A lattice-based digital signature method and system for power data value-added services

Abstract

The application discloses a lattice-based digital signature method and system for power data value-added services, and first, a first terminal generates a signature private key and a signature verification public key, wherein the first terminal is a power gateway in a region where a user is located; then, the first terminal generates a legal signature by using a HashTree and a rejection sampling method in an interaction process with a second terminal, and generates a related path by using BuildAuth; the second terminal is a power consumption user; finally, a third terminal calculates a target commitment value by using the signature, restores a root node of a commitment tree by executing RootCale, and verifies the legality of the root node; the third terminal is a power enterprise service system center. The application has good compatibility with the power enterprise service system, and not only enables the power enterprise service system to have the ability to resist quantum computer attacks, but also can improve the operation efficiency of the whole service system. This enables the power enterprise to timely formulate flexible and economically applicable electricity price packages according to the electricity consumption information of the user.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of information security, and relates to a lattice-based digital signature method and system, in particular to an efficient lattice-based digital signature method and system for power data value-added services. BACKGROUND

[0002] The lattice cryptography is a new type of cryptographic system capable of resisting quantum computer attacks, and the main idea is to replace the difficult problem in the traditional discrete logarithm or elliptic curve-based cryptographic protocol into the difficult problem on the lattice, so that the modified cryptographic protocol has the ability to resist quantum algorithm attacks. Based on the difficult problem on the lattice, the lattice-based digital signature algorithm, the public key encryption algorithm and the key exchange protocol are born. Among them, the lattice-based digital signature scheme includes a key generation algorithm, a signature generation algorithm and a verification algorithm, and can be applied to protect the reliability of the transmitted message in the message transmission process. In the lattice-based digital signature scheme, each terminal has a one-to-one public key and private key. The private key is used to generate the digital signature of the message to be signed, and the public key can be used to verify the digital signature. The signer uses the public key to perform digital signature verification calculation on the received message M to be signed, verifies whether the digital signature of the message M to be signed matches, and if it matches, confirms that the received message M to be signed is correct.

[0003] The lattice-based digital signature scheme is mainly established on two architectures, the trapdoor technology-based architecture and the rejection sampling-based architecture. Compared with the trapdoor technology-based signature architecture, the rejection sampling-based signature architecture usually has better operation efficiency. However, in order to protect the information of the signature private key, the rejection sampling technology needs to be used in this kind of lattice-based digital signature scheme. The use of the rejection sampling technology often needs to repeatedly execute the signature generation algorithm in the scheme for many times, thereby generating large calculation overhead and communication overhead.

[0004] For the above problems, a common solution is to use the bimodal rejection sampling technology to reduce the number of repeated execution of the signature generation algorithm as much as possible. However, this method does not have a very significant effect on reducing the calculation overhead and communication overhead, and the public and private key size of the signer is usually large. SUMMARY

[0005] In order to solve the above technical problems, the present application provides an efficient lattice-based digital signature method and system for power data value-added services.

[0006] The technical scheme adopted by the method of the present application is: a lattice-based digital signature method for power data value-added services, comprising the following steps:

[0007] Step 1: a first terminal generates a signature private key and a signature verification public key, and the first terminal is a power gateway in the region where the user is located.

[0008] The specific implementation of step 1 includes the following sub-steps:

[0009] Step 1.1: The first terminal randomly selects a polynomial matrix as the system public matrix, and then selects a polynomial matrix with a small norm as the signature private key; finally, calculates T = AB mod q as the signature verification public key; wherein, R q represents a polynomial ring, and the coefficients of the polynomial elements are all modulo q; represents a matrix with n rows and m columns composed of elements in R q ; represents a matrix with m rows and m columns composed of elements in R q ;

[0010] Step 1.2: The first terminal discloses the matrix T and keeps the matrix B secret.

