Search

CN-121998762-A - Pairing in a blockchain system method for authenticating identity of account

CN121998762ACN 121998762 ACN121998762 ACN 121998762ACN-121998762-A

Abstract

A method for authenticating an account in a blockchain system includes obtaining a first transaction including a zero-knowledge proof and a first hash, wherein a public input of the zero-knowledge proof includes a first account address, a public key subset of an authentication item and a first signature, the zero-knowledge proof is used for proving that the first hash is calculated based on first secret data input by the first user, the first signature is an aggregate signature of sub-signatures corresponding to the public key subset of the authentication item, each sub-signature is generated by signing a first credential of the first user by an identity authentication mechanism, and the public key of the authentication item corresponds to the identity authentication item. Under the condition that the zero knowledge proof passes verification and the first hash is the same as the second hash stored in the blockchain system, verifying the first signature, wherein the second hash is uploaded by an identity authentication mechanism and is the root hash of the authentication merck tree; in the case of verification passing, an identity authentication item for which the first account address has passed is determined from the authentication item public key subset.

Inventors

  • LV HONG

Assignees

  • 蚂蚁区块链科技(上海)有限公司

Dates

Publication Date
20260508
Application Date
20251230

Claims (12)

  1. 1. A method of authenticating an account in a blockchain system, performed by a node of the blockchain system, comprising: The method comprises the steps that a first transaction is obtained, the first transaction calls a verification contract and comprises first proving data, the first proving data at least comprise zero-knowledge proof and first root hash, the zero-knowledge proof is used for proving that the first root hash is obtained by calculation based on first secret data input by a first user, public input of the zero-knowledge proof comprises a first account address, an authentication item public key subset and a first signature, the first signature is an aggregate signature of sub-signatures corresponding to public keys of all authentication items in the authentication item public key subset, all the sub-signatures are generated by signing a first certificate corresponding to the first user by an identity authentication mechanism, and the authentication item public key corresponds to an identity authentication item of the identity authentication mechanism; The authentication contract is invoked based on a first transaction to authenticate the zero-knowledge proof based on a first hash, to determine if the first hash is identical to a second hash stored in the blockchain system if the zero-knowledge proof is authenticated, the second hash being uploaded by the identity authentication mechanism and being a root hash of an authentication merck tree constructed by the identity authentication mechanism based on hash values of secret data of a plurality of authenticated users, to authenticate a first signature based on the subset of authentication public keys if the first hash is identical to the second hash, and to determine an identity authentication item for which a first account address has passed based on the subset of authentication public keys if the first signature is authenticated.
  2. 2. The method of claim 1, wherein the method further comprises: And under the condition that the passed identity authentication item meets the preset authentication constraint, recording the identity authentication state corresponding to the first account address as a state passing identity authentication in the contract state of the verification contract.
  3. 3. The method of claim 1, wherein the first credential comprises a first root hash and a hash value of the first secret data.
  4. 4. The method of claim 1, wherein the subset of public keys of the authentication item is selected by the first user from a set of public keys of the authentication item received from the identity authentication authority, including the public keys of the authentication item to which the first user has passed at the identity authentication authority.
  5. 5. The method of claim 1, wherein determining, from the subset of authentication item public keys, an identity authentication item that the first account address has passed comprises: Acquiring a first mapping set which belongs to the identity authentication mechanism and is stored in a contract state of the authentication contract by executing the authentication contract called by the authentication contract, wherein the first mapping set comprises a plurality of first mappings, and any first mapping is used for representing the corresponding relation between an identity authentication item and an authentication item public key; And determining the identity authentication item which passes the first account address according to the first mapping set and the authentication item public key subset.
  6. 6. The method of claim 1, wherein verifying the first signature based on the authentication item public key subset comprises: based on the subset of authentication item public keys and the first credential, the first signature is verified to determine whether the first user possesses a sub-signature generated by the identity authentication authority and corresponding to each authentication item public key in the subset of authentication item public keys.
  7. 7. The method of claim 1, wherein the zero-knowledge proof is generated by a first user via a zero-knowledge proof circuit based on first secret data, the validation contract comprising a validation algorithm corresponding to the zero-knowledge proof circuit.
  8. 8. The method of claim 1, wherein the method further comprises: Receiving a transfer transaction, the transfer transaction including transfer information for indicating to transfer from or to a first account address a first amount of financial assets, the financial assets being issued by a smart contract, the transfer transaction invoking the validation contract; and calling the verification contract through executing the transfer transaction, determining whether the account of the party in the transfer transaction passes identity authentication, and executing transfer according to the transfer information under the condition that a first condition is met, wherein the first condition is one of the transfer transaction that the transfer account passes identity authentication and the transfer transaction that the transfer account and the transfer account pass identity authentication.
  9. 9. The method of claim 8, wherein determining whether the party account to the transfer transaction is authenticated by executing the transfer transaction to invoke the validation contract further comprises: Freezing a first asset of the transfer account of the transfer transaction if the first condition is not satisfied; And invoking the verification contract by executing a second transaction, thawing the first asset and performing transfer according to the transfer information if the first condition is satisfied within the first period of time, and thawing the first asset if not.
  10. 10. A method of authenticating an account in a blockchain system, performed by an identity authentication authority, comprising: Receiving a secret hash corresponding to the secret data sent by the first user and authentication data; based on the authentication data, executing identity authentication on a first user, and adding the secret hash to an authentication merck tree when the identity authentication passes, wherein the identity authentication comprises a plurality of identity authentication items; Updating the authentication merck tree to obtain a root hash corresponding to a root node of the authentication merck tree, and proving the root Ha Xicun to the blockchain system; for any passed first identity authentication item, signing a first certificate corresponding to the first user by using a corresponding authentication item private key to generate a sub signature corresponding to the first identity authentication item; and sending the sub-signatures corresponding to the passed identity authentication items and the merck paths corresponding to the secret hashes in the authentication merck tree to the first user.
  11. 11. A method of authenticating an account in a blockchain system, performed by a user device of a first user, the method comprising: Inputting first data provided by a first user into a first circuit, wherein the first circuit is constructed based on a zero knowledge proof framework, the first data at least comprises a first merck path and first secret data which are input as privacy, a first account address, an authentication item public key subset and a first signature which are input as public, wherein the first signature is an aggregate signature of sub-signatures corresponding to all authentication item public keys in the authentication item public key subset, each sub-signature is generated by signing a first certificate corresponding to the first user by an identity authentication mechanism, and the authentication item public key corresponds to an identity authentication item of the identity authentication mechanism; The method comprises the following steps of carrying out hash calculation on first secret data to obtain a secret hash, taking the secret hash as a leaf node, and calculating to obtain a first root hash based on a first merck path; The method comprises the steps of sending a first transaction to a blockchain system, wherein the first transaction calls a verification contract and comprises first proof data, the first proof data at least comprise zero knowledge proof and a first root hash, the verification contract is used for verifying the zero knowledge proof, determining whether the first root hash is identical to a second root hash stored in the blockchain system under the condition that the zero knowledge proof verification is passed, the second root hash is uploaded by an identity authentication mechanism and is a root hash of an authentication merck tree, the authentication merck tree is constructed by the identity authentication mechanism based on hash values of secret data of a plurality of users passing identity authentication, and verifying a first signature based on a public key subset of an authentication item under the condition that the first root hash is identical to the second root hash.
  12. 12. A computing device comprising a memory and a processor, the memory having stored therein a computer program which, when executed by the processor, implements the method of any of claims 1-11.

