# US 11,451,519 B2 · Anonymous credential authentication system and method thereof > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,519 B2 - Document ID: US11451519B2 - Status: Granted - Kind: B2 - Application number: 17/104,695 - Filed: 2020-11-25 - Published: 2021-05-27 - Granted: 2022-09-20 - Earliest claimed: 2019-11-25 - Assignees: Electronics and Telecommunications Research Institute - Applicants: Electronics and Telecommunications Research Institute - Inventors: Jung Yeon Hwang; Seung-Hyun Kim; Sung-Hoon Lee; Soo Hyung Kim; Sangrae Cho; Seok Hyun Kim; Young Seob Cho; Youngsam Kim; Jong-Hyouk Noh; Kwantae Cho; Jin-Man Cho - Web page: https://patentgrep.com/patent/US11451519B2 ## CPC - H04L 9/3255: {using group based signatures, e.g. ring or threshold signatures} - H04L 63/0421: {Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer} - G06F 21/45: Structures or tools for the administration of authentication - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3218: {using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 63/123: {received data contents, e.g. message integrity} - H04L 2209/42: Anonymization, e.g. involving pseudonyms - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An anonymous credential authentication system receives an anonymous credential signature value indicating that setting proposition information using a credential is satisfied from a user device that has been issued the credential combined with multiple pieces of attribute information constituting personal information, generates signer authentication information that confirms a signer of the anonymous credential signature value using an opening key, and outputs the signer authentication information. ## Claims ### Claim 1 A method for authenticating in an anonymous credential authentication system, the method comprising: receiving an anonymous credential signature value indicating that setting proposition information using a credential is satisfied from a user device that has been issued the credential combined with multiple pieces of attribute information constituting personal information; generating and outputting signer authentication information that confirms a signer of the anonymous credential signature value using an opening key; and checking whether two anonymous credential signature values are linked to each other using a linking key when the two anonymous credential signature values generated by the user device are given. ### Claim 2 (depends on 1) The method of claim 1, further comprising verifying the signer authentication information. ### Claim 3 (depends on 1) The method of claim 1, wherein further comprising verifying validity of the anonymous credential signature value. ### Claim 4 (depends on 3) The method of claim 3, wherein the verifying includes: receiving the proposition information, the credential, and the anonymous credential signature value from the user device; classifying the attribute information combined with the credential into hidden attribute information, direct disclosure attribute information, and attribute information related to a setting function; performing basic verification on the anonymous credential signature value; and verifying the classified attribute information, respectively, when the basic verification is successful. ### Claim 5 (depends on 1) The method of claim 1, wherein the generating and outputting includes: receiving the anonymous credential signature value for the proposition information; calculating a signature value of an issuer using the opening key and the anonymous credential signature value; obtaining user registration information from a user registration list using the signature value of an issuer; and generating the signer authentication information by using the user registration information and values included in the anonymous credential signature value. ### Claim 6 (depends on 1) The method of claim 1, further comprising: generating a first public parameter associated with the opening key and a second public parameter associated with the linking key; generating a system public key including the first public parameter and the second public parameter; and issuing the credential in response to the system public key. ### Claim 7 (depends on 6) The method of claim 6, further comprising publishing the system public key. ### Claim 8 (depends on 6) The method of claim 6, wherein the issuing includes: receiving, from the user device, a credential issuance request message including a commitment value for the multiple pieces of attribute information, a zero knowledge proof value for the commitment value, and a user signature value for the commitment value; verifying validity of the zero-knowledge proof value and the user signature value; calculating a signature value of an issuer using random values selected from an integer set representing the multiple pieces of attribute information, the system public key, the issuing key, and the commitment value; and issuing the credential including the random values and the signature value of the issuer to the user device. ### Claim 9 (depends on 8) The method of claim 8, wherein issuing further includes adding user registration information including the credential issued to the user device, the commitment value, the zero-knowledge proof value, and the user signature value to a user registration list. ### Claim 10 A method for authentication of an anonymous credential authentication system in a user device, the method comprising: transmitting, to a credential issuance processor, a credential issuance request message including multiple pieces of attribute information constituting personal information, a commitment value for the multiple pieces of attribute information, a zero knowledge proof value for the commitment value, and a user signature value for the commitment value; getting a credential including a signature value of the credential issuing processor generated by using an issuing key and random values selected from an integer set representing the multiple pieces of attribute information issued from the credential issuing processor; generating an attribute authentication signature key by combining a system public key published by the credential issuing processor, the credential and the multiple pieces of attribute information; presenting an anonymous credential signature value indicating that a proposition information set is satisfied using the credential and the attribute authentication signature key; and receiving a verification result for the anonymous credential signature value, wherein the system public key includes at least one of a first public parameter providing a signer authentication and a second public parameter providing a linking check between two signature values, and wherein the presenting includes: generating a value providing the signer authentication using the first public parameter and the signature value of the credential issuing processor; calculating a proof value that proves each piece of attribute information; and generating a zero-knowledge proof value for qualification requirements among a proposition information. ### Claim 11 (depends on 10) The method of claim 10, wherein the presenting further includes: generating an anonymous credential signature value including at least the proof value, the value providing the signer authentication, the zero-knowledge proof value, and the multiple pieces of attribute information. ### Claim 12 (depends on 10) The method of claim 10, wherein the presenting includes: generating a value providing the linking check by using the second public parameter; calculating a proof value that proves each piece of attribute information; generating a zero-knowledge proof value for qualification requirements among a proposition information; and generating an anonymous credential signature value including at least the proof value, the value providing the linking check, the zero-knowledge proof value, and the multiple pieces of attribute information. ### Claim 13 An anonymous credential authentication system for authenticating a user using an anonymous credential method, the anonymous credential authentication system comprising: a credential issuing processor that issues a credential combined with multiple pieces of attribute information constituting personal information in response to a system public key to the user; an opening processor that generates and outputs signer authentication information for confirming a signer of an anonymous credential signature value when the anonymous credential signature value indicating that setting proposition information set is satisfied using the credential from the user who is issued the credential is received; and a linking processor that checks whether two anonymous credential signature values are linked to each other by using a linking key when the two anonymous credential signature values generated by the user are given. ### Claim 14 (depends on 13) The anonymous credential authentication system of claim 13, further comprising a signature verification processor that classifies the attribute information combined with the credential into hidden attribute information, direct disclosure attribute information, and attribute information related to a setting function, performs basic verification on the anonymous credential signature value, and then verifies validity of the anonymous credential signature value by verifying the classified attribute information, respectively. ### Claim 15 (depends on 13) The anonymous credential authentication system of claim 13, further comprising a signer identification processor that verifies the validity of the signer authentication information according to a verification request of the signer authentication information. ### Claim 16 (depends on 13) The anonymous credential authentication system of claim 13, wherein the system public key includes at least one of a first public parameter providing a signer authentication and a second public parameter providing a linking check between two anonymous credential signature values. ### Claim 17 (depends on 13) The anonymous credential authentication system of claim 13, wherein when a credential issuance request message including a commitment value for the multiple pieces of attribute information, a zero knowledge proof value for the commitment value, and a user signature value for the commitment value is received from the user, the credential issuing processor that calculates a signature value of the credential issuing processor using random values selected from an integer set representing the multiple pieces of attribute information, the system public key, the issuing key, and the commitment value, and generates the credential including the random values and the signature value of the credential issuing processor.