CN114301604A - A distributed public key infrastructure method based on blockchain and attribute signatures - Google Patents

Abstract

The invention belongs to the technical field of cryptography, in particular to a distributed public key infrastructure method based on block chain and attribute signature. The invention transforms the single-node CA of the traditional public key infrastructure into a multi-node CA that is arranged on the blockchain for collaborative certificate issuance/verification, and introduces cryptographic algorithms such as attribute-based signature and zero-knowledge proof, so that the certificate The identity of the representative is more fine-grained; the method of the present invention includes: system initialization, user initialization, signature issuance of certificate, certificate verification, certificate revocation and other steps; the present invention is a general scheme, suitable for various certificate-based identity authentication scenarios, and The breadth covered by the attributes makes the identity more three-dimensional, and the whole method has fine-grained identity authentication and certain fault tolerance. The invention combines non-interactive zero-knowledge proof to realize the non-repudiation of the certificate and expands the application of the invention breadth.

Description

A distributed public key infrastructure method based on blockchain and attribute signatures

technical field

The invention belongs to the technical field of cryptography, and in particular relates to a distributed public key infrastructure method based on block chain and attribute signature.

Background technique

A flexible and effective identity authentication/management scheme has always been one of the core requirements of the information age. Through a flexible and effective identity authentication/management scheme, we can uniquely determine the identity of each entity in the Internet. Public key infrastructure is one of the typical representatives. PKI can solve the trust problem between different entities by managing digital certificates, and it is one of the important cornerstones of the current Internet. However, there are many problems in the traditional centralized PKI. The biggest flaw is that the CA must be completely trusted. When the CA is attacked or the CA itself is a malicious node, the identity of the entity corresponding to the certificate issued by it cannot be authenticated or is not trusted. Impact on the identity authentication system of the Internet.

The decentralization of the blockchain, the consensus mechanism for synchronization, and tamper resistance provide new ideas for the development of PKI. In view of the problems existing in the centralized identity authentication system, the inventor found that many schemes use traditional CA Arranged on multiple nodes of the blockchain to achieve distributed authentication. The introduction of blockchain has brought many benefits: first, the consensus mechanism of blockchain natively supports data synchronization of multiple nodes; related data can be stored in the blockchain by using high-level programming language smart contracts running on the blockchain , so that users can apply for and query certificates under multiple nodes; second, because of the decentralization and immutable nature of the blockchain, the communication under it has a trust basis, and different users can exchange information securely.

The inventor found that the existing solutions still have some problems, including high computational overhead, insufficient anti-attack ability, ignoring certificate non-repudiation, etc. At the same time, they learned that attribute-based cryptography can provide fine-grained and flexible access control, It also provides a new development direction for PKI. An identity can be composed of a set of attributes, as long as the error between the user's attribute set and the required attribute set is within a certain range, the authentication can be considered successful. The introduction of attribute cryptography makes the identity of the authentication entity more three-dimensional. The identity of the entity can be composed of various attributes (such as identification information, organizational relationship, etc.), which is more in line with the real-world identity mechanism.

The inventor has designed a new distributed public key infrastructure method based on blockchain and attribute signature, which has the characteristics of generality, good performance, flexible and fine-grained identity mechanism, and non-repudiation.

references:

(1) Eberhardt J, Tai S. ZoKrates-Scalable Privacy-Preserving Off-ChainComputations[C]//2018 IEEE International Conference on Internet of Things(iThings) and IEEE Green Computing and Communications(GreenCom) and IEEECyber,Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData). IEEE, 2018. Aumasson J P, Neves S, Wilcox-O'Hearn Z, et al. BLAKE2:simpler,smaller,fast as MD5[C]//International Conference on Applied Cryptography and Network Security. Springer, Berlin, Heidelberg, 2013: 119-135;

(2) Fiat A, Shamir A. How To Prove Yourself: Practical Solutions toIdentification and Signature Problems[C]//Proceedings on Advances incryptology---CRYPTO'86. 1999.GB/T 32918, Information Security Technology SM2 Elliptic Curve Public key cryptographic algorithm [S];

(3) Wei Liang, Huang Zhenjie, Chen Qunshan. Decentralized attribute-based non-repudiation signature [J]. Computer Engineering and Science, 2020, 42(6): 9.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a distributed public key infrastructure method based on blockchain and attribute signature.

