Abstract: There has been no efficient anonymous subscription system which supports customers to purchase some service for a number of times decided by themselves. Previous systems fail to balance both the resistance of misusing anonymity and the protection of customers’ privacy. Moreover, systems in the literature are all built on standard sigma-protocols, which implies that those systems can only preserve the weak property of HVZK（Honest Verifier Zero-Knowledge） in the random oracle model. To combat the above difficulties, a revised system is proposed, which is constructed by applying the recent rechargeable electronic wallet to the Au-Susilo-Yiu non-interactive k-times anonymous authentication. The underlying sigma-protocols are strengthened to black-box zero-knowledge arguments by borrowing the technique of Zhao et al. The proposed system fulfills several properties simultaneously, i.e., unlimited subscription, service type, non-transferable subscription and reusable tokens. In particular, it is proved secure in the standard model.

Key words: privacy protection, anonymous subscription, rechargeable electronic wallet, sigma-protocols, black-box zero-knowledge, conditional anonymity, standard model

摘要： 尚未提出支持顾客根据所需订购次数付费的高效匿名订购系统，已有系统未能实现防止匿名性滥用与确保顾客隐私间的平衡。已有系统都是基于标准的sigma协议构造的，因此仅能在随机预言模型下满足较弱的诚实验证者的零知识性。提出一个改进的系统，利用最新的可充值电子钱包技术对Au-Susilo-Yiu非交互的k次匿名认证方案进行扩展，利用Zhao等人的技术将底层的sigma协议增强为黑盒零知识的知识论证协议。新系统不仅同时实现了订购次数不受限制、支持服务类型、订购服务不可共享以及令牌可重用的性质，而且在标准模型下满足可证安全。

关键词: 隐私保护, 匿名订购, 可充值的电子钱包, sigma协议, 黑盒零知识, 有条件的匿名性, 标准模型