[0011] Step 2: The first terminal generates a legal signature by using the HashTree algorithm and the rejection sampling method during the interaction process with the second terminal, and generates the relevant path by using the BuildAuth algorithm; the second terminal is a power consumption user;

[0012] The specific implementation of step 2 includes the following sub-steps:

[0013] Step 2.1: The first terminal generates l vectors y1, y2,..., y l according to the Gaussian distribution , and calculates l commitment values Y1 = Ay1, Y2 = Ay2,..., Y l = Ay l ; wherein, represents an m-dimensional vector composed of elements in the polynomial ring R q ; σ represents the standard deviation of the discrete Gaussian distribution;

[0014] Step 2.2: The first terminal executes the HashTree algorithm using the l commitment values Y1, Y2,..., Y l to generate a commitment tree tree, and sends the tree root root of the commitment tree tree to the second terminal;

[0015] Step 2.3: The second terminal calculates a hash value h by using the tree root root and the message u, and then returns h to the first terminal;

[0016] Step 2.4: The first terminal sets an initial value count = 0 of a counter, and traverses the l vectors y1, y2,..., y l to calculate the value Z k= y k + Bh, k e [l]; if Z k is not verified by the rejection sampling technique, then count + 1; in addition, when k > l, the entire signature algorithm needs to be re-executed; otherwise, run the BuildAuth algorithm to generate a path auth; and send (Z k , auth) as the final signature to the second terminal.

[0017] Step 3: The third terminal calculates the target commitment value using the signature, and executes the RootCale algorithm to restore the root node of the commitment tree, and verifies the legitimacy of the root node; the third terminal is a power enterprise service system center.

[0018] The specific implementation of step 3 includes the following sub-steps:

[0019] Step 3.1: The third terminal calculates AZ k using Z k -Th≡Ay k mod g;

[0020] Step 3.2: The third terminal executes RootCale(Ay k , auth) using auth and Ay k to restore the root node root' of the commitment tree tree;

[0021] Step 3.3: The third terminal verifies whether and h = H(root', u) are both true; if both are true, the third terminal accepts the message u; otherwise, the message u is rejected; wherein H is a hash function.

[0022] As a preferred, in step 2, the first terminal will run the HashTree algorithm using l random vectors to generate a commitment tree, and send the hash value h to the second terminal in the system;

[0023] The polynomial calculation in the implementation process is accelerated by NTT, which includes the following steps:

[0024] (1) According to the discrete Gaussian distribution generate l polynomial vectors y1, y2,..., y l and perform NTT transformation to obtain Then calculate l commitment values Finally, perform inverse NTT transformation on the l commitment values to obtain Y1, Y2,..., Y l ;

[0025] (2) Use l commitment values Y1, Y2,..., Y lRun the HashTree algorithm as input;

[0026] ① Set h = [log(l)], tree = Φ; where Φ represents the empty set, and it is promised that the number of elements in the tree is 0;

[0027] ② Traverse the l commitment values ​​and calculate the leaf node F(Y) of the tree. j = v0[j] and tree∪{v0[j]}-→tree, 0≤j≤l-1; where v0 represents the leaf node level of the commitment tree tree; v0[j] represents the j-th element of the leaf node level;

[0028] ③ Calculate the other leaf nodes of the tree, F(j) = v0[j] and tree∪{v0[j]}→tree, l-1≤j≤2 h -1; where h represents the height of the commitment tree;

[0029] ④ Traverse 0≤i≤h and 0≤j≤2 h-i -1, generating other nodes F(v) of the tree i-1 [2j],v i-1 [2j+1])→v i [j] and tree∪{v i [j]}-→tree; where, v i v0[j] represents the i-th level of the commitment tree; v0[j] represents the j-th element of the i-th level of the commitment tree.

[0030] ⑤ Return the root of the commitment tree (tree) = root = v h [0].

