CN118018211A - Trusted distributed digital identity authentication method and system - Google Patents

Trusted distributed digital identity authentication method and system Download PDF

Info

Publication number
CN118018211A
CN118018211A CN202410205969.6A CN202410205969A CN118018211A CN 118018211 A CN118018211 A CN 118018211A CN 202410205969 A CN202410205969 A CN 202410205969A CN 118018211 A CN118018211 A CN 118018211A
Authority
CN
China
Prior art keywords
certificate
credential
service receiver
public
service
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202410205969.6A
Other languages
Chinese (zh)
Inventor
黄海辉
潘桢
徐光侠
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Chongqing University of Post and Telecommunications
Original Assignee
Chongqing University of Post and Telecommunications
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Chongqing University of Post and Telecommunications filed Critical Chongqing University of Post and Telecommunications
Priority to CN202410205969.6A priority Critical patent/CN118018211A/en
Publication of CN118018211A publication Critical patent/CN118018211A/en
Pending legal-status Critical Current

Links

Landscapes

  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

The invention belongs to the technical field of blockchain, and particularly relates to a trusted distributed digital identity authentication method and system. The invention uses the centralized prophetic machine to obtain the data under the chain, and the certificate center carries out signature confirmation to generate the pre-certificate, thereby determining the attribute and the statement of the certificate. A zero knowledge proof is generated for the certificate through RLWE and is recorded and disclosed by the certificate center, so that the service receiver owns the master certificate. The method and the device can limit the abuse of the certificates and lock the certificates by updating/revoking the request management certificates and by disclosing information, thereby realizing effective digital identity authentication and ensuring the safety and the reliability of a digital identity authentication system.

