Digital signature method, verification method, device, equipment, storage medium and system

Abstract

The invention discloses a digital signature method and device, a verification method and device, equipment, a storage medium and a system. The digital signature method is applied to a sending end, and comprises the following steps: acquiring an additional value of original message data; connecting the additional value to the original message data to generate to-be-signed data; performing a first signature operation and a second signature operation based on the to-be-signed data to correspondingly obtain first signature data and second signature data; and connecting the first signature data and the second signature data in series to obtain final signature data. According to the digital signature method, the logic association of the signature data is realized by introducing the additional value, the signature uniqueness and tamper resistance are improved, quantum computing attacks can be effectively resisted through double signatures of the first signature operation and the second signature operation, the tamper resistance of the digital signature is enhanced, the data security is enhanced, and the security of the digital signature is improved. And the method has good compatibility with a traditional password system.

Description

Technical Field

[0001] The present application relates to the field of cryptography application technology, and specifically to a digital signature method, verification method, device, equipment, storage medium and system. Background Art

[0002] With the rapid development of quantum computing technology, traditional digital signature algorithms (such as RSA and ECC) are facing the threat of being cracked by quantum computers due to their mathematical foundations. Therefore, post-quantum cryptographic algorithms have become an important research direction for digital signatures in the future. However, in related technologies, directly switching to post-quantum cryptographic algorithms has problems such as poor tamper resistance of digital signatures and poor compatibility with traditional cryptographic systems.

[0003] The above statements are only used to provide background information related to the present application and do not necessarily constitute prior art. Summary of the invention

[0004] The purpose of this application is to provide a digital signature method, verification method, device, equipment, storage medium and system. In order to have a basic understanding of some aspects of the disclosed embodiments, a simple summary is given below. This summary is not a general review, nor is it intended to identify key / important components or describe the scope of protection of these embodiments. Its only purpose is to present some concepts in a simple form as a preface to the detailed description that follows.

[0005] According to one aspect of an embodiment of the present application, a digital signature method is provided, which is applied to a sending end, and the method includes: Get the additional value of the original message data; Connecting the additional value to the original message data to generate data to be signed; Based on the data to be signed, a first signature operation and a second signature operation are performed to obtain first signature data and second signature data respectively; The first signature data and the second signature data are concatenated to obtain final signature data.

[0006] In some embodiments of the present application, the obtaining of the additional value of the original message data includes: A timestamp, a dynamic identifier and / or context information of the original message data is obtained.

[0007] In some embodiments of the present application, performing a first signature operation and a second signature operation based on the data to be signed, and correspondingly obtaining first signature data and second signature data, includes: Performing a first signature operation on the data to be signed to obtain first signature data; A second signature operation is performed on the data to be signed, or a second signature operation is performed on the data to be signed and the first signature data to obtain second signature data.

[0008] In some embodiments of the present application, the first signature operation is a classical cryptographic algorithm signature operation and the second signature operation is a post-quantum cryptographic algorithm signature operation; or, The first signature operation is a post-quantum cryptographic algorithm signature operation and the second signature operation is a classical cryptographic algorithm signature operation.

[0009] In some embodiments of the present application, the method also includes: sending the final signature data to a receiving end, so that the receiving end verifies the first signature data using a first public key corresponding to the first signature operation and verifies the second signature data using a second public key corresponding to the second signature operation.

[0010] According to another aspect of an embodiment of the present application, a digital signature verification method is provided, which is applied to a receiving end, and the method includes: The final signature data generated and sent by the receiving transmitting end is obtained by concatenating the first signature data and the second signature data, wherein the first signature data and the second signature data are obtained by performing the first signature operation and the second signature operation on the data to be signed; the data to be signed is generated by connecting the additional value to the original message data; Verifying the first signature data using a first public key corresponding to the first signature operation and verifying the second signature data using a second public key corresponding to the second signature operation; Determine whether the digital signature verification passes according to the verification result of the first signature data and the verification result of the second signature data.

[0011] In some embodiments of the present application, determining whether the digital signature verification is passed according to the verification result of the first signature data and the verification result of the second signature data includes: In the case that both the first signature data and the second signature data are verified, it is determined that the digital signature verification is successful; otherwise, it is determined that the digital signature verification fails.