[0031] Preferably, in step 2, the first terminal will traverse l vectors y1, y2, ..., y l Then, the BuildAuth algorithm is executed to obtain the final valid signature; specifically including:

[0032] ① Set an initial counter with count = 0, and iterate through l polynomial vectors y1, y2, ..., y l Calculate the value using NTT form. in, For signing private key S ID NTT form and The NTT form of the challenge h sent by the second terminal; finally, for Z is obtained by performing the inverse NTT transform. k ;

[0033] ②If Z kIf the rejection sampling technique fails verification, increment the count by 1. Furthermore, when k > l, the entire signature algorithm needs to be re-executed; otherwise, run the BuildAuth algorithm to generate the path auth.

[0034] ③ Traverse each level of the commitment tree (0 ≤ i ≤ h) and calculate the value. And the index bit = s mod 2; if bit = 1, then let v i [s-1]=a i Otherwise, let v i [s+1]=a i ;

[0035] ④ Return path auth = (a0, a1, ..., a h-1 ).

[0036] The technical solution adopted by the system of this invention is: a grid-based digital signature system for value-added electricity data services, comprising the following modules:

[0037] Module 1 is used for the first terminal to generate a signing private key and a verification public key, wherein the first terminal is the power gateway in the user's area;

[0038] Module 1 includes the following sub-modules:

[0039] Module 1.1 is used for the first terminal to randomly select a polynomial matrix. As the common matrix of the system, then a polynomial matrix with a small norm is selected. R serves as the private key for signing; finally, T = AB mod q is calculated as the public key for verification; where R... q It represents a polynomial ring, where the coefficients of all polynomial elements are modulo q; Indicates that by R q The elements in the matrix form a matrix with n rows and m columns; Indicates that by R q The elements in the matrix form a matrix with m rows and m columns;

[0040] Module 1.2 is used for the first terminal's public matrix T and confidential matrix B.

[0041] Module 2 is used to generate a valid signature using the HashTree algorithm and the rejection sampling method during the interaction between the first terminal and the second terminal, and to generate a relevant path using the BuildAuth algorithm; the second terminal is an electricity consumer.

[0042] Module 2 includes the following sub-modules:

[0043] Module 2.1, used for the first terminal to follow a Gaussian distribution Generate l vectors y1, y2, ..., y l And calculate l commitment values ​​Y1 = Ay1, Y2 = Ay2, ..., Y l =Ay l ;in, Represented as a polynomial ring R q The elements in the vector form an m-dimensional vector; σ represents the standard deviation of the discrete Gaussian distribution.

[0044] Module 2.2 is used by the first terminal to utilize l commitment values ​​Y1, Y2, ..., Y l The HashTree algorithm is executed to generate a commitment tree, and the root of the commitment tree is sent to the second terminal.

[0045] Module 2.3 is used by the second terminal to calculate a hash value h using the tree root and message u, and then return h to the first terminal;

[0046] Module 2.4 is used to set an initial value of count = 0 for the first terminal and to traverse l vectors y1, y2, ..., y l To calculate the value Z k =y k +Bh, k∈[l]; if Z k If the rejection sampling technique fails verification, increment the count by 1; furthermore, when k > l, the entire signature algorithm needs to be re-executed; otherwise, run the BuildAuth algorithm to generate the path auth; and set (Z k , auth) is sent as the final signature to the second terminal.

[0047] Module 3 is used by the third terminal to calculate the target commitment value using the signature, execute the RootCale algorithm to recover the root node of the commitment tree, and verify the legality of the root node; the third terminal is the power enterprise service system center;

[0048] Module 3 includes the following sub-modules:

[0049] Module 3.1, for use by third terminals utilizing Z k Calculate AZ k -Th≡Ay k mod q;

[0050] Module 3.2, for third-party terminals to utilize auth and Ay k Execute RootCale(Ay) k ,auth) to restore the root node root′ of the commitment tree;

[0051] Module 3.3, used for third-party terminal verification Check whether both h = H(root′, u) are true; if both are true, the third terminal accepts message u; otherwise, it rejects message u; where H is a hash function.