Description

Trusted distributed digital identity authentication method and system
Technical Field
The invention belongs to the technical field of blockchain, and particularly relates to a trusted distributed digital identity authentication method and system.
Background
The de-centralized digital identity (Decentralized DIGITAL IDENTITY, DID) is a digital identity system built based on blockchain technology. Verifiable credentials for DID are an important technology in the current digital identity management arts. The method can ensure that the identity data is true and reliable, and can also protect the privacy related to the identity user, and ensure that the data related to the personal identity belongs to the personal.
The current source of the decentralised digital identity vouchers content is typically the user itself, third party authorities, in-chain historical data. The generation, verification, updating and revocation of the verifiable credentials are generally implemented using digital signatures, zero knowledge certificates, or symmetric and asymmetric encryption techniques.
The acquisition of the verifiable voucher content is derived from the problems that the user is easy to cause low information fidelity, low credibility and data falsification; data from third party institutions easily causes interaction between the chain and different third party institutions to be bloated, efficiency is lacked, and problems of data repetition and data difficult processing are faced; the credential content is derived from historical data on the chain, so that the burden of the blockchain is improved, the expandability is reduced, and the three acquisition modes face the problems of user privacy disclosure and hysteresis of user data. With the development of quantum computing, digital signatures, zero knowledge proof and asymmetric encryption and other cryptographic algorithms used in the current conventional verifiable credential management mechanism all form threats, and a quantum computer can crack a plurality of conventional encryption algorithms in theory, while with the development of technology, the conventional cryptographic algorithms are more threatened, and the possibility of being cracked is more and more increased.
Disclosure of Invention
Based on the problems existing in the prior art, the invention provides a trusted distributed digital identity authentication method and a system, which are used for solving the security problem in the traditional data identity authentication system.
In a first aspect of the present invention, the present invention provides a trusted distributed digital identity authentication method, the method comprising:
the prophetic machine obtains the information under the chain from the service receiver, and send the information under the chain to the credential center;
The certificate center confirms the authenticity of the information under the chain, signs the information under the chain, generates a pre-certificate according to the information under the chain and the information under the chain, and sends the pre-certificate to a service receiver;
the service receiver generates a main certificate related zero knowledge proof required parameter based on ring belt error learning according to the pre-certificate, encrypts the required parameter, generates a ciphertext and sends the ciphertext to a certificate center;
The credential center decrypts the ciphertext, calculates required parameters after verifying the signature, issues a master credential to a service receiver according to the required parameters if the verification is passed, forms a credential list from the master credential, stores a public list formed by the public parameters in a database, and discards the required parameters if the verification is not passed;
The service receiver generates a master certificate related zero knowledge proof according to the issued master certificate, and sends the master certificate related zero knowledge proof to the service provider;
And the service provider verifies the received related zero knowledge proof of the master certificate and the parameters accessed in the database to judge whether the data are consistent, if so, the service provider provides the service for the service receiver, and if not, the service provider refuses to provide the service for the service receiver.
In a second aspect of the present invention, the present invention also provides a trusted distributed digital identity authentication system, the system comprising:
The service receiver is provided with a decentralization identity and is used for storing a pre-credential of the service receiver and generating zero knowledge proof related parameters of a main credential according to the pre-credential;
The pre-prediction machine is used for acquiring the information under the chain of the service receiver;
The certificate center is used for confirming the authenticity of the information under the chain and signing the information under the chain, generating a pre-certificate according to the information under the chain and the signature of the information under the chain, sending the pre-certificate to a service receiver, decrypting the ciphertext, calculating required parameters after verifying the signature, issuing a main certificate to the service receiver according to the required parameters if the verification is passed, and simultaneously storing a certificate list and public parameters formed by the main certificate into a database, and discarding the required parameters if the verification is not passed;
The database is used for storing a certificate list and a public list;
And the service provider is used for verifying whether the pre-credentials of the user are consistent with the corresponding values in the public information list, if so, providing the service, and if not, rejecting the service.
The invention has the beneficial effects that:
Compared with the traditional credential data acquisition mode, the technology of the invention applies a decentralizing predictor, and by acquiring the information under the chain of the service receiver and the signature of the credential center, the authenticity, the effectiveness and the instantaneity of the credential source are ensured, the efficiency of the information interaction between the blockchain and the third party mechanism is improved, and the burden of the blockchain is reduced. In the processes of credential verification, generation, updating and revocation, zero knowledge proof based on a lattice password is adopted, so that privacy security of a user is guaranteed, meanwhile, the lattice password is adopted, quantum resistance of the zero knowledge proof is enhanced, quantum attack can be resisted, even if an attacker knows a public key, the private key cannot be successfully calculated in polynomial time, and the private key cannot be successfully cracked in theory. Meanwhile, due to the existence of the certificate list and the public information, if an attacker tries to pass the verification by using the old certificate after the certificate is updated, the attacker can be marked as a suspicious attacker.
Drawings
FIG. 1 is a schematic diagram of a trusted distributed digital authentication system in accordance with an embodiment of the present invention;
FIG. 2 is a schematic diagram of a trusted distributed digital authentication system in accordance with a preferred embodiment of the present invention;
FIG. 3 is a flow chart of a trusted distributed digital identity authentication method according to an embodiment of the present invention;
fig. 4 is a flow chart of a trusted distributed digital identity authentication method according to a preferred embodiment of the present invention.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
FIG. 1 is a schematic diagram of a trusted distributed digital identity authentication system according to an embodiment of the present invention, as shown in FIG. 1, the system includes a service receiver, a service provider, a predictor, a credential center, and a database; wherein:
The service receiver has an under-chain identity, wherein the under-chain identity is a decentralised identity, and under-chain information is acquired through the under-chain identity application of the service receiver; the predictor is used for acquiring the link information of the service receiver from the link identity of the service receiver; the credential center is used for confirming the authenticity of the information under the chain and signing the information under the chain; generating a pre-credential according to the link information and the link information signature, and sending the pre-credential to a service receiver; the service receiver generates a main certificate related zero knowledge proof required parameter based on ring belt error learning (RLWE) according to the pre-certificate, encrypts the required parameter, generates a ciphertext and sends the ciphertext to a certificate center; the credential center issues a master credential to a service receiver according to the parameters, forms a credential list from the master credential, and stores a public list formed by public parameters into the database; the service provider verifies whether the zero knowledge proof related to the main certificate sent by the service receiver is equal to the public parameters stored in the database, so as to determine whether to provide service for the service receiver, and realize safe digital identity authentication.
FIG. 2 is a schematic diagram of a trusted distributed digital authentication system in accordance with a preferred embodiment of the present invention, as shown in FIG. 2, which still includes a service recipient, a service provider, a propulsor, a credential center, and a database; wherein:
The service receiver has an under-chain identity, wherein the under-chain identity is a decentralised identity, and under-chain information is acquired through the under-chain identity application of the service receiver; the predictor is used for acquiring the link information of the service receiver from the link identity of the service receiver; the credential center is used for confirming the authenticity of the information under the chain and signing the information under the chain; generating a pre-credential according to the link information and the link information signature, and sending the pre-credential to a service receiver; the service receiver generates the parameters required by the zero knowledge proof related to the main certificate based on the ring belt error learning (RLWE) according to the pre-certificate, encrypts the required parameters to generate ciphertext and sends the ciphertext to the certificate center, and the difference from the embodiment is that the parameters required by the zero knowledge proof related to the main certificate based on the ring belt error learning (RLWE) are the required parameters which can be used for updating/cancelling; the credential center issues a master credential to a service receiver according to the parameters, updates a credential list and stores the update of the public list into the database; the service provider verifies whether the zero knowledge proof related to the main certificate sent by the service receiver is equal to the public parameters stored in the database, so as to determine whether to provide service for the service receiver, and realize safe digital identity authentication.
FIG. 3 is a flow chart of a trusted distributed digital identity authentication method according to an embodiment of the present invention, as shown in FIG. 3, the method includes:
101. the prophetic machine obtains the information under the chain from the service receiver, and send the information under the chain to the credential center;
In the embodiment of the invention, the service receiver indicates the identity of the service receiver through the DID identifier, and the predictors can acquire corresponding link-down information from the service receiver, wherein the link-down information comprises a credential attribute name A, a credential declaration value V, an information provider Pd and the like.
In the embodiment of the invention, the predictor is a decentralizing predictor, and the decentralizing predictor can acquire data from a designated under-chain data source, namely, an under-chain identity of a service receiver, verify the acquired under-chain data, and perform subsequent operations such as uplink on the verified and consensus data. Such data may be some sensitive data such as financial data of a bank, tax data of an enterprise, identity data of a government, etc.
