CN111797427B - Blockchain user identity supervision method and system giving consideration to privacy protection - Google Patents
Blockchain user identity supervision method and system giving consideration to privacy protection Download PDFInfo
- Publication number
- CN111797427B CN111797427B CN202010501526.3A CN202010501526A CN111797427B CN 111797427 B CN111797427 B CN 111797427B CN 202010501526 A CN202010501526 A CN 202010501526A CN 111797427 B CN111797427 B CN 111797427B
- Authority
- CN
- China
- Prior art keywords
- user
- key
- node
- information
- true identity
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 37
- 238000005516 engineering process Methods 0.000 claims abstract description 11
- 238000012795 verification Methods 0.000 claims description 17
- 238000004891 communication Methods 0.000 claims description 3
- 238000007405 data analysis Methods 0.000 abstract description 4
- 238000012544 monitoring process Methods 0.000 abstract description 4
- 230000001105 regulatory effect Effects 0.000 description 7
- 230000006399 behavior Effects 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 230000000977 initiatory effect Effects 0.000 description 2
- 238000004883 computer application Methods 0.000 description 1
- 125000004122 cyclic group Chemical group 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000002452 interceptive effect Effects 0.000 description 1
- 238000011835 investigation Methods 0.000 description 1
- 238000013507 mapping Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/45—Structures or tools for the administration of authentication
- G06F21/46—Structures or tools for the administration of authentication by designing passwords or checking the strength of passwords
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Computer Hardware Design (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Databases & Information Systems (AREA)
- Storage Device Security (AREA)
Abstract
The invention provides a blockchain user identity supervision method and system giving consideration to privacy protection, wherein the method comprises the following steps: the user requests to call the service; the CA authentication node verifies the access credentials of the user; the node server verifies and acquires the legitimacy of the access credential user, and splices key information containing the real identity information of the legal user and corresponding operation data and stores the key information and the corresponding operation data into a blockchain; the monitoring node monitors operation data in the blockchain, searches key information of illegal/illegal operation data, and acquires real identity information of illegal/illegal users. The invention supports anonymous admittance of users, adopts a mode of encrypting the true identity of the users, can achieve the aim of supervising the identity of the users under the condition of not modifying a blockchain base protocol, can reveal the identity of malicious users without adopting technologies such as big data analysis and the like, and has simplicity.
Description
Technical Field
The invention belongs to the technical field of computer application, and particularly relates to a blockchain user identity supervision method and system with privacy protection.
Background
Blockchain technology is essentially a distributed data storage and processing technology that primarily utilizes cryptographic methods (including hashing, digital signature, encryption, etc.) to protect anonymity, data integrity, non-counterfeitability, etc. It is these security features that make it difficult to be administered, which presents a number of security issues. To combat these security problems, blockchain user identity policing methods are required.
In the prior art, the regulatory authorities often need to obtain knowledge behind the hidden block data, which leaves the privacy of all users unprotected, and an attacker can extract a representation of the user by analyzing the block data. Common privacy protection techniques for blockchains include zero knowledge proof, ring signatures, group signatures, and the like. These techniques may provide strong privacy protection but increase the difficulty of supervision. To achieve supervision, it is often necessary to incorporate big data analysis techniques. For example, researchers at university of london have proposed heuristic address clustering methods based on anonymous digital currency Zcash (which employs zero knowledge proof technology to protect user privacy), which, in combination with public information on the network, enable the supervision of criminal offences in Zcash. But such methods do not take into account regulatory boundaries. Any person (especially lawbreaker) may use this technique to analyze to break the anonymity of the legitimate user and infringe the privacy of the legitimate user. In addition, implementing supervision based on big data analysis techniques is not simple and efficient. Chinese patent application CN109672529a discloses a method and system for anonymizing by combining blockchain and secret sharing, but the method encrypts the identity information after the user selects the symmetric key by himself, and does not realize authentication of the user identity. Even though the regulatory agency may recover the identity information by a corresponding method, it may be a false identity provided by the user. Therefore, the supervision method has no substantial effect.
Therefore, how to truly implement blockchain user identity supervision while protecting user privacy is a current urgent problem to be solved.