[0052] This invention discloses an efficient lattice-based digital signature method and system for power data value-added services. Compared to conventional lattice-based digital signatures based on the Fiat-Shamir architecture, the lattice-based digital signature scheme proposed in this invention utilizes commitment tree technology during signature generation to reduce the additional computational and communication costs caused by rejected sampling. Compared to lattice-based digital signatures, which require 3-4 repetitions of the signature algorithm to generate a valid signature, the efficient lattice-based digital signature scheme proposed in this invention only requires a single execution of the signature algorithm. Since the lattice-based digital signature scheme proposed in this invention is based on a polynomial ring, the number-theoretic transform (NTT) can be used to further improve the scheme's operational efficiency. Therefore, the efficient lattice-based digital signature method and system for power data value-added services proposed in this invention has good compatibility with power enterprise service systems, not only enabling these systems to resist quantum computer attacks but also improving the overall operational efficiency of the service system. This allows power companies to promptly formulate flexible and cost-effective electricity pricing packages based on users' electricity consumption information. Attached Figure Description

[0053] Figure 1 This is a flowchart of a method according to an embodiment of the present invention. Detailed Implementation

[0054] To facilitate understanding and implementation of the present invention by those skilled in the art, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0055] Please see Figure 1 The present invention provides a grid-based digital signature method for value-added services of power data, comprising the following steps:

[0056] Step S01: The first terminal generates a small-norm polynomial matrix B as its own signature private key. Then, it selects a random polynomial matrix A as the system public parameter and calculates T = AB mod q as its own verification public key.

[0057] Step S02: The first terminal follows a Gaussian distribution. Generate l vectors y1, y2, ..., y l And calculate l commitment values ​​Y1 = Ay1, Y2 = Ay2, ..., Yl =Ay l .

[0058] Step S03: The first terminal uses l commitment values ​​Y1, Y2, ..., Y l The HashTree algorithm is executed to generate a commitment tree, and the root of the tree is sent to the second terminal.

[0059] Step S04: The second terminal uses root and message u to calculate a hash value h, and then returns h to the first terminal.

[0060] Step S05: The first terminal sets an initial counter with count = 0, and iterates through l vectors y1, y2, ..., y l To calculate the value Z k =y k +S ID h, k∈[l]. Where, S ID This is the private key for signing. If Z k If the rejection sampling technique fails verification, increment the count by 1. Furthermore, when k > l, the entire signature algorithm needs to be re-executed. Otherwise, run the BuildAuth algorithm to generate the path auth. And set (Z) k , auth) is sent as the final signature to the third terminal.

[0061] Step S06: The third terminal uses Z k Calculate AZ k -H(ID)h≡Ay k mod q.

[0062] Step S07: The third terminal uses auth and Ay k Execute RootCale(Ay) k ,auth) to restore the root node root′ of the commitment tree.

[0063] Step S08: Third-party terminal verification Check if both h = slice(root′, u) are true. If both are true, the verifier accepts message u. Otherwise, it rejects message u.

[0064] It should be noted that in this embodiment, two parties participate in the digital signature generation process: a first terminal and a second terminal. The first terminal is the power gateway in the user's area, and the second terminal is the power consumer. Signature verification is performed by a third terminal, which is the power company's service system center.

[0065] Before generating a digital signature, the regional power gateway will perform the following initialization operations:

[0066] The regional power gateway needs to select system parameters n, m, and q. Since the efficient lattice-based digital signature scheme for power data value-added services proposed in this invention is based on a polynomial ring construction, n, m, and q can be selected according to the Dilithium digital signature scheme in NIST. Simultaneously, the regional power gateway needs to select a collision-resistant hash function H: {0, 1}. * →{v:v∈{-1,0,1} m , ||v|I1≤τ}, are usually instantiated using SHAKE256.

[0067] In the specific implementation of step S01 of this embodiment, the first terminal (regional power gateway) generates a small-norm polynomial matrix B as its own signature private key. Then, it selects a random polynomial matrix A as the system public parameter and calculates T = AB mod q as its own verification public key.

