Method and system for anonymous identification of a user

1. A method of anonymously identifying a user as a member of a group of users, the method being performed in a computing system comprising at least one computing device of a trusted party and a plurality of computing devices of users, wherein the method comprises:

(1) a preliminary stage ( 300 ) including steps performed in the computing device of the trusted party, the steps comprising:

(1a): for each j-th user from n users of the group, 1≤j≤n, computing ( 320 ) a unique private identifier x j for the j-th user, wherein x j does not enable to restore therefrom any personal information of the j-th user, and wherein each of the computed private identifiers has the same number of digits λ;

(1b): for each i-th user from n users of the group, 1≤i≤n ,

computing ( 330 ) a personal secret for the i-th user as P i =[β{circumflex over (Γ)} i (mod m)]G 1 , where {circumflex over (Γ)} i =x i −1 Γ(mod m), Γ=Π i=1 n x i (mod m), β is a common secret available only to the trusted party, G 1 is a generator of a subgroup G 1 of a prime order m of an additive group of points E( p ) on an elliptic curve E/ p over a finite field p , p<3 is an odd prime, [·] denotes scalar product; and

sending ( 340 ), to a computing device of the i-th user, the private identifier x i of the i-th user and the personal secret P i of the i-th user; and

(1c): computing ( 350 ) a public group key for the group as {tilde over (g)}=e m (βΓ(mod m)]G 1 , G 1 ) where e m (·,·) is symmetric pairing which represents mapping 1 × 1 3 , wherein G 3 is a subgroup of the prime order m in of a multiplicative group of an extended finite field p k * with a generator g with an embedding degree k<1,

wherein P , m, G 1 , G 3 , e m (·,·) are preset in the computing device of the trusted party and are publicly known, β is preset in the computing device of the trusted party, wherein β∈ R (0, m−1], 2 λ− <m<2 λ , where n<m; and

(2) an identification session ( 400 ) including steps comprising:

(2a): in a computing device of a user to be identified, computing ( 403 ) a witness as P1=[v]P, where P is a personal secret of the user to be identified, v is a first random number selected ( 401 ) in the computing device of the user to be identified, the first random number being usable only once for each identification session, v ∈ R (0, m−1], and sending ( 404 ), from the computing device of the user to be identified to the computing device of a verifying party, a first message containing the computed witness;

(2b): in the computing device of the verifying party, computing ( 406 ) a query as P2=[ϕ]G 1 , where ϕ is a second random number selected ( 405 ) in the computing device of the verifying party, the second random number being usable only once for each identification session, ϕ∈ R (0, m−1], and sending ( 407 ), from the computing device of the verifying party to the computing device of the user to be identified, a second message containing the computed query;

(2c): in the computing device of the user to be identified, computing ( 409 ) a response as g 1 =e m ([v+z (mod m)]P, P2), where z is a private identifier of the user to be identified, and sending ( 410 ), from the computing device of the user to be identified to the computing device of the verifying party, a third message containing the computed response,

(2d): in the computing device of the verifying party, verifying ( 412 ) the response g 1 for equality to a verification factor computed as {tilde over (g)} ϕ g 2 , where g 2 =e m (P1, P2), and identifying the user to be identified as a member of the group only if the response is equal to the computed verification factor.

2. The method according to claim 1 , wherein

step (1a) of the preliminary stage ( 300 ) further comprises, prior to the computing ( 320 ): for each j-th user from n users of the group, 1≤j≤n , assigning ( 310 ) to the -th user a registration identifier a j , where a i is a sequence of symbols; and

the unique private identifier x j for the j-th user is computed ( 320 ) based on a j , without possibility to restore a j from x i .

3. The method according to claim 2 , wherein the private identifier x i for the i-th user, 1≤i≤n , is computed as x i =h(a i ∥h i (β)) where h(·) is a λ-bit first cryptographic hash function, h i (·) denotes i-time iterative application of h(·), ·∥· denotes concatenation.

4. The method according to claim 1 , wherein, prior to computing the witness, step (2a) of the identification session (2) comprises: verifying ( 402 ) whether a condition ([v]P≠∞) ∧ ([v+z (mod m)]P≠∞) is met with respect to the selected v, and, if said condition is not met, selecting a new v.

5. The method according to claim 1 , wherein, prior to computing the response g 1 , step (2c) of the identification session (2) comprises: verifying ( 408 ) that P2≠∞, wherein if P2=∞, the identification session (2) is terminated.