[0012] According to another aspect of an embodiment of the present application, a digital signature device is provided, which is applied to a sending end, and the device includes: An added value acquisition module, used to acquire the added value of the original message data; A module for generating data to be signed, used for connecting the additional value to the original message data to generate data to be signed; A signature module, used to perform a first signature operation and a second signature operation based on the data to be signed, and obtain first signature data and second signature data accordingly; A concatenation module is used to concatenate the first signature data and the second signature data to obtain final signature data.

[0013] According to another aspect of an embodiment of the present application, a digital signature verification device is provided, which is applied to a receiving end, and the device includes: a receiving module, configured to receive final signature data generated and sent by a sending end; the final signature data is obtained by concatenating first signature data and second signature data, the first signature data and the second signature data are obtained by correspondingly performing a first signature operation and a second signature operation on the data to be signed; the data to be signed is generated by connecting an additional value to the original message data; a verification module, configured to verify the first signature data using a first public key corresponding to the first signature operation and to verify the second signature data using a second public key corresponding to the second signature operation; The verification result determination module is used to determine whether the digital signature verification is passed according to the verification result of the first signature data and the verification result of the second signature data.

[0014] According to another aspect of an embodiment of the present application, an electronic device is provided, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the computer program to implement the digital signature method described in any embodiment of the present application, or the digital signature verification method described in any embodiment of the present application.

[0015] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, on which a computer program is stored, and the computer program is executed by a processor to implement the digital signature method described in any embodiment of the present application, or the digital signature verification method described in any embodiment of the present application.

[0016] According to another aspect of an embodiment of the present application, a digital authentication system is provided, including a digital signature device and a digital signature verification device, wherein the digital signature device is used to execute the digital signature method described in any embodiment of the present application, and the digital signature verification device is used to execute the digital signature verification method described in any embodiment of the present application.

[0017] The technical solution provided by one aspect of the embodiments of the present application may have the following beneficial effects: The digital signature method provided in the embodiment of the present application obtains an additional value of original message data; connects the additional value to the original message data to generate data to be signed; based on the data to be signed, performs a first signature operation and a second signature operation to obtain first signature data and second signature data respectively; concatenates the first signature data and the second signature data to obtain final signature data, and realizes the logical association of signature data by introducing the additional value, thereby improving the uniqueness and tamper resistance of the signature, and can effectively resist quantum computing attacks through the dual signature of the first signature operation and the second signature operation, thereby enhancing the tamper resistance of the digital signature, enhancing data security, and having good compatibility with traditional cryptographic systems.

[0018] The above description is only an overview of the technical solution of the embodiment of the present application. In order to more clearly understand the technical means of the embodiment of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiment of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A flow chart of a digital signature method according to an embodiment of the present application is shown.

[0021] Figure 2 A flowchart of step S13 of an embodiment of the present application is shown.

[0022] Figure 3 A flow chart of a digital signature verification method according to an embodiment of the present application is shown.

[0023] Figure 4 A structural block diagram of a digital signature device according to an embodiment of the present application is shown.

[0024] Figure 5 A structural block diagram of a digital signature verification device according to an embodiment of the present application is shown.

[0025] Figure 6 A structural block diagram of an electronic device according to an embodiment of the present application is shown.

[0026] Figure 7 A schematic diagram of a computer-readable storage medium according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0028] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as here.

[0029] In response to the problems in the related art that the digital signature has poor tamper resistance and poor compatibility with traditional cryptographic systems after directly switching to the post-quantum cryptographic algorithm, the embodiment of the present application provides a digital signature method, which obtains an additional value of the original message data, connects the additional value to the original message data, generates data to be signed, performs a first signature operation and a second signature operation based on the data to be signed, and correspondingly obtains first signature data and second signature data, concatenates the first signature data and the second signature data to obtain final signature data, and realizes the logical association of signature data by introducing the additional value, improves the uniqueness and tamper resistance of the signature, and can effectively resist quantum computing attacks through the dual signature of the first signature operation and the second signature operation, enhances data security, and has good compatibility with traditional cryptographic systems.