The cryptography technique adopted by the invention comprises the following steps:
Threshold signature algorithm: the signature private key sk (whose corresponding verification public key is vk) is divided into n shares and held by different entities. When a message m needs to be signed, a corresponding signature σ is generated by the entity co-operating protocol having at least t private key shares. Any entity can verify the legitimacy of the signature through vk. The security ensures that an attacker in any polynomial time cannot forge a legitimate signature with less than t signature private key shares.
Public key encryption algorithm: the decryption key dk (its corresponding encryption key pk) is held by one entity alone. Any entity can generate ciphertext c by encrypting message m with pk. Only the entity with dk of the decryption key can decrypt the ciphertext c.
Threshold encryption algorithm: the decryption key dk (its corresponding encryption key pk) is divided into m shares and held by different entities. Any entity can generate ciphertext c by encrypting message m with pk. When the ciphertext c needs to be decrypted, the entities having at least s decryption key shares co-operate with the corresponding plaintext m. The security ensures that an attacker in any polynomial time cannot properly decrypt a ciphertext with less than s shares of decryption keys.
Zero knowledge proof protocol: an interactive protocol is run between the prover and the verifier. The prover proves to the verifier and makes him/herself aware of a certain secret information. Security the verifier will only accept the proof if the prover knows the private information; while the attestation process does not leak any knowledge about the private information to the verifier. Any NP problem exists with a zero knowledge proof protocol.
Disclosure of Invention
In order to overcome the defects of the prior art, the invention provides a blockchain user identity supervision method and a blockchain user identity supervision system which are compatible with privacy protection, and the blockchain capable of supervising the identity is constructed by utilizing cryptography technologies such as a (t, n) threshold signature algorithm, a public key encryption algorithm, a (s, m) threshold encryption algorithm, a zero knowledge proof protocol and the like, and when illegal behaviors are discovered, the true identity of related malicious users can be revealed.
The invention adopts the following technical scheme:
A blockchain user identity supervision method giving consideration to privacy protection is applicable to a blockchain system consisting of n CA authentication nodes, m node servers, a supervision node and a plurality of users, and comprises the following steps:
1) When a user requests to call a service, a CA authentication node verifies an admission certificate of the user, wherein the admission certificate consists of a true identity information ciphertext and a signature of the true identity information ciphertext;
2) Obtaining key information by the verified user according to the true identity information ciphertext, sending the signature of the key information and the true identity information ciphertext to any node server, and proving that the user is a legal user to the corresponding node server;
3) The corresponding node server splices the key information and the operation data of the legal user and stores the key information and the operation data into a block chain;
4) The monitoring node monitors operation data in the blockchain, searches corresponding key information after finding illegal/illegal operation data, and obtains real identity information of illegal/illegal users.
Further, an admission voucher consisting of a true identity information ciphertext and a signature of the true identity information ciphertext is generated by:
1) The n CA authentication nodes cooperatively generate signature/verification public and private key pairs, the signature private keys are stored in the n CA authentication nodes through a (t, n) threshold signature algorithm, and the verification public keys are issued in a blockchain, wherein t is more than or equal to 1 and less than or equal to n;
2) A CA authentication node obtains a true identity information ciphertext through the true identity information of a user to be registered and a supervision public key issued by a supervision node;
3) The CA authentication node is combined with other t-1 CA authentication nodes to jointly generate a signature of a true identity information ciphertext.
Further, a signature of the authentic identity information ciphertext is generated by:
1) The CA authentication node sends a true identity information ciphertext to other t-1 CA authentication nodes;
2) t CA authentication nodes use the respective signature private key shares to sign the true identity information ciphertext, so as to obtain t signature shares;
3) The CA authentication node receives signature shares of other t-1 CA authentication nodes, and calculates the signature of the true identity information ciphertext through a Lagrange interpolation technology.
Further, key information is obtained by:
1) The m node servers cooperatively generate encryption/decryption public-private key pairs, store the decryption private keys in the m node servers through an (s, m) threshold encryption algorithm, and release the encryption public keys in a blockchain, wherein s is more than or equal to 1 and less than or equal to m;
2) The user obtains key information through the true identity information ciphertext and the encrypted public key.
Further, through the common operation of the user and the corresponding node server, if the user has a signature which can be verified by the verification public key and is corresponding to the true identity information ciphertext of the key information, the user is verified to be a legal user.