102. The certificate center confirms the authenticity of the information under the chain, signs the information under the chain, generates a pre-certificate according to the information under the chain and the information under the chain, and sends the pre-certificate to a service receiver;
In the embodiment of the invention, the credential center signs the information under the chain, the information under the chain and the signature of the information under the chain form a pre-credential, the pre-credential is expressed as PC= { DIDs, A, V, pd and sigma }, the DIDs are the decentralised identities of service receivers s, the decentralised identities are identifiers of a new type, the identifier has global uniqueness, high reliability, analytical property and encryption verifiability, A is a credential attribute name, V is a credential declaration value, pd is a service provider, and the pre-credential can be used for distinguishing different service providers, and sigma is the signature of the information under the chain.
103. The service receiver generates a main certificate related zero knowledge proof required parameter based on ring belt error learning according to the pre-certificate, encrypts the required parameter, generates a ciphertext and sends the ciphertext to a certificate center;
In the embodiment of the invention, the generating the required parameters of the main certificate related zero knowledge proof based on the ring belt error learning by the service receiver according to the pre-certificate, and encrypting the required parameters to generate the ciphertext and sending the ciphertext to the certificate center comprises the following steps:
The service receiver generates a random matrix according to the modulus q, the degree n of the polynomial, the noise parameter alpha conforming to the discrete Gaussian distribution Error distribution e=χ α;
where the modulus q may be a prime number greater than 8.
Generating a knowledge private key S k＝M×Pk +2e according to the random matrix M and the knowledge public key P k;
wherein the knowledge public key is a public key related to zero knowledge proof, and the invention is not particularly limited to this.
Generating a service receiver public key P u＝M×Su +2e according to the random matrix M and the service receiver private key S u;
Generating a credential center public key P c＝M×Sc +2e according to the random matrix M and the credential center private key S c;
Generating verification feature values according to the service receiver private key S u, the knowledge private key S k and the certificate center public key P c
Wherein, superscript T represents the transposition, char is the instruction function, represents:
wherein E 1 represents a first range, E 2 represents a second range, expressed as:
In the present embodiment, by judging Whether the value of (2) is within the first range or the second range, the corresponding verification feature value ω can be determined.
Knowledge verified value is generated through Hash function H 1 and modulo two operation Mod 2 Indication value/>, for updating/revoking feature values
Where H 1 represents a hash function, mod 2 represents a modulo-2 operation, which can be written as:
Generating ciphertext C=E MC(Pu,Pk, K, omega, v, sigma according to the information signature under the chain and the parameters;
Wherein E MC is an encryption function.
104. The credential center decrypts the ciphertext, calculates required parameters after verifying the signature, issues a master credential to a service receiver according to the required parameters if the verification is passed, forms a credential list from the master credential, stores a public list formed by the public parameters in a database, and discards the required parameters if the verification is not passed;
In the embodiment of the invention, the credential center decrypts the ciphertext, and the process of verifying the signature includes calculating a credential disclosure verification value j=h 2 (W) and a request and revocation request verification value if the knowledge verification value W is equal to the knowledge verified value K Issuing a master certificate to a service receiver, forming a certificate list by the master certificate MC= (DIDs, P u,Pk, I, W), forming a public list by public parameters PV u＝(Pu, J, DIDs, and storing the public list into a database; if the knowledge verification value W is not equal to the knowledge verified value K, discarding the knowledge verification value;
Wherein, P k is a public key of knowledge, S c is a private key of a credential center, v is an indication value for updating/revoking a feature value, P u is a public key of a service receiver, DIDs is a decentralised identity of the service receiver S, H 2 is a hash function, and Mod 2 is a modulo two operation.
In the embodiment of the invention, after receiving the ciphertext, the credential center firstly decrypts the ciphertext, verifies the signature sigma, and calculates the corresponding parameter knowledge verification valueAnd knowledge verified valueAnd judging whether to calculate the credential disclosure verification value J and the request and revocation request verification value I by verifying whether the knowledge verification value and the knowledge verified value are equal.
It is understood that the hash function H 1 and the hash function H 2 may be the same type of hash function or may be different types of hash functions, in this embodiment, the hash function H 1 and the hash function H 2 are different types of hash functions, the hash function H 1 may be SHA256, and the hash function H 2 may be RIPEMD160.
105. The service receiver generates a master certificate related zero knowledge proof according to the issued master certificate, and sends the master certificate related zero knowledge proof to the service provider;
In an embodiment of the invention, the service receiver generates a master credential related zero knowledge Proof, denoted Proof MC＝(Pu,H2 (K), from a master credential issued by the credential centre.
Where P u represents the service recipient public key and K represents the knowledge verified value.