The present invention designs a general distributed public key infrastructure method based on attribute signature. In the system implemented based on this method, users can freely apply for the CA organization of the system through the open API (application programming interface, application programming interface). Certificates are issued and certificates are verified.

The invention uses blockchain and smart contracts as carriers. Due to the one-to-one correspondence between blockchain nodes and node public keys, it enables nodes to initiate secure and secret communication through smart contracts, and all nodes can obtain blocks through smart contracts. For the data on the chain (including but not limited to the public parameters of attribute signature and zero-knowledge proof), all nodes need to publicly upload the public key generated by initialization, the ciphertext generated by encryption, etc., and all data on the blockchain (including Certificate library, etc.) will be synchronized through the consensus mechanism of the blockchain.

A distributed public key infrastructure method based on block chain and attribute signature proposed by the present invention, the method is based on attribute signature, block chain, and zero-knowledge proof technology, including: system initialization, user initialization, signature issuing certificate, Certificate verification and certificate revocation; the specific steps are as follows:

(1) System initialization: The system initializes the relevant parameterization of the decentralized non-repudiation attribute signature, and uploads it to the blockchain publicly. At the same time, the system initializes the relevant parameters of the zero-knowledge proof ZoKrates, and publicly uploads it to the chain, representing the authority CA node of the attribute. Initialization, CA randomly generates the private key CSK of the attribute, and calculates the public key CPK from the private key, and publicly puts the CPK and other information on the chain;

(2) User initialization; User initialization, in addition to the information required to register the blockchain, User _{Applicant, u} (user u applying for a certificate) also needs to randomly generate a secret value S _u , so that the calculated ID identifies the UID _u is globally unique on the blockchain, User applies for attributes from several CA nodes, and obtains User's attribute private key AK _{u, i} and public key APK _{u, i} ;

(3) Signing and issuing certificates; User _{Applicants who expect to apply for specific n CA-issued certificates, u} has several attributes in n attributes, and sends network access request certificate services to the digital certificate registration center RA (registration authority) through the blockchain network, User _{Applicant, u} submits various information required for the certificate, RA confirms the information in various ways (including but not limited to offline authentication), if the information is incorrect, the node request is rejected, otherwise the information is sent to n CAs, The CA cooperates to sign the certificate, the RA collects the signature message to generate the signature, and stores it in the certificate store of the _blockchain . non-repudiation proof;

(4) Certificate verification: User _{Verifier, s} , which is expected to verify the identity of User _{Applicant, u (} user s who verify the certificate), initiates a verification request to User Applicant, u, User _{Applicant, u} , first goes to RA to obtain its own certificate, and Send the certificate to User _{Verifier, s} , User _{Verifier, s} to verify the certificate; see if the certificate is issued by a legitimate CA, see if the certificate of User _{Applicant, u} is revoked, check the validity period of the certificate and see if it is required. Issued by n CA nodes; if the certificate has expired, been revoked, or the certificate is not issued by a legitimate node, the identity authentication fails, otherwise the certificate is authenticated. The verification includes signature verification and zero-knowledge proof ZoKrates verification. User _{Applicant, the identity of u} ;

(5) Certificate revocation; certificate revocation is divided into expired revocation and User _Applicant 's active revocation, and the certificate revocation list (CRL) will be periodically updated by RA; User _{Applicant, if u} sends a request for revocation of its own certificate to RA , the RA verifies the zero-knowledge proof to confirm the User _{Applicant, u} identity, by adding the certificate to the CRL.

In the present invention, in step (3), the method for issuing certificates by signature is:

It may be assumed that there is a User _{Applicant, u} who expects to apply for a certificate, and it expects to apply for a certificate corresponding to the attribute set Ω = {Attr ₁ , Attr ₂ , ..., Attr _n }, User _{Applicant, u} has t attributes among them; User _{Applicant , u} can be regarded as an ordinary node in the blockchain, which sends the network access request certificate service to the RA node through the blockchain network, User _{Applicant, u} submits various information m (including UID _u ) required for the certificate, RA confirms information, if the information is wrong, reject the node request, otherwise send the information to n CA nodes:

(1) Sign(m, Su, UIDu, Ω, {APK _{u, i} , ASK _{u, i} }, {CPK _i , CSK _i })→P _nt (x), σ.