Further, the real identity information of the illegal/illegal user is obtained by the following steps:
1) After acquiring the key information, the supervision node sends a request for the key information to the node server;
2) A node server responds to the request and receives the key information, and the key information is decrypted by combining other s-1 node servers to obtain a true identity information ciphertext;
3) And the supervision node receives the true identity information ciphertext, and decrypts the true identity information ciphertext by using the supervision private key to obtain the true identity information of the illegal/illegal user.
Further, the key information is decrypted by:
1) The node server sends the key information to other s-1 node servers;
2) The s node servers decrypt the key information by using the respective decryption private key shares to obtain s decryption shares;
3) The node server receives decryption shares of other s-1 node servers and calculates a true identity information ciphertext through a Lagrange interpolation technology.
Further, after each authentication by the node server, the user generates a new user encryption/decryption key pair for encrypting the user's communication information with any node server.
A blockchain user identity supervision system with privacy protection function comprises n CA authentication nodes, m node servers, a supervision node and a plurality of users;
The CA authentication node is used for verifying an admission certificate formed by a true identity information ciphertext and a signature of the true identity information ciphertext of the user;
The node server is used for proving that the user is a legal user, and storing key information and operation data of the legal user into the block chain after splicing;
the user is used for generating real identity information and operation data and obtaining key information according to the ciphertext of the real identity information;
and the supervision node is used for monitoring the operation data in the blockchain, searching corresponding key information after finding out the illegal/illegal operation data, and acquiring the real identity information of the illegal/illegal user.
Further, after each layer of the user passes the certification, a new user encryption/decryption key pair is generated.
Compared with the prior art, the invention has the advantages that:
1. The invention adds the supervision function on the traditional blockchain technology, and can achieve the purpose of supervising the user identity under the condition of not modifying the blockchain base protocol by utilizing the cryptography technologies such as the (t, n) threshold signature algorithm, the public key encryption algorithm, the (s, m) threshold encryption algorithm, the zero knowledge proof protocol and the like which are relatively mature.
2. Compared with the prior art, the invention adopts a mode of encrypting the true identity of the user, and the supervision department can reveal the identity of the malicious user without adopting technologies such as big data analysis and the like, thereby having simplicity. In addition, the present invention supports anonymous admission to users, and only authenticated users can access blockchain services.
Drawings
FIG. 1 is a flow chart of the present invention.
Figure 2 is a user admission flow diagram.
FIG. 3 is a block chain service invocation flow diagram.
Fig. 4 is a user authentication flow chart.
Fig. 5 is an identity administration flow chart.
Detailed Description
The present invention will be further described in detail with reference to the following examples, in order to make the objects, technical solutions and advantages of the present invention more apparent.
The invention relates to a blockchain user identity supervision system with privacy protection, which comprises the following four types of entities: CA authentication nodes, (blockchain) node servers, regulatory authorities, and (blockchain) users;
1. The CA authentication node has a signature private key share of the (t, n) threshold signature algorithm: carrying out identity authentication on a user to obtain real identity information of the user; the real identity information is encrypted by using a public key of a supervision department to call a public key encryption algorithm, and a corresponding ciphertext is generated; and running corresponding protocols with other t-1 CA authentication nodes to generate (t, n) threshold signatures of true identity information ciphertext, and sending the (t, n) threshold signatures to a user as an admission certificate.
2. A (blockchain) node server having a decryption key share of a (t, n) threshold encryption algorithm, co-maintaining a blockchain network, providing blockchain services to users after they have provided legal access credentials by way of zero knowledge proof; storing key information (i.e., a (t, n) threshold encrypted ciphertext generated from the true identity information ciphertext) and operational data of the user for the regulatory authorities to conduct regulations; and responding to the key information decryption request of the supervision department, specifically, operating corresponding protocols with other t-1 node servers to decrypt corresponding (t, n) encrypted ciphertexts and returning decryption results (namely true identity information ciphertexts).
3. The regulatory department has a decryption key of the public key encryption algorithm alone: monitoring user behaviors in the blockchain network, and if illegal/illegal operations are found, obtaining corresponding key information; initiating a request for decrypting the key information to a blockchain network, so as to obtain a true identity information ciphertext; and decrypting the true identity information ciphertext, thereby obtaining the true identity information of the malicious user.
4. The user: obtaining an admission certificate after authentication of the CA authentication node; and running a zero knowledge proof protocol with the node server to provide access credentials, and calling the blockchain service after passing through the access credentials.