106. And the service provider verifies the received related zero knowledge proof of the master certificate and the parameters accessed in the database to judge whether the data are consistent, if so, the service provider provides the service for the service receiver, and if not, the service provider refuses to provide the service for the service receiver.
In the embodiment of the invention, the service provider verifies according to the received master certificate related zero knowledge Proof and the parameters accessed in the database, wherein the service provider acquires the master certificate related zero knowledge Proof MC＝(Pu,H2 (K) in the data receiver, verifies whether H 2 (K) is equal to J based on the public parameter PV u, and if the two proofs are equal, the two proofs pass, and if the two proofs are not equal, the two proofs do not pass.
Wherein K represents a knowledge authenticated value, P u is a service receiver public key, and J represents a credential public authentication value.
FIG. 4 is a flow chart of a trusted distributed digital identity authentication method according to a preferred embodiment of the present invention, as shown in FIG. 4, the method comprises:
201. the prophetic machine obtains the information under the chain from the service receiver, and send the information under the chain to the credential center;
202. The certificate center confirms the authenticity of the information under the chain, signs the information under the chain, generates a pre-certificate according to the information under the chain and the information under the chain, and sends the pre-certificate to a service receiver;
203. the service receiver generates a main certificate related zero knowledge proof required parameter based on ring belt error learning according to the pre-certificate, encrypts the required parameter, generates a ciphertext and sends the ciphertext to a certificate center;
204. the credential center decrypts the ciphertext, calculates required parameters after verifying the signature, issues a master credential to a service receiver according to the required parameters if the verification is passed, forms a credential list from the master credential, stores a public list formed by the public parameters in a database, and discards the required parameters if the verification is not passed;
205. the service receiver generates a master certificate related zero knowledge proof according to the issued master certificate, and sends the master certificate related zero knowledge proof to the service provider;
206. and the service provider verifies the received related zero knowledge proof of the master certificate and the parameters accessed in the database to judge whether the data are consistent, if so, the service provider provides the service for the service receiver, and if not, the service provider refuses to provide the service for the service receiver.
207. The service receiver sends the cipher text of the certificate updating/canceling request and the request parameter, the certificate center decrypts after receiving the cipher text, calculates whether the parameter is the same as the stored related parameter, decides whether to update/cancel, if so, updates the certificate list and changes the corresponding public parameter.
In the embodiment of the invention, a service receiving party sends an update/revocation request to a credential center to generate a new knowledge public key P k 'and a knowledge private key S k′＝M×Pk' +2e;
calculating a verified value of an update request
Calculating new indication value for updating/revoking feature value
If the certificate request is updated, generating a new verification feature value
Knowledge verified value generated by hash function and modulo two operationGenerating ciphertext C u＝EMC(Pu,Pk ', omega', I ', v');
after receiving the update request and the ciphertext, the credential center decrypts the encrypted data, and determines whether to update by verifying whether I' =I is true:
if the two types of the data are equal, the updating is not needed, and if the two types of the data are not equal, the updating is needed;
If updated, calculate New parameter knowledge verification valueA new certificate public verification value J 1＝H2 (W '), the original (DIDs, P u,Pk, I, W) in the certificate list is updated to be (DIDs, P u,Pk′,I1, W'), and the public parameters PV u＝(Pu,J,J1, DIDs are updated; where J represents a credential disclosure verification value, where J may be considered a great name in personal information, and may be used in subsequent processes to find operations that the credential had taken prior to updating.
If the user is to be revoked, the ciphertext C u＝EMC(Pu,Pk 'and I') are sent;
The certificate center receives the update request and the ciphertext and then decrypts the encrypted text, determines whether to cancel or not by verifying whether I' =I is established, if so, the original (DIDs, P u,Pk, I, W) in the certificate list is deleted, and the public parameters PV u＝(Pu, NULL and DIDs are updated, wherein NULL represents that the certificate public verification value is a NULL value.
The invention uses the centralized prophetic machine to obtain the data under the chain, and the certificate center carries out signature confirmation to generate the pre-certificate, thereby determining the attribute and the statement of the certificate. A zero knowledge proof is generated for the certificate through RLWE and is recorded and disclosed by the certificate center, so that the user has the master certificate. The method and the device can limit the abuse of the certificates and lock the certificates by updating/revoking the request management certificates and by disclosing information, thereby realizing effective digital identity authentication and ensuring the safety and the reliability of a digital identity authentication system.
Those of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be implemented by a program to instruct related hardware, the program may be stored in a computer readable storage medium, and the storage medium may include: ROM, RAM, magnetic or optical disks, etc.
Although embodiments of the present invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made therein without departing from the principles and spirit of the invention, the scope of which is defined in the appended claims and their equivalents.