Description

Pairing in a blockchain system method for authenticating identity of account Technical Field One or more embodiments of the present disclosure relate to the field of blockchain technology, and more particularly, to a method for authenticating an account in a blockchain system. Background Blockchain (Blockchain) is a novel application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanisms, encryption algorithms, and the like. In the block chain system, the data blocks are combined into a chain data structure in a sequential connection mode according to the time sequence, and the distributed account book which is not tamperable and counterfeit and is ensured in a cryptographic mode is formed. Because the blockchain has the characteristics of decentralization, non-tamperability of information, autonomy and the like, the blockchain is also receiving more and more attention and application. For example, in one blockchain technology practice, the decentralised finance (Decentralized Finance, deFi) enables users to exchange and circulate various financial assets through blockchain accounts, greatly improving the efficiency and transparency of financial transactions. However, with the increasing perfection of blockchain infrastructure, the maturation and popularity of smart contract technology, the development of decentralised finances is accompanied by a high speed, and the transfer of financial assets across blockchains is facing increasingly severe compliance challenges. Financial regulatory authorities typically require that various types of financial activities adhere to relevant regulations, such as back-flushing money (Anti-Money Laundering, AML), subsidizing terrorist financing (Combating THE FINANCING of Terrorism, CFT), etc., with the central appeal of requiring a financial service provider to authenticate (Know Your Customer, KYC) the identity of the account principal involved in the financial activity. In addition to the DeFi scenario exemplified above, there is also a need for identity authentication of accounts in a blockchain system in other practical scenarios of blockchains. Therefore, it is desirable to have a technical solution that can complete identity authentication for an account in a blockchain system while maintaining the characteristics of decentralization and transparency of the blockchain and without revealing any privacy information of the user, and can disclose the identity authentication item information passed by the user. Disclosure of Invention A first aspect of the present specification provides a method of authenticating an account in a blockchain system, performed by a node of the blockchain system, comprising: The method comprises the steps of obtaining a first transaction, calling a verification contract by the first transaction, and comprising first proving data, wherein the first proving data at least comprises zero-knowledge proof and first root hash, the zero-knowledge proof is used for proving that the first root hash is obtained by calculation based on first secret data input by a first user, public input of the zero-knowledge proof comprises a first account address, a public key subset of authentication and a first signature, the first signature is an aggregate signature of sub-signatures corresponding to public keys of all authentication items in the public key subset of the authentication items, each sub-signature is generated by signing a first certificate corresponding to the first user by an identity authentication mechanism, and the public key of the authentication item corresponds to an identity authentication item of the identity authentication mechanism. The authentication contract is invoked based on a first transaction to authenticate the zero-knowledge proof based on a first hash, to determine if the first hash is identical to a second hash stored in the blockchain system if the zero-knowledge proof is authenticated, the second hash being uploaded by the identity authentication mechanism and being a root hash of an authentication merck tree constructed by the identity authentication mechanism based on hash values of secret data of a plurality of authenticated users, to authenticate a first signature based on the subset of authentication public keys if the first hash is identical to the second hash, and to determine an identity authentication item for which a first account address has passed based on the subset of authentication public keys if the first signature is authenticated. A second aspect of the present specification provides a method of authenticating an account in a blockchain system, performed by an identity authentication authority, comprising: And receiving the secret hash corresponding to the secret data sent by the first user and the authentication data. Based on the authentication data, identity authentication is performed on the first user, and when the identity authentication passes,