User _{Applicant, u} has t attributes. At this time, n CA nodes of PKI receive m (including UID _u ) and start to sign the certificate message m∈{0,1} ^* ;

(i) For User _Applicant, the CA node Attr _i of which u has attributes, let it be i=1,...,t, Attr _i randomly select t _i ∈ Zp ^* and calculate:

e _i =H ₁ (Attr _i , APK _u,i , UID _u , CPK _i ),

s _i =ASK _u,i +e _i CSK _i ,

_Attri sends Ri to the _RA node through a secure secret channel;

随机生成APK_u，i∈G，计算：(ii) For User _Applicant, the CA node Attr _i for which u does not have attributes may be randomly selected as i=t+1,...,n, Attr _i

Randomly generate APK _{u, i} ∈ G, compute:

e _i =H ₁ (Attr _i , APK _u,i , UID _u , CPK _i ),

Attr _i sends <ci , d _i , APK _{u, i ,} R _i > to the RA node through a secure secret channel;

(iii) The RA node sends R _i , i=1, . . . , n to User _{Applicant, u} , User _{Applicant, u} calculates:

(iv) and return to the RA node, the RA node calculates:

c=H ₂ (m, T ₁ , . . . , T _n , UID _u ).

(v) Then use n-t+1 points (0, c), (t+1, c _t+1 ), ..., (n, c _n ) to construct a Lagrangian interpolation polynomial Pn- t(x):

(vi) Send P _nt (x) to User _{Applicant, u} own CA node Attr _i with attributes, i = 1, ..., t. CA calculation:

c _i =P _nt ( _i ), d _i =t _i -ci s _i , i=1, . . . , t.

Attr _i sends < _{ci , d i >} to the RA node through a secure secret channel;

(vii) RA outputs the polynomial P _nt (x) and the signature:

σ=< _{ci , d i ,} T _i , APK _u,i , UID _u >, i=1, 2, ..., n.

(viii) RA appends P _nt (x) and σ to certificate information m, generates certificate M, sends it to User _{Applicant, u} through a secure secret channel, and uses the concatenation of UID _u and timestamp as the key, certificate The content is stored in the certificate store as value, and multiple certificate stores are automatically synchronized and backed up;

(2) zkProveGen(zkParams, w, x, M _L )→π _u .

User _{Applicant, u} executes ZoKrates' generating proof algorithm Prove(zkParams, w, x, M _L ), where among the input parameters, the proof:

e_i＝ H₁(Attr_i，APK_u，i，UID_u，CPK_i)>，

e _i = H ₁ (Attr _i , APK _{u, i} , UID _u , CPK _i )>,

且

User_{Applicant，u}将证明π_u， 命题x与图灵机算法M_L传输上链方便查询。The generated proof π _u takes the form of Fiat-Shamir Heurisitc. Specifically, π _u can prove that User _{Applicant, u} knows that the discrete logarithm S _u satisfies

and

User _{Applicant, u} will prove π _u , proposition x and Turing machine algorithm _ML transmission on the chain to facilitate query.

In the present invention, the certificate verification method in step (4) is:

It may be assumed that there is a User _{Verifier, s} that expects to verify the identity of User Applicant, _u , and it expects to verify the identity of User Applicant, _u . User _{Applicant, u} first goes to the RA node to obtain his own certificate, and sends the certificate to User _{Verifier, s} , User _{Verifier, s} verifies the certificate to see if the certificate is issued by a legitimate DPKI CA node, check whether the certificate of User _{Applicant, u} has been revoked, and check the validity period of the certificate; if the certificate has expired, been revoked, or the certificate is not legal If the node is issued, the identity authentication fails, otherwise the certificate is signed and authenticated;

Verify(m, σ, P _nt (x), π _u )→True/False.

(i) Verification

If one of the above fails, the signature is invalid;

(ii) After the above verifications are passed, User _{Verifier, s} obtains the proof π _u and ZoKrates related parameters on the blockchain, and executes the ZoKrates verification algorithm Verify(zkParams, x, M _L , π _u ), if the verification fails , the signature is an invalid signature; if the verification passes, the signature is a valid signature.