Based on the above entities, the blockchain user identity supervision method giving consideration to privacy protection of the present invention is shown in fig. 1, and is implemented by the following steps:
1. And (3) system establishment: generating a verification public key of a (t, n) threshold signature algorithm, and distributing a corresponding signature private key share for each CA authentication node; generating an encryption key of a public key encryption algorithm, and transmitting the corresponding decryption key to a supervision department; an encryption key for a (t, n) threshold encryption algorithm is generated and each node server is assigned a corresponding decryption key share. All authentication public keys and encryption keys are disclosed as system parameters.
Specifically:
Setting n CA authentication nodes, generating a verification public key vk of a (t, n) threshold signature algorithm, wherein a corresponding signature private key sk is divided into n shares and is denoted as sk i, wherein 1.ltoreq.i.ltoreq.n is an integer. Each CA authentication node is identified by a unique identifier i and assigned a corresponding signature private key share sk i. Taking a simple GDH threshold signature as an example:
Let G denote a cyclic group whose order is q, G being a generator; let H denote a hash function mapping from arbitrary length to group G.
All n CA authentication nodes together run a secure multiparty computing protocol to generate corresponding verification public keys and signature private keys, which together output a public key vk=x=g x, each authentication node gets a private key share sk i＝xi. When any t authentication nodes are joined, x= Σl i.xi can be reconstructed by classical lagrangian interpolation techniques. Wherein L i is the corresponding lagrangian coefficient.
When it is necessary to generate a signature of the message M, each authentication node calculates a signature shareAfter any one node collects t shares, a signature can be calculatedWhen it is required to verify whether (sigma, M) is a legal signature, it is only necessary to verify whether (g, X, H (M), sigma) is a legal DDH tuple.
M node servers are arranged to generate an encryption key ek of an (s, m) threshold encryption algorithm, and the corresponding decryption key dk is divided into m shares and is denoted as dk j, wherein 1.ltoreq.j.ltoreq.m is an integer. Each node server is identified by a unique identifier j and assigned a corresponding decryption key share dk j. Similar to the threshold signature described above, all m node servers collectively operate a secure multiparty computing protocol to collectively generate an encrypted public key, and each node server obtains a decryption key share dk j. The complete decryption key dk can be reconstructed by any combination of s node servers through classical lagrangian interpolation techniques. When a message needs to be decrypted, each node server generates a decryption share; after any one node collects s shares, the plaintext can be reconstructed by the corresponding technique.
The regulatory body generates itself an encryption key and a decryption key (ek sup,dksup) for a pair of public key encryption algorithms.
The disclosure (vk, ek, ek sup) is that system parameters are shared by all entities. Constructing a distributed authentication network by CA authentication nodes, and operating a blockchain protocol by a node server to construct a blockchain network
2. User admission: as shown in fig. 2, a user first sends a join request into a distributed authentication network; and then, a certain CA authentication node responds to carry out identity authentication, real identity information is encrypted by using a public key of a supervision department to call a public key encryption algorithm to generate a corresponding ciphertext, and the corresponding protocol is operated with other t-1 CA authentication nodes to generate a (t, n) threshold signature of the real identity information ciphertext, and the (t, n) threshold signature is returned to a user as an admission certificate.
Specifically:
1) The new user first initiates a join request into the distributed authentication network.
2) Active CA authentication responds to the request, authenticating its true identity (e.g., the identity card is valid and the principal is the holder).
3) If the authentication is not passed, the process is terminated.
4) If the authentication is passed, the true identity information (for example, an identity card number) is encrypted by ek sup to generate true identity information c, a threshold signature sigma of c is generated in combination with other t-1 CA authentication nodes, and (c, sigma) is returned to the user as an admission certificate.
3. Blockchain operation: as shown in fig. 3, the node servers co-operate to maintain the reading and writing of blockchain data by the corresponding blockchain protocol. Before any user invokes the blockchain service, the user first needs to run a zero knowledge proof protocol with a certain node server to prove that the user has corresponding access credentials; operational data generated by a user when invoking a blockchain service is stored in the blockchain along with its critical information (i.e., an (s, m) threshold encryption ciphertext generated from the user's true identity information ciphertext).
Specifically:
1) The user first initiates a service investigation request into the blockchain network.
2) The active node server responds to the request as a verifier running a zero knowledge proof protocol with the user to verify whether it has legitimate admission credentials.
3) If the verification is not passed, the service is refused to be provided.