[0068] It should be noted that the regional power gateway can generate a small-norm matrix B based on a discrete Gaussian distribution or a central binomial distribution. Furthermore, for ease of subsequent calculations, the regional power gateway can perform an NTT transformation on the polynomial matrix B to obtain... Then it is made public. To reduce computational overhead, the random polynomial matrix A selected by the regional power gateway is usually assumed to be in NTT form. Therefore, the matrix T calculated according to formula (1) also has NTT form.

[0069]

[0070] In the specific implementation of step S02 of this embodiment, the regional power gateway follows a Gaussian distribution. Generate l vectors y1, y2, ..., y l And calculate l commitment values ​​Y1, Y2, ..., Y according to formula (2). l .

[0071] Y i =Ay i mod q, 1≤i≤l formula (2)

[0072] It should be noted that the regional power gateway does not directly perform the calculation in formula (2), but rather uses l vectors y1, y2, ..., y l After performing the NTT transformation, the calculation is then performed. Then, the commitment values ​​Y1, Y2, ..., Y are obtained by performing the inverse NTT transformation on the resulting l result vectors. l .

[0073] In the specific implementation of step S03 of this embodiment, after the regional power gateway executes the HashTree algorithm to obtain the root of the commitment tree, it sends the root to the second terminal (power consumption user).

[0074] In the specific implementation of step S04 of this embodiment, the smart application device calls the SHAKE256 hash function to calculate the hash value h corresponding to the consumed electricity, and then returns h to the regional power gateway.

[0075] In the specific implementation of step S05 of this embodiment, the regional power gateway will first calculate the NTT form of h in order to improve the operating efficiency of the scheme. Then, the matrix obtained during the initialization process is used. And the y1, y2, ..., y obtained in step S02 l NTT form Calculate according to formula (3). Finally, obtain the result. The corresponding Z can be obtained by performing the inverse NTT transform. k .

[0076]

[0077] It should be noted that, in the above process, in order to reduce the computational overhead of the third terminal (power company service system center), smart meters can directly transmit legitimate electricity data. Send to the power service center.

[0078] In the specific implementation of step S06 of this embodiment, the power enterprise service system center first calculates the NTT form of the hash value h. Then, calculate Finally, Perform the inverse NTT transformation.

[0079] The subsequent verification process at the power company service system center can be performed according to steps S07 and S08. If the power company service system center successfully verifies the legitimacy of the electricity consumption information and messages sent by the regional gateway, the power company service system center will formulate a reasonable electricity pricing package for the user based on the electricity consumption situation within its jurisdiction and the user's customer value.

[0080] This invention, without altering the overall architecture of lattice-based digital signatures based on the Fiat-Shamir architecture, optimizes the signature generation process by utilizing commitment tree technology to generate multiple commitment values ​​at once, addressing the characteristic that signing user terminals need to repeatedly execute the signature generation algorithm to generate a valid signature. Ultimately, the signing user terminal can generate a valid signature with a very high probability by executing the signature generation algorithm only once.

[0081] It should be understood that the above description of the preferred embodiments is quite detailed, but it should not be considered as a limitation on the scope of protection of this invention. Those skilled in the art, under the guidance of this invention, can make substitutions or modifications without departing from the scope of protection of the claims of this invention, and all such substitutions or modifications fall within the scope of protection of this invention. The scope of protection of this invention should be determined by the appended claims.

Claims

1. A grid-based digital signature method for value-added electricity data services, characterized in that, Includes the following steps: Step 1: The first terminal generates a signing private key and a verification public key. The first terminal is the power gateway in the user's area. Step 1 includes the following sub-steps: Step 1.1: The first terminal randomly selects a polynomial matrix. As the common matrix of the system, then a polynomial matrix with a small norm is selected. R serves as the private key for signing; finally, T = AB mod q is calculated as the public key for verification; where R... q It represents a polynomial ring, where the coefficients of all polynomial elements are modulo q; Indicates that R q The elements in the matrix form a matrix with n rows and m columns; Indicates that R q The elements in the matrix form a matrix with m rows and m columns; Step 1.2: First terminal public matrix T, confidential matrix B; Step 2: During the interaction between the first terminal and the second terminal, a valid signature is generated using the HashTree algorithm and the rejection sampling method, and a relevant path is generated using the BuildAuth algorithm; the second terminal is an electricity consumer. Step 2 includes the following sub-steps: Step 2.1: The first terminal follows a Gaussian distribution. Generate l vectors y1, y2, ..., y l And calculate l commitment values ​​Y1 = Ay1, Y2 = Ay2, ..., Y l =Ay l ;in, Represented as a polynomial ring R q The elements in the vector form an m-dimensional vector; σ represents the standard deviation of the discrete Gaussian distribution. Step 2.2: The first terminal uses l commitment values ​​Y1, Y2, ..., Y l The HashTree algorithm is executed to generate a commitment tree, and the root of the commitment tree is sent to the second terminal. Step 2.3: The second terminal calculates a hash value h using the tree root and message u, and then returns h to the first terminal; Step 2.4: The first terminal sets an initial counter with count = 0, and iterates through l vectors y1, y2, ..., y l To calculate the value Z k =y k +Bh, k∈[l]; if Z k If the rejection sampling technique fails verification, increment the count by 1; furthermore, when k > l, the entire signature algorithm needs to be re-executed; otherwise, run the BuildAuth algorithm to generate the path auth; and set (Z k The auth signature is sent as the final signature to the second terminal. Step 3: The third terminal calculates the target commitment value using the signature, executes the RootCale algorithm to recover the root node of the commitment tree, and verifies the legality of the root node; the third terminal is the power enterprise service system center; Step 3 includes the following sub-steps: Step 3.1: The third terminal utilizes Z k Calculate AZ k -Th≡Ay k mod q; Step 3.2: The third terminal uses auth and Ay k Execute RootCale(Ay) k The `auth` function is used to restore the root node of the commitment tree. ′ ; Step 3.3: Third-party terminal verification and h = H(root) ′ If both (u, h) are true, the third terminal accepts message u; otherwise, it rejects message u; where H is a hash function.

2. The grid-based digital signature method for value-added power data services according to claim 1, characterized in that: In step 2, the first terminal will use l random vectors to run the HashTree algorithm to generate a commitment tree and send the hash value h to the second terminal in the system. The polynomial calculations in its implementation process are accelerated using NTT, specifically including the following steps: (1) According to the discrete Gaussian distribution Generate l polynomial vectors y1, y2, ..., y l And perform NTT transformation on them to obtain Then calculate l commitment values. Finally, for the l commitment values Perform the inverse NTT transform to obtain Y1, Y2, ..., Y l ; (2) Using l commitment values ​​Y1, Y2, ..., Y l Run the HashTree algorithm as input; ①Settings tree = Φ; where Φ represents the empty set, and it is guaranteed that the number of elements in the tree is 0; ② Traverse the l commitment values ​​and calculate the leaf node F(Y) of the tree. j = v0[j] and tree∪{v0[j]}→tree, 0≤j≤l-1; where v0 represents the leaf node level of the commitment tree tree; v0[j] represents the j-th element of the leaf node level; ③ Calculate the other leaf nodes of the tree, F(j) = v0[j] and tree∪{v0[j]}→tree, l-1≤j≤2 h -1; where h represents the height of the commitment tree; ④ Traverse 0≤i≤h and 0≤j≤2 h-i -1, generating other nodes F(v) of the tree i-1 [2j],v i-1 [2j+1])→v i [j] and tree∪{v i [j]}→tree; where, v i v0[j] represents the i-th level of the commitment tree; v0[j] represents the j-th element of the i-th level of the commitment tree. ⑤ Return the root of the commitment tree (tree) = root = v h [0].