[0030] The following describes a digital signature method, verification method, apparatus, device, storage medium and system proposed according to an embodiment of the present application in conjunction with the accompanying drawings.

[0031] refer to Figure 1 As shown, an embodiment of the present application provides a digital signature method, which is applied to a sending end. The method may include steps S11 to S14: S11. Obtain the additional value of the original message data.

[0032] Exemplarily, the additional value of the original message data may include a timestamp, a dynamic identifier and / or context information of the original message data. Acquiring the additional value of the original message data may include: acquiring the timestamp, the dynamic identifier and / or context information of the original message data.

[0033] S12. Connect the additional value to the original message data to generate data to be signed.

[0034] By introducing the information coupling mechanism of additional data, the uniqueness and relevance of the data to be signed can be improved, thereby reducing the risk of tampering and replay attacks.

[0035] For example, after the sender obtains the original message data m, it adds the additional value ad (such as a timestamp, a random identifier, or context information) to the original message data m to form the data to be signed m||ad.

[0036] S13. Based on the data to be signed, perform a first signature operation and a second signature operation to obtain first signature data and second signature data respectively.

[0037] refer to Figure 2 As shown, in some implementations, based on the data to be signed, performing a first signature operation and a second signature operation to obtain first signature data and second signature data correspondingly may include: S131, performing a first signature operation on the data to be signed to obtain first signature data; S132: Perform a second signature operation on the data to be signed, or perform a second signature operation on the data to be signed and the first signature data to obtain second signature data.

[0038] Exemplarily, the first signature operation is a classical cryptographic algorithm signature operation and the second signature operation is a post-quantum cryptographic algorithm signature operation; or, the first signature operation is a post-quantum cryptographic algorithm signature operation and the second signature operation is a classical cryptographic algorithm signature operation.

[0039] Classical cryptographic algorithms include but are not limited to Rabin signature algorithm, DSS signature algorithm, RSA signature algorithm, etc. Post-quantum cryptographic algorithms include but are not limited to CRYSTALS-KYBER algorithm, FALCON algorithm, CRYSTALS-Dilithium algorithm, SPHINCS+ algorithm, etc.

[0040] The sender can sign based on the pre-acquired post-quantum signature algorithm and classical signature algorithm and related parameters. For example, the sender calls the post-quantum cryptography algorithm private key sk PQC , sign m||ad, and get the first signature data s1=sign PQC (m||ad, sk PQC ); call the classic cryptographic algorithm private key sk C , sign m||ad and get the second signature data s2=sign C (m||ad, skC ).

[0041] For example, the sender calls the private key sk of the post-quantum cryptography algorithm PQC , sign m||ad, and get the first signature data s1=sign PQC (m||ad,sk PQC ), call the classic cryptographic algorithm private key sk C , sign m||ad||s1, and get the second signature data s2=sign C (m||ad||s1,sk C ).

[0042] For example, the sender calls the classic cryptographic algorithm private key sk C , sign m||ad, and get the first signature data s1=sign C (m||ad, sk C ), calling the post-quantum cryptography algorithm private key sk PQC , sign m||ad||s1, and get the second signature data s2=sign PQC (m||ad||s1, sk PQC ).

[0043] The method of this embodiment has dynamic adjustment capability, supports dynamic selection of signature algorithms, and flexible adjustment of signature operation sequence and additional value type, and can adapt to different application scenario requirements.

[0044] Through the dual signature mechanism of the first signature operation and the second signature operation, combined with the classical cryptographic algorithm and the post-quantum cryptographic algorithm, dual signature data is generated, which can enhance the security and anti-quantum computing capability of the digital authentication system.

[0045] S14. Concatenate the first signature data and the second signature data to obtain final signature data.

[0046] For example, the first signature data s1 and the second signature data s2 are concatenated together as the final signature data of the message: s1||s2; wherein the first signature data is s1=sign PQC (m||ad, sk PQC ), and the second signature data is s2=sign C (m||ad, sk C ); or, the first signature data is s1=sign PQC (m||ad,sk PQC ), and the second signature data is s2=sign C (m||ad||s1,sk C); or, the first signature data is s1=sign C (m||ad, sk C ), the second signature data is s2=sign PQC (m||ad||s1, sk PQC ).

[0047] In some embodiments, the method may further include: S50, sending the final signature data to a receiving end, so that the receiving end verifies the first signature data using a first public key corresponding to the first signature operation and verifies the second signature data using a second public key corresponding to the second signature operation.

[0048] Specifically, the sending end transmits the message and the final signature data to the receiving end. The receiving end uses the public key corresponding to the algorithm used for the first signature operation and the public key corresponding to the algorithm used for the second signature operation to verify the first signature data and the second signature data respectively. If and only if the first signature data and the second signature data are both verified, it is determined that the final signature data verification is passed, otherwise it is determined that the verification fails.

[0049] The method of the embodiment of the present application can achieve the following beneficial technical effects: 1) By combining classical cryptographic algorithms and post-quantum cryptographic algorithms for dual signing, it can effectively resist quantum computing attacks and provide redundant security protection. Even if a single signature algorithm is cracked, it can still protect data security and enhance data security.

[0050] 2) Improve signature uniqueness and tamper resistance: By introducing additional values ​​(such as timestamps, dynamic identifiers, etc.), the logical association of signature data is realized, each signature is unique, and data tampering and replay attacks are prevented.

[0051] 3) Achieve smooth system transition: support compatibility with existing classic encryption infrastructure.

[0052] 4) Flexibility and scalability: It provides multiple signature generation methods, including independent generation, dependent generation, etc., and supports dynamic adjustment of signature order and structure according to application requirements.

[0053] 5) Adapt to distributed verification: Support multi-node signature verification in scenarios such as blockchain to meet the security requirements of distributed environments.

[0054] 6) Meet future security and compliance needs: By introducing post-quantum cryptographic algorithms, it provides long-term protection for data security and complies with future quantum security standards.

[0055] 7) Adapt to multi-scenario applications: Suitable for scenarios such as financial transactions and IoT device authentication, the signature process and added value type can be dynamically adjusted according to performance and security requirements.

[0056] 8) It performs well in terms of system compatibility, performance overhead, etc.

[0057] refer to Figure 3 As shown, another embodiment of the present application provides a digital signature verification method, which is applied to a receiving end. The method may include steps S21 to S23: S21, receiving the final signature data generated and sent by the transmitting end; the final signature data is obtained by concatenating the first signature data and the second signature data, the first signature data and the second signature data are obtained by performing a first signature operation and a second signature operation on the data to be signed; the data to be signed is generated by connecting the additional value to the original message data; S22. Verify the first signature data using the first public key corresponding to the first signature operation and verify the second signature data using the second public key corresponding to the second signature operation; S23. Determine whether the digital signature verification passes according to the verification result of the first signature data and the verification result of the second signature data.

[0058] In some embodiments, determining whether the digital signature verification passes based on the verification results of the first signature data and the second signature data may include: if both the first signature data and the second signature data are verified, determining that the digital signature verification passes; otherwise, determining that the digital signature verification fails.

[0059] Specifically, the receiving end receives the message and final signature data sent by the sending end, and uses the public key corresponding to the algorithm used for the first signature operation and the public key corresponding to the algorithm used for the second signature operation to verify the first signature data and the second signature data respectively. If and only if the first signature data and the second signature data are both verified, it is determined that the final signature data verification is passed, otherwise it is determined that the verification fails.

[0060] The digital signature verification method of the embodiment of the present application can achieve the same beneficial technical effects as the digital signature method provided in the embodiment of the present application.

[0061] In a specific example, the digital signature method may include the following steps: Step 1: Signature preparation.

[0062] Get the original message data m to be signed.

[0063] Generate additional data (ad), including timestamps, dynamic identifiers, or context information, to ensure the uniqueness and anti-replay capability of the signed data.

[0064] Determine the signature algorithm (classical cryptographic algorithm and post-quantum cryptographic algorithm) and the order in which it is generated.

[0065] Step 2: Generate dual signatures.

[0066] Use the classical cryptographic algorithm and the post-quantum cryptographic algorithm to sign m||ad respectively to generate double-signed data. The specific generation method may include: Independent generation: Classical signatures and post-quantum signatures sign message data separately and independently of each other; Dependent generation: One signature depends on the result of another signature, for example, the latter part of the signature takes the output of the previous part of the signature as input.

[0067] The method in this example supports multiple signature generation methods such as independent generation and dependent generation, as well as data combination structures such as concatenation.

[0068] Step 3: Sign the data combination.

[0069] The two parts of the generated signature data are combined into the final signature. The combination method may include but is not limited to: Concatenation: directly combine the two parts of signature data in a fixed order.

[0070] Other combinations: specific signature data structures designed according to the requirements of the application scenario.

[0071] The method in this example provides the ability to expand to a multi-level signature structure, which can adapt to future complex security requirements and has good scalability.

[0072] Step 4: Signature verification.

[0073] The receiving end receives the message data, additional value, and final signature data.

[0074] Verify the validity of the two-part signature step by step according to the generation logic.

[0075] If the verification is successful, the signature is valid; if any part of the verification fails, the signature is invalid.

[0076] Another example provides a method comprising the following steps: First, the sender obtains the signature request and gets the message m to be signed, as well as the corresponding post-quantum signature algorithm and classical signature algorithm names and related parameters.

[0077] The sender adds an additional value ad (such as a timestamp, a random identifier, or context information) after the message m to form the data to be signed m||ad.

[0078] The sender calls the post-quantum cryptography algorithm private key sk PQC, sign m||ad and get the first part of the signature data s1=sign PQC (m||ad, sk PQC ).

[0079] The sender calls the classic cryptographic algorithm private key sk C , sign m||ad and get the second part of the signature data s2=sign C (m||ad, sk C ).

[0080] The sender concatenates the first part of the signature data and the second part of the signature data as the final signature data of the message: that is, s1||s2 or s2||s1.

[0081] The sender transmits the message and signature data to the receiver in a specific way.

[0082] The receiving end uses the public keys corresponding to the post-quantum signature algorithm and the classical signature algorithm to verify the two partial signature data s1 and s2 respectively. The signature data verification passes if and only if both partial signature data are verified, otherwise the verification fails.

[0083] Another example provides a method that uses a sequentially coupled double signature approach. The method in this example includes: First, the sender obtains the signature request and gets the message m to be signed, as well as the corresponding post-quantum signature algorithm and classical signature algorithm names and related parameters.

[0084] The sender adds an additional value ad (such as a timestamp, a random identifier, or context information) after the message m to form the data to be signed m||ad.

[0085] The sender calls the post-quantum cryptography algorithm private key sk PQC , sign m||ad and get the first part of the signature data s1=sign PQC (m||ad, sk PQC ).

[0086] The sender calls the classic cryptographic algorithm private key sk C , sign m||ad||s1 and get the second part of the signature data s2=sign C (m||ad||s1, sk C ).

[0087] The sender concatenates the first part of the signature data and the second part of the signature data as the final signature data of the message: s1||s2.

[0088] The sender transmits the message and signature data to the receiver in a specific way.

[0089] The receiving end uses the public keys corresponding to the post-quantum signature algorithm and the classical signature algorithm to verify the two parts of the signature data respectively. The signature data verification passes if and only if both parts of the signature data are verified, otherwise the verification fails.

[0090] Another example method uses a reverse coupling double signature approach, and the method of the example includes the following steps: First, the sender obtains the signature request and gets the message m to be signed, as well as the corresponding post-quantum signature algorithm and classical signature algorithm names and related parameters.

[0091] The sender adds an additional value ad (such as a timestamp, a random identifier, or context information) after the message m to form the data to be signed m||ad.

[0092] The sender calls the classic cryptographic algorithm private key sk C , sign m||ad and get the first part of the signature data s1=sign C (m||ad, sk C ).

[0093] The sender calls the post-quantum cryptography algorithm private key sk PQC , sign m||ad||s1 and get the second part of the signature data s2=sign PQC (m||ad||s1, sk PQC ).

[0094] The sender concatenates the first part of the signature data and the second part of the signature data as the final signature data of the message: s1||s2.

[0095] The sender transmits the message and signature data to the receiver in a specific way.

[0096] The receiving end uses the public keys corresponding to the post-quantum signature algorithm and the classical signature algorithm to verify the two parts of the signature data respectively. The signature data verification passes if and only if both parts of the signature data are verified, otherwise the verification fails.

[0097] The method provided in the example of this application is a hybrid digital signature method that combines a classical cryptographic algorithm and a post-quantum cryptographic algorithm. Through a dual signature mechanism and an information coupling mechanism, data integrity, authenticity, tamper resistance, and quantum security are achieved. By introducing additional value (Additional Data, ad) in the signature message, information coupling is achieved, the signature process is dynamically adjusted, and a dual signature mechanism is constructed. The method provided in this example can not only ensure the integrity and authenticity of the data, but also effectively prevent replay attacks and enhance the system's ability to resist quantum computing. In addition, the method of this example supports a smooth transition of existing classical encryption infrastructure and is suitable for high-security application scenarios such as financial transactions, IoT device authentication, and e-government. The method of the embodiment of this application performs well in terms of system compatibility and performance overhead.

[0098] The method provided in the embodiment of the present application supports a multi-level signature structure and can combine various types of signature algorithms (such as classical cryptographic algorithms, post-quantum cryptographic algorithms, etc.) to cope with more complex security requirements. Among them, the added value ad is a dynamically generated auxiliary information used to enhance the uniqueness and security of the signature data. Its form may include but is not limited to timestamps (used to prevent replay attacks), random identifiers (to ensure uniqueness in distributed environments), and context information (such as session IDs, transaction serial numbers, etc., used to bind the application context of the signature). The form and structure of the added value can be dynamically adjusted (such as a combination of timestamps and contexts) to meet the needs of joint signatures and verification in single-device generation and distributed environments.

[0099] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0100] refer to Figure 4 As shown, an embodiment of the present application provides a digital signature device, which is applied to a sending end, and the device may include: An added value acquisition module, used to acquire the added value of the original message data; A module for generating data to be signed, used for connecting the additional value to the original message data to generate data to be signed; A signature module, used to perform a first signature operation and a second signature operation based on the data to be signed, and obtain first signature data and second signature data accordingly; A concatenation module is used to concatenate the first signature data and the second signature data to obtain final signature data.

[0101] Exemplarily, the additional value acquisition module is further specifically used to obtain the timestamp, dynamic identifier and / or context information of the original message data.

[0102] Exemplarily, the signature module may include: A first signature unit, used to perform a first signature operation on the data to be signed to obtain first signature data; The second signature unit is used to perform a second signature operation on the data to be signed, or to perform a second signature operation on the data to be signed and the first signature data, to obtain second signature data.

[0103] Exemplarily, the first signature operation is a classical cryptographic algorithm signature operation and the second signature operation is a post-quantum cryptographic algorithm signature operation; or, the first signature operation is a post-quantum cryptographic algorithm signature operation and the second signature operation is a classical cryptographic algorithm signature operation.

[0104] Exemplarily, the device may also include: a sending module, used to send the final signature data to a receiving end, so that the receiving end uses the first public key corresponding to the first signature operation to verify the first signature data and uses the second public key corresponding to the second signature operation to verify the second signature data.

[0105] The digital signature device of the embodiment of the present application obtains the additional value of the original message data, connects the additional value to the original message data, generates the data to be signed, performs the first signature operation and the second signature operation based on the data to be signed, obtains the first signature data and the second signature data respectively, concatenates the first signature data and the second signature data, obtains the final signature data, and realizes the logical association of the signature data by introducing the additional value, thereby improving the uniqueness and tamper resistance of the signature, and can effectively resist quantum computing attacks and enhance data security through the dual signature of the first signature operation and the second signature operation.

[0106] refer to Figure 5 As shown, another embodiment of the present application provides a digital signature verification device, which is applied to a receiving end, and the device may include: a receiving module, configured to receive final signature data generated and sent by a sending end; the final signature data is obtained by concatenating the first signature data and the second signature data, the first signature data and the second signature data are obtained by correspondingly performing a first signature operation and a second signature operation on the data to be signed; the data to be signed is generated by connecting the additional value to the original message data; a verification module, configured to verify the first signature data using a first public key corresponding to the first signature operation and to verify the second signature data using a second public key corresponding to the second signature operation; The verification result determination module is used to determine whether the digital signature verification is passed according to the verification result of the first signature data and the verification result of the second signature data.

[0107] Exemplarily, the verification result determination module is further specifically used to determine that the digital signature verification is successful if both the first signature data and the second signature data are verified successfully, otherwise determine that the digital signature verification fails.

[0108] The digital signature verification device of the embodiment of the present application improves the uniqueness and tamper resistance of the signature, can effectively resist quantum computing attacks, enhances the tamper resistance of the digital signature, enhances data security, and has good compatibility with traditional cryptographic systems.

[0109] As shown in the reference figure, another embodiment of the present application provides a digital authentication system, including a digital signature device and a digital signature verification device, wherein the digital signature device is used to execute the digital signature method of any embodiment of the present application, and the digital signature verification device is used to execute the digital signature verification method of any embodiment of the present application.

[0110] The digital authentication system of the embodiment of the present application obtains the additional value of the original message data, connects the additional value to the original message data, generates the data to be signed, performs the first signature operation and the second signature operation based on the data to be signed, obtains the first signature data and the second signature data respectively, concatenates the first signature data and the second signature data, obtains the final signature data, and realizes the logical association of the signature data by introducing the additional value, improves the uniqueness and tamper resistance of the signature, and can effectively resist quantum computing attacks and enhance data security through the dual signature of the first signature operation and the second signature operation.

[0111] Another embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the computer program to implement the digital signature method of any embodiment of the present application, or the digital signature verification method of any embodiment of the present application.

[0112] refer to Figure 4 As shown, the electronic device 10 may include: a processor 100, a memory 101, a bus 102 and a communication interface 103, and the processor 100, the communication interface 103 and the memory 101 are connected via the bus 102; the memory 101 stores a computer program that can be run on the processor 100, and when the processor 100 runs the computer program, it executes the digital signature method of any embodiment of the present application, or the digital signature verification method of any embodiment of the present application.

[0113] The memory 101 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage. The communication connection between the device network element and at least one other network element is realized through at least one communication interface 103 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0114] The bus 102 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 101 is used to store a program, and the processor 100 executes the program after receiving an execution instruction. The method disclosed in any implementation of the aforementioned embodiment of the present application may be applied to the processor 100, or implemented by the processor 100.

[0115] The processor 100 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 100 or an instruction in the form of software. The above processor 100 may be a general-purpose processor, which may include a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module may be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 101, and the processor 100 reads the information in the memory 101 and completes the steps of the above method in combination with its hardware.

[0116] The electronic device provided in the embodiment of the present application and the method provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the method adopted, operated or implemented by them.

[0117] Another embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored, and the computer program is executed by a processor to implement the method of any of the above embodiments. Figure 5 As shown, the computer-readable storage medium shown is a CD 20, on which a computer program (i.e., a program product) is stored. When the computer program is run by the processor, it will execute the digital signature method of any embodiment of the present application, or the digital signature verification method of any embodiment of the present application.

[0118] It should be noted that examples of computer-readable storage media may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0119] The computer-readable storage medium provided in the above-mentioned embodiments of the present application and the method provided in the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the method adopted, run or implemented by the application program stored therein.

[0120] It should be noted that: The term "module" is not intended to be limited to a specific physical form. Depending on the specific application, a module can be implemented as hardware, firmware, software, and / or a combination thereof. In addition, different modules can share common components or even be implemented by the same components. There may or may not be clear boundaries between different modules.

[0121] The algorithm and display provided herein are not inherently related to any specific computer, virtual device or other equipment. Various general devices can also be used together with examples based on this. According to the above description, it is obvious to construct the structure required for this type of device. In addition, the application is not directed to any specific programming language yet. It should be understood that various programming languages ​​can be utilized to realize the content of the application described herein, and the description made to specific languages ​​above is for the purpose of disclosing the best mode of implementation of the application.

[0122] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0123] The above embodiments only express the implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A digital signature method, characterized in that: Applied to the sending end, the method includes: Get the additional value of the original message data; Connecting the additional value to the original message data to generate data to be signed; Based on the data to be signed, a first signature operation and a second signature operation are performed to obtain first signature data and second signature data respectively; The first signature data and the second signature data are concatenated to obtain final signature data.

2. The method according to claim 1, characterized in that The obtaining of the additional value of the original message data includes: A timestamp, a dynamic identifier and / or context information of the original message data is obtained.

3. The method according to claim 1 or 2, characterized in that: The performing a first signature operation and a second signature operation based on the data to be signed, and correspondingly obtaining first signature data and second signature data, includes: Performing a first signature operation on the data to be signed to obtain first signature data; A second signature operation is performed on the data to be signed, or a second signature operation is performed on the data to be signed and the first signature data to obtain second signature data.

4. The method according to claim 3, characterized in that The first signature operation is a classical cryptographic algorithm signature operation and the second signature operation is a post-quantum cryptographic algorithm signature operation; or, The first signature operation is a post-quantum cryptographic algorithm signature operation and the second signature operation is a classical cryptographic algorithm signature operation.

5. The method according to claim 1 or 2, characterized in that: The method also includes: sending the final signature data to a receiving end, so that the receiving end verifies the first signature data using a first public key corresponding to the first signature operation and verifies the second signature data using a second public key corresponding to the second signature operation.

6. A digital signature verification method, characterized in that: Applied to the receiving end, the method includes: The final signature data generated and sent by the receiving transmitting end is obtained by concatenating the first signature data and the second signature data, wherein the first signature data and the second signature data are obtained by performing the first signature operation and the second signature operation on the data to be signed; the data to be signed is generated by connecting the additional value to the original message data; Verifying the first signature data using a first public key corresponding to the first signature operation and verifying the second signature data using a second public key corresponding to the second signature operation; Determine whether the digital signature verification passes according to the verification result of the first signature data and the verification result of the second signature data.

7. The method according to claim 6, characterized in that The determining whether the digital signature verification is passed according to the verification result of the first signature data and the verification result of the second signature data includes: In the case that both the first signature data and the second signature data are verified, it is determined that the digital signature verification is successful; otherwise, it is determined that the digital signature verification fails.

8. A digital signature device, characterized in that: Applied to a transmitting end, the device comprises: An added value acquisition module, used to acquire the added value of the original message data; A module for generating data to be signed, used for connecting the additional value to the original message data to generate data to be signed; A signature module, used to perform a first signature operation and a second signature operation based on the data to be signed, and obtain first signature data and second signature data accordingly; A concatenation module is used to concatenate the first signature data and the second signature data to obtain final signature data.

9. A digital signature verification device, characterized in that: Applied to a receiving end, the device comprises: a receiving module, configured to receive final signature data generated and sent by a sending end; the final signature data is obtained by concatenating first signature data and second signature data, the first signature data and the second signature data are obtained by correspondingly performing a first signature operation and a second signature operation on the data to be signed; the data to be signed is generated by connecting an additional value to the original message data; a verification module, configured to verify the first signature data using a first public key corresponding to the first signature operation and to verify the second signature data using a second public key corresponding to the second signature operation; The verification result determination module is used to determine whether the digital signature verification is passed according to the verification result of the first signature data and the verification result of the second signature data.

10. An electronic device, characterized in that: It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the digital signature method as described in any one of claims 1 to 5, or the digital signature verification method as described in any one of claims 6 to 7.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: The computer program is executed by a processor to implement the digital signature method according to any one of claims 1 to 5, or the digital signature verification method according to any one of claims 6 to 7.

12. A digital authentication system, characterized in that: It comprises a digital signature device and a digital signature verification device, wherein the digital signature device is used to execute the digital signature method as described in any one of claims 1-5, and the digital signature verification device is used to execute the digital signature verification method as described in any one of claims 6-7.

Images