4) If the verification is passed, providing corresponding service, and storing relevant operation data of the user together with key information thereof into a blockchain.
Further, step 2) is as shown in fig. 4:
a) The user encrypts C with ek as an encryption key to generate ciphertext C.
B) The user acts as a prover and the node server acts as a verifier running a zero knowledge proof protocol. In particular, the user proves to the node server that: which has a signature σ of the message C corresponding to C that can be verified by vk. This process does not reveal any information about (C, σ), even though the prover cannot decrypt C alone to obtain C.
C) If the certification is passed, the ciphertext C is stored as key information.
Further, the user proves to the node server that it has legitimate admission credentials based on the above procedure. After each authentication pass, the user can generate a new encryption key independent of the access certificate, thereby achieving the aim of confidentiality and communication between node servers.
In particular, ciphertext C in the message sent each time the user proves is a new ciphertext generated by C. Therefore, the ciphertext generated in different proving processes is also different, so that an attacker cannot link multiple service calls of the same user together, and anonymity (namely, unlinkability) is achieved.
4. Identity supervision: as shown in fig. 5, the supervision department monitors the user operation in the blockchain by its own method, and once the illegal/offending operation is found, the key information stored together with the operation is obtained by searching the blockchain; and initiating a request for decrypting key information to a node server in the blockchain network, and decrypting by a decryption protocol of which at least t node servers run a (t, n) threshold encryption algorithm to obtain a true identity ciphertext of the malicious user.
Specifically:
1) The supervision department monitors the user operation in the blockchain network, and after finding out the illegal/illegal operation, the supervision department can obtain the user key information C stored together with the relevant user operation data record from the data stored in the blockchain, and then initiate the request for decrypting the ciphertext to the blockchain network.
2) The active node server responds to the request, decrypts ciphertext C in combination with other s-1 node servers to obtain message C, and returns the message C to the supervision department.
3) The supervision department decrypts c by using the decryption key dk sup to obtain the real identity information of the malicious user.
The above examples are provided for the purpose of describing the present invention only and are not intended to limit the scope of the present invention. The scope of the invention is defined by the appended claims. Various equivalents and modifications that do not depart from the spirit and principles of the invention are intended to be included within the scope of the invention.
Claims (6)
1. A blockchain user identity supervision method giving consideration to privacy protection is applicable to a blockchain system consisting of n CA authentication nodes, m node servers, a supervision node and a plurality of users, and comprises the following steps:
1) When a user requests to call a service, a node server is used as a verifier to run a zero knowledge proof protocol with the user to verify whether the user has legal access credentials; wherein,
The generation process of the admission certificate comprises the following steps:
the n CA authentication nodes cooperatively generate signature/verification public and private key pairs, the signature private key sk is stored in the n CA authentication nodes through a (t, n) threshold signature algorithm, and the verification public key vk is issued in a block chain, wherein t is more than or equal to 1 and less than or equal to n;
When the user applies for permission, a CA authentication node verifies the true identity of the user, and after the verification is passed, an encryption key ek sup generated by a supervision node is used for encrypting the true identity to obtain true identity information c;
The CA authentication node for verifying the true identity of the user is combined with other t-1 CA authentication nodes to generate a threshold signature sigma of the true identity information c, and the true identity information c and the threshold signature sigma are returned to the user as an admission certificate;
The node server is used as a verifier to run a zero knowledge proof protocol with the user to verify whether the user has legal access credentials, and the node server comprises the following steps:
Generating an encryption key ek of an (s, m) threshold encryption algorithm; wherein, the decryption key dk corresponding to the encryption key ek is divided into m shares, and each decryption key share dk j is distributed to a node server, and j is more than or equal to 1 and less than or equal to m;
the user encrypts the real identity information C by using the encryption key ek to obtain key information C;
The node server is used as a verifier, and runs a zero knowledge proof protocol so that a user can prove that the user has a threshold signature sigma of a true identity message C corresponding to the key information C to the node server, wherein the threshold signature sigma can be verified by a verification public key vk;
2) Under the condition that the user has legal access credentials, providing the user with service requested to be invoked, and storing related operation data during the invocation together with key information C into a blockchain;
3) The supervision node monitors the operation data in the blockchain, searches the corresponding key information C after finding the illegal/illegal operation data, and obtains the real identity information of the illegal/illegal user.