The present invention also has good performance in actual experimental tests, so the present invention has practical application feasibility. The present invention is a flexible and fine-grained identity authentication mechanism, which utilizes the breadth covered by the attributes of the decentralized non-repudiation attribute signature to make the identity more three-dimensional, and at the same time enables the whole method to have fine-grained identity authentication and certain fault tolerance. The attribute signature and threshold algorithm realize the fine-grained dynamic management and maintenance of information relationship and the trustworthiness maintenance, and introduce zero-knowledge proof to ensure the non-repudiation of the certificate.

Description of drawings

Figure 1 shows an example of the method architecture.

Figure 2 is an example of fields returned from applying for a certificate.

Figure 3 is an example of a certificate signature field.

Figure 4 is an example of the returned result of the verification certificate.

Figure 5 is an example of simulating 5000 users concurrent access.

Detailed ways

The present invention is further described below through specific embodiments, so that those skilled in the relevant fields can better understand the technology and functional characteristics of the present invention, but the protection scope of the present invention is not limited to the following embodiments.

Embodiment 1: In this embodiment, the programming language is Golang, and the browser is Chrome.

Figure 1 is a schematic diagram of the system architecture, and the specific process is:

1. System initialization:

(1)GlobalSetup(λ)→Params.

H₂：

将公共参数Params＝<G，p，g，Ω，H₁，H₂>打包上传至区块链；Select a cyclic group G, whose prime order N=p, and its generator is g. Corresponding to n CA nodes of distributed public key infrastructure, we have attribute population Ω={Attr ₁ , Attr ₂ ,..., Attr _n }, and also need to choose 2 hash functions H ₁ :

_H2 :

Pack and upload the public parameters Params=<G, p, g, Ω, H ₁ , H ₂ > to the blockchain;

(2) CASetup(Params)→CSK, CPK.

并计算出公钥

并将CPK_i公开上链； _n CA nodes, namely the attribute authority Attri, randomly generate their own private keys

and calculate the public key

And publicly list CPK _i on the chain;

(3) ZKSetup(1 ⁿ )→zkParams.

The public parameters zkParams are initialized through the Setup(1 ⁿ ) algorithm that comes with ZoKrates, and zkParams are publicly uploaded to the chain.

2. User initialization:

(1) USetup(λ ^u )→S _u , UID _u .

使得所计算的ID标识

是区块链上全局唯一的；User _{Applicant, u} randomly generates a secret value

so that the calculated ID identifies

is globally unique on the blockchain;

(2) UAttrSetup(UID _u , Attr _i )→ASK _{u, i} , APK _{u, i} .

作为User_{Applicant，u}的属性Attr_i的私钥，并计算

作为 User_{Applicant，u}的属性公钥，将<APK_u，i，ASK_u，i>通过安全的秘密信道发送给 User_{Applicant，u}并将APK_u，i公开上链。User _{Applicant, u applies} for attributes to the attribute authority Attri through various methods (including but not limited to offline application), and is confirmed by the attribute authority, and _Attri randomly selects

As the User _Applicant, the private key of the attribute Attr _i of u, and calculate

As the attribute public key of User _{Applicant, u} , send <APK _{u, i} , ASK _{u, i} > to User _{Applicant, u} through a secure secret channel, and publicly upload APK _{u, i} to the chain.

3. Sign and issue certificates: It may be assumed that there is a User _{Applicant, u} who expects to apply for a certificate, and he expects to apply for a certificate corresponding to the attribute set Ω={Attr ₁ , Attr ₂ , ..., Attr _n }, and User _{Applicant, u} has one of them. t attributes. User _{Applicant, u} can be regarded as an ordinary node in the blockchain, which sends a network access request certificate service to the RA node through the blockchain network, User _{Applicant, u} submits various information m (including UID _u ) required for the certificate, RA Confirm the information in various ways (including but not limited to offline authentication), if the information is wrong, reject the node request, otherwise send the information to n CA nodes:

(1) Sign(m, Su, UIDu, Ω, {APK _{u, i} , ASK _{u, i} }, {CPK _i , CSK _i })→P _nt (x), σ.