6. The method according to claim 1 , wherein

computing the public group key for the group includes steps comprising:

creating ( 351 ) a public group key certificate including information about the trusted party, the public group key, and a digital signature (DS) of the public group key certificate;

placing ( 352 ) the public group key certificate into a public data storage;

prior to verifying the response for equality to the verification factor, the method further includes steps performed in the computing device of the verifying party, said steps comprising: reading ( 411 ) the public group key certificate from the public data storage, and verifying the DS of said certificate, wherein said verification of the response g 1 is performed only if the DS of the public group key certificate is successfully verified.

7. The method according to claim 6 , wherein

the DS of the public group key certificate is computed as ⇐ sign( ({tilde over (g)}∥ T ), where Sign(·,·) is a function of generating the DS, is a secret key of the trusted party, T is the information about the trusted party, (·) is a second cryptographic hash function;

the DS of the public group key certificate is verified with ⇐ Verify( ({tilde over (g)}| T ), , , where Verify(·,·,·) is a function of verifying the DS, wherein a value of is True if the DS is valid, and False otherwise, is a public key of the trusted party, said public key being paired to , wherein said verification of the response g 1 is performed if ( =True) ∧ (P1≠∞.

8. The method according to claim 1 , wherein, when at least one new user is added to the group, step (1a) of the preliminary stage (1) is further performed with respect to said at least one new user, and steps (1b) to (1c) of the preliminary stage (1) are newly performed with respect to the entire group of users whereto the at least one new user has been added.

9. The method according to claim 1 , wherein, upon each exclusion of at least one user from the group of users, the preliminary stage (1) further comprises a step performed in the computing device of the trusted party, said step comprising: selecting a new common secret β′ such that β′ is not equal to a previously used common secret, wherein steps (1b) to (1c) of the preliminary stage (1) are newly performed with respect to the entire group of users from which said at least one user has been excluded.

10. A computing system ( 200 ) configured for anonymously identifying a user as a member of a group of users, the computing system comprising, at least, a computing device ( 201 ) of a trusted party and a plurality of computing devices ( 202 ) of users,

the computing device of the trusted party and the computing devices of the users each comprising, at least:

one or more processors;

communication means; and

one or more data storage devices having computer-executable instructions stored therein for execution by the one or more processors,

wherein the computing device ( 201 ) of the trusted party, when executing the instructions by the one or more processors of the computing device of the trusted party, is configured to perform a preliminary stage ( 1 ) comprising the following operations:

(1a): for each j-th user from n users of the group, 1≤j≤n, for each j-th user from n users of the group, 1≤j≤n, computing a unique private identifier x j for the j-th user, wherein x j does not enable to restore therefrom any personal information of the j-th user, and wherein each of the computed private identifiers has the same number of digits λ;

(1b): for each i-th user from n users of the group, 1≤i≤n ,

computing a personal secret for the i-th user as P i =[β{circumflex over (Γ)} i (mod m)]G 1 , where {circumflex over (Γ)} i =x i −1 Γ(mod m), Γ=Π i=1 n x i (mod m), β is a common secret available only to the trusted party, G 1 is a generator of a subgroup G 1 of a prime order m of an additive group of points E( ) on an elliptic curve E/ p over a finite field p , p>3 is an odd prime, [·] denotes scalar product; and

sending, to a computing device of the i-th user, the private identifier x i of the i-th user and the personal secret P i of the i-th user; and

(1c): computing a public group key for the group as {tilde over (g)}=e m ([βΓ(mod m)]G 1 , G 1 ) where e m (·,·) is symmetric pairing which represents mapping 1 × 1 3 wherein 3 is a subgroup of the prime order m of a multiplicative group of an extended finite field p k * with a generator g with an embedding degree k>1,

wherein P, m, G 1 , G 3 , e m (·,·) are preset in the computing device of the trusted party and are publicly known, β is preset in the computing device of the trusted party, wherein β∈ R (0,m−1], 2 λ−1 <m<2 λ , where n<m; and

wherein a computing device ( 202 -N) of a verifying party, when executing the instructions by the one or more processors of the computing device of the verifying party, and a computing device ( 202 - 1 ) of a user to be identified, when executing the instructions by the one or more processors of the computing device of the user to be identified, are configured to perform an identification session (2) comprising the following operations:

(2a): in the computing device ( 202 - 1 ) of the user to be identified, computing a witness as P1=[v]P, where P is a personal secret of the user to be identified, v is a first random number selected in the computing device ( 202 - 1 ) of the user to be identified, the first random number being usable only once for each identification session, v ∈ R (0, m−1], and sending, from the computing device ( 202 - 1 ) of the user to be identified to the computing device ( 202 -N) of the verifying party, a first message containing the computed witness;

(2b): in the computing device ( 202 -N) of the verifying party, computing a query as P2=[ϕ]G 1 , where ϕ is a second random number selected in the computing device ( 202 -N) of the verifying party, the second random number being usable only once for each identification session, ϕ∈ R (0, m−1], and sending, from the computing device ( 202 -N) of the verifying party to the computing device ( 202 - 1 ) of the user to be identified, a second message containing the computed query;

(2c): in the computing device ( 202 - 1 ) of the user to be identified, computing a response as g 1 =e m ([v+z (mod m)]P, P2), where z is a private identifier of the user to be identified, and sending, from the computing device ( 202 - 1 ) of the user to be identified to the computing device ( 202 -N) of the verifying party, a third message containing the computed response,

(2d): in the computing device ( 202 -N) of the verifying party, verifying the response g 1 for equality to a verification factor computed as {tilde over (g)} ϕ g 2 , where g 2 =e m (P1, P2) and identifying the user to be identified as a member of the group only if the response is equal to the computed verification factor.

11. The computing system according to claim 10 , wherein

operation (1a) of the preliminary stage (1) further comprises, prior to the computing: for each j-th user from n users of the group, 1≤j≤n, assigning to the j-th user a registration identifier a j , where a j is a sequence of symbols; and

the unique private identifier x j for the j-th user is computed based on a j , without possibility to restore a j from x i .

12. The computing system according to claim 11 , wherein the private identifier x i for the i-th user, 1≤i≤n, is computed as x i =h(a i ∥h i (β)), where h(·) is a λ-bit first cryptographic hash function, h i (·) denotes i-time iterative application of h(·), ·∥· denotes concatenation.

13. The computing system according to claim 10 , wherein, prior to computing the witness, operations (2a) of the identification session (2) comprise: verifying whether a condition ([v]P≠∞) ∧ ([v+z (mod m)]P≠∞) is met with respect to the selected v, and, if said condition is not met, selecting a new v.

14. The computing system according to claim 10 , wherein, prior to computing the response g 1 , operation (2c) of the identification session (2) comprises: verifying that P2≠∞, wherein if P2=∞, the identification session (2) is terminated.

15. The computing system according to claim 10 , wherein

computing the public group key for the group further comprises:

creating a public group key certificate including information about the trusted party, the public group key, and a digital signature (DS) of the public group key certificate;

placing the public group key certificate into a public data storage;

prior to verifying the response g 1 for equality to the verification index, the following operations are further performed in the computing device of the verifying party:

reading the public group key certificate from the public data storage, and

verifying the DS of said certificate,

wherein said verification of the response g 1 is performed only if the DS of the public group key certificate is successfully verified.

16. The computing system according to claim 15 , wherein

the DS of the public group key certificate is computed as ⇐ Sign( ({tilde over (g)}∥ T ), ), where Sign(·,·) is a function of generating the DS, is a secret key of the trusted party, T is the information about the trusted party, (·) is a second cryptographic hash function;

the DS of the public group key certificate is verified with ⇐ Verify( ({tilde over (g)}∥ T ) , ), where Verify(·,·,·) is a function of verifying the DS, wherein a value of is True if the DS is valid, and False otherwise, is a public key of the trusted party, said public key being paired to , wherein said verification of the response g 1 is performed if ( =True) ∧ (P1≠∞).

17. The computing system according to any of claims 10 to 12 claim 10 , wherein, when at least one new user is added to the group, operation (1a) of the preliminary stage (1) is further performed with respect to said at least one new user, and operations (1b) to (1c) of the preliminary stage (1) are newly performed with respect to the entire group of users whereto the at least one new user has been added.

18. The computing system according to claim 10 , wherein, upon each exclusion of at least one user from the group of users, the preliminary stage (1) further comprises an operation performed in the computing device of the trusted party, said operation comprising: selecting a new common secret β′ such that β′ is not equal to a previously used common secret, wherein operations (1b) to (1c) of the preliminary stage (1) are newly performed with respect to the entire group of users from which said at least one user has been excluded.