2. The method of claim 1, wherein the offending/offending user true identity information is obtained by:
1) After acquiring the key information, the supervision node sends a request for the key information to the node server;
2) A node server responds to the request and receives the key information, and the key information is decrypted by combining other s-1 node servers to obtain a true identity information ciphertext;
3) And the supervision node receives the true identity information ciphertext, and decrypts the true identity information ciphertext by using the supervision private key to obtain the true identity information of the illegal/illegal user.
3. The method of claim 2, wherein the key information is decrypted by:
1) The node server sends the key information to other s-1 node servers;
2) The s node servers decrypt the key information by using the respective decryption private key shares to obtain s decryption shares;
3) The node server receives decryption shares of other s-1 node servers and calculates a true identity information ciphertext through a Lagrange interpolation technology.
4. The method of claim 1, wherein the user generates a new user encryption/decryption key pair for encrypting the user's communication with any of the node servers after each pass of the node server certification.
5. A blockchain user identity supervision system with privacy protection function comprises n CA authentication nodes, m node servers, a supervision node and a plurality of users; wherein,
When a user requests to call a service, a node server is used as a verifier to run a zero knowledge proof protocol with the user to verify whether the user has legal access credentials; wherein,
The generation process of the admission certificate comprises the following steps:
the n CA authentication nodes cooperatively generate signature/verification public and private key pairs, the signature private key sk is stored in the n CA authentication nodes through a (t, n) threshold signature algorithm, and the verification public key vk is issued in a block chain, wherein t is more than or equal to 1 and less than or equal to n;
When the user applies for permission, a CA authentication node verifies the true identity of the user, and after the verification is passed, an encryption key ek sup generated by a supervision node is used for encrypting the true identity to obtain true identity information c;
The CA authentication node for verifying the true identity of the user is combined with other t-1 CA authentication nodes to generate a threshold signature sigma of the true identity information c, and the true identity information c and the threshold signature sigma are returned to the user as an admission certificate;
The node server is used as a verifier to run a zero knowledge proof protocol with the user to verify whether the user has legal access credentials, and the node server comprises the following steps:
Generating an encryption key ek of an (s, m) threshold encryption algorithm; wherein, the decryption key dk corresponding to the encryption key ek is divided into m shares, and each decryption key share dk j is distributed to a node server, and j is more than or equal to 1 and less than or equal to m;
the user encrypts the real identity information C by using an encryption key e k to obtain key information C;
The node server is used as a verifier, and runs a zero knowledge proof protocol so that a user can prove that the user has a threshold signature sigma of a true identity message C corresponding to the key information C to the node server, wherein the threshold signature sigma can be verified by a verification public key vk;
Under the condition that the user has legal access credentials, providing the user with service requested to be invoked, and storing related operation data during the invocation together with key information C into a blockchain;
The supervision node monitors the operation data in the blockchain, searches the corresponding key information C after finding the illegal/illegal operation data, and obtains the real identity information of the illegal/illegal user.
6. The system of claim 5, wherein a new user encryption/decryption key pair is generated after each pass of the user.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010501526.3A CN111797427B (en) | 2020-06-04 | 2020-06-04 | Blockchain user identity supervision method and system giving consideration to privacy protection |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010501526.3A CN111797427B (en) | 2020-06-04 | 2020-06-04 | Blockchain user identity supervision method and system giving consideration to privacy protection |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111797427A CN111797427A (en) | 2020-10-20 |
| CN111797427B true CN111797427B (en) | 2024-07-30 |
Family
ID=72802886
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010501526.3A Active CN111797427B (en) | 2020-06-04 | 2020-06-04 | Blockchain user identity supervision method and system giving consideration to privacy protection |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111797427B (en) |