User _{Applicant, u} has t attributes. At this time, n CA nodes of PKI receive m (including UID _u ) and start to sign the certificate message m∈{0,1} ^* ;

(i) For User _Applicant, the CA node Attr _i of which u has attributes, let it be i=1,...,t, Attr _i randomly select t _i ∈ Zp ^* and calculate:

e _i =H ₁ (Attr _i , APK _u,i , UID _u , CPK _i ),

s _i =ASK _u,i +e _i CSK _i ,

_Attri sends Ri to the _RA node through a secure secret channel;

随机生成APK_u，i∈G，计算：(ii) For User _Applicant, the CA node Attr _i for which u does not have attributes may be randomly selected as i=t+1,...,n, Attr _i

Randomly generate APK _{u, i} ∈ G, compute:

e _i =H ₁ (Attr _i , APK _u,i , UID _u , CPK _i ),

Attr _i sends <ci , d _i , APK _{u, i ,} R _i > to the RA node through a secure secret channel;

(iii) The RA node sends R _i , i=1, . . . , n to User _{Applicant, u} , User _{Applicant, u} computes:

(iv) and return to the RA node, the RA node calculates:

c=H ₂ (m, T ₁ , . . . , T _n , UID _u ).

(v) Then use n-t+1 points (0, c), (t+1, c _t+1 ), ..., (n, c _n ) to construct a Lagrangian interpolation polynomial Pn- t(x):

(vi) Send P _nt (x) to User _{Applicant, u} own CA node Attr _i with attributes, i = 1, ..., t. CA calculation:

c _i =P _nt ( _i ), d _i =t _i -ci s _i , i=1, . . . , t.

Attr _i sends < _{ci , d i >} to the RA node through a secure secret channel;

(vii) RA outputs the polynomial P _nt (x) and the signature:

σ=< _{ci , d i ,} T _i , APK _u,i , UID _u >, i=1, 2, ..., n.

(viii) RA appends P _nt (x) and σ to certificate information m, generates certificate M, sends it to User _{Applicant, u} through a secure secret channel, and uses the concatenation of UID _u and timestamp as the key, certificate The content is stored in the certificate store as value, and multiple certificate stores are automatically synchronized and backed up;

(2) zkProveGen(zkParams, w, x, M _L )→π _u .

User _{Applicant, u} executes ZoKrates' generating proof algorithm Prove(zkParams, w, x, M _L ), where among the input parameters, the proof:

e_i＝ H₁(Attr_i，APK_u，i，UID_u，CPK_i)>，

e _i = H ₁ (Attr _i , APK _{u, i} , UID _u , CPK _i )>,

且

User_{Applicant，u}将证明π_u， 命题x与图灵机算法M_L传输上链方便查询。The generated proof π _u takes the form of Fiat-Shamir Heurisitc. Specifically, π _u can prove that User _{Applicant, u} knows that the discrete logarithm S _u satisfies

and

User _{Applicant, u} will prove π _u , proposition x and Turing machine algorithm _ML transmission on the chain to facilitate query.

4. Certificate verification: It may be assumed that there is a User _{Verifier, s} that expects to verify the identity of User Applicant, _u . It expects to verify the identity of User Applicant, _u . User _{Applicant, u} first goes to the RA node to obtain its own certificate, and sends the certificate to User _{Verifier, s} , User _{Verifier, s} verifies the certificate. First, check whether the certificate is issued by a valid DPKI CA node, check whether the certificate of User _{Applicant, u} has been revoked, and check the validity period of the certificate. If the certificate has expired and been revoked , or the certificate is not issued by a legitimate node, the identity authentication fails, otherwise the certificate is signed and authenticated;

Verify(m, σ, P _nt (x), π _u )→True/False.

(i) Verification

If one of the above fails, the signature is invalid.

(ii) After the above verifications are passed, User _{Verifier, s} obtains the proof π _u and ZoKrates related parameters on the blockchain, and executes the ZoKrates verification algorithm Verify(zkParams, x, M _L , π _u ), if the verification fails , the signature is an invalid signature; if the verification passes, the signature is a valid signature.

5. Certificate revocation: User _{Applicant, u} sends a revocation request for a specific certificate M to the RA node.

Revoke(M, π _u , UID _u )→True/False.

RA obtains the proof π _u on the blockchain, and executes ZoKrates' verification algorithm Verify(zkParams, x, M _L , π _u ). If the verification fails, the signature is invalid; if the verification passes, it is sent to n CA nodes. Certificate revocation request, otherwise return an error message. The CA node destroys the generated information about the relevant intermediate parameters, and returns the revoked certificate Cer _i with successful revocation to the RA node. The RA collects n revoked certificates Cer _i to synthesize the revocation certificate and stores it in the CRL, and removes the certificate of User _{Applicant, u} from the certificate store. revoke. Multiple certificate repositories in the blockchain are then automatically synchronized with the CRL.

This method is an infrastructure that provides an API interface, and can send a request to it to perform corresponding operations. Figure 2 is an example of the returned fields for applying for a certificate, including the certificate serial number, signature and other information. Figure 3 is an example of the certificate signature field. It is jointly issued by multiple CAs (100 in this example). Figure 4 is an example of the returned fields of the verification certificate. It will prompt whether the certificate verification is successful or not. Figure 5 is an example of simulating 5000 users to apply/verify certificates concurrently. It can be seen that the present invention The overhead is relatively low and the performance is good.

Claims (3)

1. A distributed public key infrastructure method based on block chains and attribute signatures, the method is based on attribute signature, block chains and zero knowledge proof technology, and the method comprises the following steps: initializing a system, initializing a user, signing and issuing a certificate, verifying the certificate and revoking the certificate; the method comprises the following specific steps:

(1) initializing a system; the system initializes the relevant parameterization of center-removing non-repudiation attribute signature, publicly uploads the parameterization to a block chain, simultaneously initializes zero knowledge to prove the relevant parameters of ZoKrates, publicly links the chain, represents the initialization of an authority CA node of the attribute, randomly generates a private key CSK of the attribute by the CA, calculates a public key CPK by the private key, and publicly links the CPK information;

(2) initializing a user; user initialization, User in addition to information required to register blockchains_{Applicant，u}(user u applying for the certificate) also needs to randomly generate secret value S_uSo that the calculated ID identifies the UID_uThe block chain is globally unique, and the User applies for attributes from a plurality of CA nodes to obtain an attribute private key ASK of the User_u，iAnd public key APK_u，i；

(3) Signing the issued certificate; user desiring to apply for a particular n number of CAs to issue a certificate_{Applicant，u}Having several n attributes, sending a network access request certificate service, User, to a digital certificate registry RA via a blockchain network_{Applicant，u}Submitting various information required by the certificate, confirming the information by RA, rejecting the node request if the information is wrong, otherwise sending the information to n CA, carrying out signature on the certificate by CA in cooperation, collecting signature information by RA to generate a signature, storing the signature in a certificate library of a block chain, and automatically synchronizing the certificate library by the block chain; then User_{Applicant，u}Executing a proof-of-generation algorithm of ZoKrates, generating a non-repudiatable proof of the certificate;

(4) and (4) certificate verification: expected authentication User_{Applicant，u}User of identity_Verifier，s(User s of certificate of authenticity), it is for User_{Applicant，u}Initiating an authentication request, User_{Applicant，u}Firstly, go RA to obtain its own certificate and send the certificate to User_Verifier，s，User_Verifier，sVerifying the certificate; firstly, whether the certificate is legal CA issuance or not is checked, and the User is checked_{Applicant，u}Whether the certificate is revoked, checking the validity period of the certificate and checking whether the certificate is issued by the required n CA nodes; if the certificate is expired, revoked or not signed by a legal node, the identity authentication fails, otherwise, the certificate is authenticated, the authentication comprises signature authentication and zero knowledge proof ZoKrates authentication, and the authentication is successful, namely the User is authenticated_{Applicant，u}The identity of (a);

(5) certificate revocation; certificate revocation is divided into expired revocation and User_ApplicantActive withdrawingPinning, the Certificate Revocation List (CRL) will be periodically updated by RA; user_{Applicant，u}If a request for self certificate revocation is sent to the RA, the RA verifies the zero knowledge proof to validate the User_{Applicant，u}Identity, verification is by adding a certificate to the CRL.

2. The distributed public key infrastructure method based on blockchain and attribute signatures of claim 1, wherein: the method for issuing the certificate by signing in the step (3) comprises the following steps:

no assumption is made that there is a User desiring to apply for a certificate_{Applicant，u}It expects an application attribute set Ω ═ { Attr₁，Attr₂，...，Attr_nCorresponding certificate, User_{Applicant，u}T attributes are possessed; user_{Applicant，u}Can be regarded as a common node in the block chain, which sends a network access request certificate service, User, to the RA node through the block chain network_{Applicant，u}Various information m (including UID) required to submit a certificate_u) And the RA confirms the information, if the information is wrong, the node request is rejected, otherwise, the information is sent to n CA nodes:

(1)Sign(m，Su，UIDu，Ω，{APK_u，i，ASK_u，i}，{CPK_i，CSK_i})→P_n-t(x)，σ.