3. The grid-based digital signature method for value-added power data services according to claim 2, characterized in that: In step 2, the first terminal will traverse l vectors y1, y2, ..., y l Then, the BuildAuth algorithm is executed to obtain the final valid signature; Specifically, it includes: ① Set an initial counter with count = 0, and iterate through l polynomial vectors y1, y2, ..., y l Calculate the value using NTT form. in, For signing private key S ID NTT form and The NTT form of the challenge h sent by the second terminal; finally, for Z is obtained by performing the inverse NTT transform. k ; ②If Z k If the rejection sampling technique fails verification, increment the count by 1. Furthermore, when k > l, the entire signature algorithm needs to be re-executed; otherwise, run the BuildAuth algorithm to generate the path auth. ③ Traverse each level of the commitment tree (0 ≤ i ≤ h) and calculate the value. And the index bit = s mod 2; if bit = 1, then let v i [s-1]=a i Otherwise, let v i [s+1]=a i ; ④ Return path auth=(a0,a1,…,a h-1 ).

4. A grid-based digital signature system for value-added services of power data, characterized in that, Includes the following modules: Module 1 is used for the first terminal to generate a signing private key and a verification public key, wherein the first terminal is the power gateway in the user's area; Module 1 includes the following sub-modules: Module 1.1 is used for the first terminal to randomly select a polynomial matrix. As the common matrix of the system, then a polynomial matrix with a small norm is selected. R serves as the private key for signing; finally, T = AB mod q is calculated as the public key for verification; where R... q It represents a polynomial ring, where the coefficients of all polynomial elements are modulo q; Indicates that R q The elements in the matrix form a matrix with n rows and m columns; Indicates that R q The elements in the matrix form a matrix with m rows and m columns; Module 1.2 is used for the first terminal's public matrix T and confidential matrix B; Module 2 is used to generate a valid signature using the HashTree algorithm and the rejection sampling method during the interaction between the first terminal and the second terminal, and to generate a relevant path using the BuildAuth algorithm; the second terminal is an electricity consumer. Module 2 includes the following sub-modules: Module 2.1 is used for the first terminal to follow a Gaussian distribution. Generate l vectors y1, y2, ..., y l And calculate l commitment values ​​Y1 = Ay1, Y2 = Ay2, ..., Y l =Ay l ;in, Represented as a polynomial ring R q The elements in the vector form an m-dimensional vector; σ represents the standard deviation of the discrete Gaussian distribution. Module 2.2 is used by the first terminal to utilize l commitment values ​​Y1, Y2, ..., Y l The HashTree algorithm is executed to generate a commitment tree, and the root of the commitment tree is sent to the second terminal. Module 2.3 is used by the second terminal to calculate a hash value h using the tree root and message u, and then return h to the first terminal; Module 2.4 is used to set an initial value count = 0 for the first terminal and traverse l vectors y1, y2, ..., y l To calculate the value Z k =y k +Bh, k∈[l]; if Z k If the rejection sampling technique fails verification, increment the count by 1; furthermore, when k > l, the entire signature algorithm needs to be re-executed; otherwise, run the BuildAuth algorithm to generate the path auth; and set (Z k The auth signature is sent as the final signature to the second terminal; Module 3 is used by the third terminal to calculate the target commitment value using the signature, execute the RootCale algorithm to recover the root node of the commitment tree, and verify the legality of the root node; the third terminal is the power enterprise service system center; Module 3 includes the following sub-modules: Module 3.1, for use by third terminals utilizing Z k Calculate AZ k -Th≡Ay k mod q; Module 3.2, for third-party terminals to utilize auth and Ay k Execute RootCale(Ay) k The `auth` function is used to restore the root node of the commitment tree. ′ ; Module 3.3, used for third-party terminal verification and h = H(root) ′ If both (u, h) are true, the third terminal accepts message u; otherwise, it rejects message u; where H is a hash function.

Images