Families Citing this family (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112738106B (en) * | 2020-12-29 | 2022-06-24 | 合肥达朴汇联科技有限公司 | Block chain anonymous user auditing system |
| CN112861186B (en) * | 2021-01-28 | 2023-01-10 | 上海分布信息科技有限公司 | Identity consistency proving method and identity consistency proving system |
| CN113472807B (en) * | 2021-02-22 | 2023-03-21 | 支付宝(杭州)信息技术有限公司 | Private communication method and device between users |
| CN113127926B (en) * | 2021-03-12 | 2024-01-16 | 西安电子科技大学 | Method, system, storage medium and computer for analyzing statistical correlation of privacy data |
| CN113159774B (en) * | 2021-04-28 | 2024-01-09 | 中国互联网络信息中心 | Supervision zero knowledge proof verification method and system in blockchain |
| CN113360948A (en) * | 2021-06-30 | 2021-09-07 | 令牌云(上海)科技有限公司 | Method and device for protecting user secret data |
| CN113591128A (en) * | 2021-08-17 | 2021-11-02 | 东北大学秦皇岛分校 | Block chain illegal address supervision system based on group signature and tracing method |
| CN114329610B (en) * | 2021-12-29 | 2024-08-27 | 浙江吉利控股集团有限公司 | Block chain privacy identity protection method, device, storage medium and system |
| CN114297690B (en) * | 2021-12-29 | 2024-09-06 | 深圳前海微众银行股份有限公司 | Information verification method based on block chain |
| CN115242370B (en) * | 2022-05-23 | 2024-04-12 | 华数云科技有限公司 | Supervision system and method based on block chain trusted security multiparty calculation |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107483198A (en) * | 2017-09-25 | 2017-12-15 | 中国科学院信息工程研究所 | A kind of block catenary system supervised and method |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102143158B (en) * | 2011-01-13 | 2013-10-09 | 北京邮电大学 | Data anti-leakage method based on trusted platform module (TPM) |
| CN106845960B (en) * | 2017-01-24 | 2018-03-20 | 上海壹账通区块链科技有限公司 | Method for secure transactions and system based on block chain |
| CN109615373B (en) * | 2018-11-29 | 2021-07-27 | 中国电子科技集团公司第三十研究所 | Entrustable supervision anonymous privacy protection method in block chain system |
| CN110648229B (en) * | 2019-08-07 | 2022-05-17 | 中国科学院信息工程研究所 | Semi-public block chain system and transaction method |
-
2020
- 2020-06-04 CN CN202010501526.3A patent/CN111797427B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107483198A (en) * | 2017-09-25 | 2017-12-15 | 中国科学院信息工程研究所 | A kind of block catenary system supervised and method |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111797427A (en) | 2020-10-20 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111797427B (en) | Blockchain user identity supervision method and system giving consideration to privacy protection | |
| Tanveer et al. | RAMP-IoD: A robust authenticated key management protocol for the Internet of Drones | |
| Irshad et al. | A provably secure and efficient authenticated key agreement scheme for energy internet-based vehicle-to-grid technology framework | |
| CN111371730B (en) | Lightweight authentication method supporting anonymous access of heterogeneous terminal in edge computing scene | |
| CN110971411B (en) | SM2 homomorphic signature method for encrypting private key by multiplying based on SOTP technology | |
| JP2023500570A (en) | Digital signature generation using cold wallet | |
| Jiang et al. | Anonymous and efficient authentication scheme for privacy-preserving distributed learning | |
| CN109347626B (en) | Safety identity authentication method with anti-tracking characteristic | |
| CN112329519A (en) | Safe online fingerprint matching method | |
| He et al. | An accountable, privacy-preserving, and efficient authentication framework for wireless access networks | |
| CN111274594A (en) | Block chain-based secure big data privacy protection sharing method | |
| Deng et al. | Policy-based broadcast access authorization for flexible data sharing in clouds | |
| CN113411801A (en) | Mobile terminal authentication method based on identity signcryption | |
| CN110572392A (en) | Identity authentication method based on HyperLegger network | |
| CN116599659B (en) | Certificate-free identity authentication and key negotiation method and system | |
| CN110572257B (en) | Identity-based data source identification method and system | |
| CN114866244B (en) | Method, system and device for controllable anonymous authentication based on ciphertext block chaining encryption | |
| Kaaniche et al. | Id-based user-centric data usage auditing scheme for distributed environments | |
| CN115955320A (en) | Video conference identity authentication method | |
| De Lacerda Filho et al. | Improving Data Security, Privacy, and Interoperability for the IEEE Biometric Open Protocol Standard | |
| CN114301612A (en) | Information processing method, communication apparatus, and encryption apparatus | |
| Ahmed et al. | Mutual authentication for mobile cloud computing: Review and suggestion | |
| CN114765533A (en) | Remote certification method, device and system based on quantum key communication | |
| Burra et al. | Leakage resilient searchable symmetric encryption with periodic updation | |
| CN114598479B (en) | Face recognition privacy protection identity authentication method based on zero knowledge proof |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |