wherein the Authenticator_cThe method comprises the steps that a legal authentication bill generated for a user ensures that a bill owner is the same as an owner when the bill is issued to the TGS, and the legal authentication bill can be used only once and has a very short life cycle; TGS according to id_cAnd W_cQuerying to obtain corresponding pk_cDecrypting the authentication ticket; k_c,VThe session key is used for ensuring the safe information exchange between the user and the third-party service provider; AD_cThe network address is used for preventing the bill from being used on a different workstation when the bill is applied; the Lifetime is used for preventing the bill from being used continuously after being expired; TS is a ticket issuing time stamp;

user/service authentication exchange: user c initiates a service request to a third party service provider and sends a Ticket_VAnd Authenticator_cThe third party service provider provides service after verification; the specific description is as follows:

(3)c→V:c||W_c||Ticket_V||Authenticator_c

(4)V→c:E(K_c,V,[W_V||TS₃+1])

Ticket_V＝E(pk_V,[K_c,V||id_c||AD_c||TS₂||Lifetime])

Authenticator_c＝E(sk_c,[AD_c||TS₃])

if mutual authentication is required, V should send a response message to c according to message (4); it is clear that the message is composed of a session key K_c,VEncryption, capable of ensuring that the message is generated only by V, and at the same time, capable of passing authentication W_VAnd realizing the confirmation of the message source.