Claims (9)

1. A method of trusted distributed digital identity authentication, the method comprising:
the prophetic machine obtains the information under the chain from the service receiver, and send the information under the chain to the credential center;
The certificate center confirms the authenticity of the information under the chain, signs the information under the chain, generates a pre-certificate according to the information under the chain and the information under the chain, and sends the pre-certificate to a service receiver;
the service receiver generates a main certificate related zero knowledge proof required parameter based on ring belt error learning according to the pre-certificate, encrypts the required parameter, generates a ciphertext and sends the ciphertext to a certificate center;
The credential center decrypts the ciphertext, calculates required parameters after verifying the signature, issues a master credential to a service receiver according to the required parameters if the verification is passed, forms a credential list from the master credential, stores a public list formed by the public parameters in a database, and discards the required parameters if the verification is not passed;
The service receiver generates a master certificate related zero knowledge proof according to the issued master certificate, and sends the master certificate related zero knowledge proof to the service provider;
And the service provider verifies the received related zero knowledge proof of the master certificate and the parameters accessed in the database to judge whether the data are consistent, if so, the service provider provides the service for the service receiver, and if not, the service provider refuses to provide the service for the service receiver.
2. The method of claim 1, wherein the pre-credential is represented as pc= { DIDs, a, V, pd, σ }, DIDs being the de-centralized identity of the service receiver s, a being the credential attribute name, V being the credential declaration value, pd being the service provider, σ being the out-of-chain information signature.
3. The method of claim 1, wherein the service receiver generates parameters required by the zero knowledge proof of the main certificate based on the ring belt error learning according to the pre-certificate, encrypts the parameters required to generate ciphertext and sends the ciphertext to the certificate center, and the method comprises the service receiver generating a random matrix according to a modulus q, a degree n of a polynomial, a noise parameter alpha conforming to the discrete Gaussian distribution, and the likeError distribution e=χ α; generating a knowledge private key S k＝M×Pk +2e according to the random matrix M and the knowledge public key P k; generating a service receiver public key P u＝M×Su +2e according to the random matrix M and the service receiver private key S u; generating a credential center public key P c＝M×Sc +2e according to the random matrix M and the credential center private key S c; generating verification feature values according to the service receiver private key S u, the knowledge private key S k and the certificate center public key P c Knowledge verified value is generated through Hash function H 1 and modulo two operation Mod 2 Indication value/>, for updating/revoking feature valuesAnd generating a ciphertext C=E MC(Pu,Pk,K,ω,ν,σ),EMC as an encryption function and char as an indication function according to the information signature under the chain and the parameters.
4. The method of claim 1, wherein the step of verifying the signature by decrypting the ciphertext by the credential center includes calculating a credential disclosure verification value j=h 2 (W) and a request and revocation request verification value if the knowledge verification value W is equal to the knowledge verified value KIssuing a master certificate to a service receiver, forming a certificate list by the master certificate MC= (DIDs, P u,Pk, I, W), forming a public list by public parameters PV u＝(Pu, J, DIDs, and storing the public list into a database; if the knowledge verification value W is not equal to the knowledge verified value K, discarding the knowledge verification value; wherein, P k is a public key of knowledge, S c is a private key of a credential center, v is an indication value for updating/revoking a feature value, P u is a public key of a service receiver, DIDs is a decentralised identity of the service receiver S, H 2 is a hash function, and Mod 2 is a modulo two operation.
5. The method of claim 1, wherein the service provider verifying the received primary credential related zero knowledge Proof against the parameters accessed in the database comprises the service provider obtaining the primary credential related zero knowledge Proof of MC＝(Pu,H2 (K) in the data receiver, verifying whether H 2 (K) is equal to J based on the public parameter PV u, if equal, the credentials pass, and if unequal, the credentials do not pass, wherein H 2 is a hash function, K represents a knowledge verified value, P u is a service receiver public key, and J represents a credential public verification value.
6. The method of claim 1, further comprising the steps of sending a ciphertext of the credential update/revocation request and the request parameter by the service receiver, decrypting the ciphertext after the credential center receives the ciphertext, calculating whether the parameter is the same as the stored related parameter, determining whether to update/revoke, and if so, updating the credential list and changing the corresponding public parameter.
7. The method of claim 6, wherein the service receiver sends an update/revocation request to the credential center, generates a new public knowledge key P k ', a private knowledge key S k′＝M×Pk' +2e, and calculates the verified value of the update requestCalculating new indication value for updating/revoking feature valueIf the certificate request is updated, a new verification feature value/> isgeneratedKnowledge verified value/>, generated by a hash function and a modulo two operationGenerating ciphertext C u＝EMC(Pu,Pk ', omega ', I ', v '), decrypting after the credential center receives the update request and the ciphertext, determining whether to update by verifying whether I ' =I is true, and if so, calculating/>New parameter knowledge verification valueA new certificate public verification value J 1＝H2 (W '), the original (DIDs, P u,Pk, I, W) in the certificate list is updated to be (DIDs, P u,Pk′,I1, W'), and the public parameters PV u＝(Pu,J,J1, DIDs are updated; if the revocation request user sends ciphertext C u＝EMC(Pu,Pk ', I '), the credential center decrypts after receiving the update request and the ciphertext, determines whether to revoke by verifying whether I ' =i is true, if so, deletes the original (DIDs, P u,Pk, I, W) in the credential list, and updates the public parameters PV u＝(Pu, NULL, DIDs.
8. A trusted distributed digital identity authentication system, the system comprising:
The service receiver is provided with a decentralization identity and is used for storing a pre-credential of the service receiver and generating zero knowledge proof related parameters of a main credential according to the pre-credential;
The pre-prediction machine is used for acquiring the information under the chain of the service receiver;
The certificate center is used for confirming the authenticity of the information under the chain and signing the information under the chain, generating a pre-certificate according to the information under the chain and the signature of the information under the chain, sending the pre-certificate to a service receiver, decrypting the ciphertext, calculating required parameters after verifying the signature, issuing a main certificate to the service receiver according to the required parameters if the verification is passed, and simultaneously storing a certificate list and public parameters formed by the main certificate into a database, and discarding the required parameters if the verification is not passed;
The database is used for storing a certificate list and a public list;
And the service provider is used for verifying whether the pre-credentials of the user are consistent with the corresponding values in the public information list, if so, providing the service, and if not, rejecting the service.
9. The system of claim 8, wherein the service receiver is further configured to send a ciphertext of the credential update/revocation request and the request parameter, decrypt the ciphertext after the credential center receives the ciphertext, calculate whether the parameter is the same as the stored related parameter, determine whether to update/revoke, and update the credential list and change the corresponding public parameter if so.
CN202410205969.6A 2024-02-26 2024-02-26 Trusted distributed digital identity authentication method and system Pending CN118018211A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202410205969.6A CN118018211A (en) 2024-02-26 2024-02-26 Trusted distributed digital identity authentication method and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202410205969.6A CN118018211A (en) 2024-02-26 2024-02-26 Trusted distributed digital identity authentication method and system