User_{Applicant，u}has t attributes, when n CA nodes of PKI receive m (including UID)_u) Begin for the certificate message m e {0, 1}^*Carrying out signature;

(i) for User_{Applicant，u}CA node Attr with attribute_iLet it be i ═ 1., t, Attr_iRandomly choosing t_i∈Zp^*And calculating:

e_i＝H₁(Attr_i，APK_u，i，UID_u，CPK_i)，

s_i＝ASK_u，i+e_iCSK_i，

Attr_ir is to be_iSending the information to the RA node through a secure secret channel;

(ii) for User_{Applicant，u}CA node Attr without attribute_iLet it be i ═ t +1_iRandom selection

Random generation of APK_u，iE G, calculating:

e_i＝H₁(Attr_i，APK_u，i，UID_u，CPK_i)，

Attr_iwill be provided with<c_i，d_i，APK_u，i，R_i>Sending the information to the RA node through a secure secret channel;

(iii) RA node combines R with R_iN is sent to User_{Applicant，u}，User_{Applicant，u}And (3) calculating:

(iv) and returning to the RA node, and calculating by the RA node:

c＝H₂(m，T₁，...，T_n，UID_u).

(v) subsequently, n-t +1 points (0, c), (t +1, c) are used_t+1)，...，(n，c_n) Constructing an n-t Lagrange interpolation polynomial Pn-t (x):

(vi) will P_n-t(x) Is sent to a User_{Applicant，u}CA node Attr with attribute_iI 1.., t.ca calculation:

c_i＝P_n-t(i)，d_i＝t_i-C_is_i，i＝1，...，t.

Attr_iwill be provided with<c_i，d_i>Sending the information to the RA node through a secure secret channel;

(vii) RA output polynomial P_n-t(x) And signature:

σ＝<c_i，d_i，T_i，APK_u，i，UID_u>，i＝1，2，...，n.

(viii) RA will P_n-t(x) And sigma is attached to the certificate information M to generate a certificate M, and the certificate M is sent to the User through a secure secret channel_{Applicant，u}And handle UID_uSplicing with the time stamp to be used as a key, storing the certificate content as a value in the certificate libraries, and automatically and synchronously backing up the plurality of certificate libraries;

(2)zkProveGen(zkParams，w，x，M_L)→π_u.

User_{Applicant，u}performing the Prove (zkParams, w, x, M) proof of Generation algorithm for ZoKrates_L) Wherein, in the input parameters, the evidence:

proof of formation_uIn the form of Fiat-Shamir Heuristic, in particular,. pi._uCan prove User_{Applicant，u}Knowing the discrete logarithm S_uSatisfy the requirement of

And is

User_{Applicant，u}Will prove pi_uProposition x and Turing machine algorithm M_LTransmitting the uplink facilitates the query.

3. The distributed public key infrastructure method based on blockchain and attribute signatures of claim 1, wherein: the certificate verification method in the step (4) comprises the following steps:

no assumptions are made about the expected authentication User_{Applicant，u}User of identity_Verifier，sIt expects to authenticate User_{Applicant，u}User_{Applicant，u}Firstly, the RA node obtains its own certificate and sends the certificate to the User_Verifier，s，User_Verifier，sVerifying the certificate, checking whether the certificate is issued by the CA node of the legal DPKI, and checking the User_{Applicant，u}Whether the certificate is revoked or not, checking the validity period of the certificate; if the certificate is expired, revoked or not signed and issued by a legal node, the identity authentication fails, otherwise, the certificate is signed and authenticated;

Verify(m，σ，P_n-t(x)，π_u)→True/False.

(i) authentication

If one fails, the signature is an invalid signature;

(ii) after the above items are verified, the User_Verifier，sObtaining a proof pi on a blockchain_uAnd ZoKrates-related parameters, performing the authentication algorithm Verify (zkParams, x, M) of ZoKrates_L，π_u) If the verification is not passed, the signature is an invalid signature; if the verification is passed, the signature is a valid signature.

Images