Publications (1)

Publication Number Publication Date
CN118018211A true CN118018211A (en) 2024-05-10

Family

ID=90950081

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202410205969.6A Pending CN118018211A (en) 2024-02-26 2024-02-26 Trusted distributed digital identity authentication method and system

Country Status (1)

Country Link
CN (1) CN118018211A (en)

Similar Documents

Publication Publication Date Title
CN107196966B (en) Identity authentication method and system based on block chain multi-party trust
US11212094B2 (en) Joint blind key escrow
WO2021042685A1 (en) Transaction method, device, and system employing blockchain
JP5001299B2 (en) Authentication and distributed system and method for replacing cryptographic keys
JP3560439B2 (en) Device for performing encryption key recovery
US8667269B2 (en) Efficient, secure, cloud-based identity services
JP2021500832A5 (en)
EP2595340A2 (en) Cryptographic document processing in a network
CN111814191A (en) Block chain private data protection method, device and system
CN109525583B (en) False certificate detection method and system for third-party identity management providing service system
WO2008020991A2 (en) Notarized federated identity management
Shankar et al. Improved Multisignature Scheme for Authenticity of Digital Document in Digital Forensics Using Edward‐Curve Digital Signature Algorithm
CN111245611B (en) Anti-quantum computation identity authentication method and system based on secret sharing and wearable equipment
ul Haq et al. An efficient authenticated key agreement scheme for consumer USB MSDs resilient to unauthorized file decryption
Li et al. A Privacy‐Preserving Authentication Scheme for VANETs with Exculpability
Rasmussen et al. Weak and strong deniable authenticated encryption: on their relationship and applications
CN118018211A (en) Trusted distributed digital identity authentication method and system
Yap et al. On the security of a lightweight authentication and encryption scheme for mobile ad hoc network
Chaudhari et al. Towards lightweight provable data possession for cloud storage using indistinguishability obfuscation
CN110855444A (en) Pure software CAVA identity authentication method based on trusted third party
Ibrahim et al. A new authentication protocol for an Authentication-as-a-Service (AaaS) cloud using Pedersen commitment scheme
CN110572257A (en) Anti-quantum computing data source identification method and system based on identity
Abbdal et al. An Efficient Public Verifiability and Data Integrity Using Multiple TPAs in Cloud Data Storage
Yu et al. Blockchain-based cryptographic model for electronic evidence authentication
CN114978549B (en) SM2 digital signature generation method and system for signer to control signature making data

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination