Signature method, device and equipment and computer readable storage medium

Abstract

The invention discloses a ring signature method, device and equipment and a computer readable storage medium, which are applied to the technical field of information security, and the method comprises the following steps: a prover generates a public and private key pair corresponding to each ring member based on security parameters; the certifier constructs a set membership certification protocol based on the public and private key pair, the private key ownership certification, the ring membership certification and the to-be-signed message corresponding to each ring member, and determines signature information based on the set membership certification protocol; the private key ownership certificate is a relational expression for proving that a signer has a private key by utilizing zero knowledge; the ring member qualification proof is a relational expression which proves that the public key belongs to a given ring member public key set; and the verifier verifies the signature information to obtain a verification result. According to the method and the device, the ring member identity certification is realized by utilizing the set membership certification protocol, and the use requirements of the existing ring signature on the Merkle tree and the Merkle certification are avoided, so that the signature process is simplified, and the signature efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a signature method, apparatus, device, and computer-readable storage medium. Background Art

[0002] Existing ring signature schemes typically use Merkle trees to store the public keys of ring members. Merkle proofs must be called during the ring signature generation process, and both signing and verification contain additional authentication paths, resulting in low computational and communication efficiency.

[0003] Therefore, how to improve the efficiency of ring signatures is a technical problem that those skilled in the art urgently need to solve. Summary of the Invention

[0004] In view of this, the object of the present invention is to provide a ring signature method, apparatus, device, and computer-readable storage medium to solve the technical problem of low efficiency of ring signatures in the prior art.

[0005] To solve the above technical problems, the present invention provides a ring signature method, comprising:

[0006] The prover generates a public-private key pair corresponding to each ring member based on the security parameters;

[0007] The prover constructs a set membership proof protocol based on the public-private key pair corresponding to each ring member, proof of private key ownership, proof of ring membership, and the message to be signed, and determines signature information based on the set membership proof protocol. The proof of private key ownership is a zero-knowledge proof that proves the signer owns the private key. The proof of ring membership is a proof that proves that the public key belongs to a given set of ring member public keys.

[0008] The verifier verifies the signature information and obtains a verification result.

[0009] Optionally, the prover generates a public-private key pair for each ring member based on security parameters, including:

[0010] Determine the security parameter as k;

[0011] Obtaining a private key based on the security parameter, the private key being a value in a set of binary strings of length k;

[0012] A public key is generated based on the security parameter k and the private key through a pseudo-random function, and a public-private key pair corresponding to each ring member is obtained based on the private key and the public key.

[0013] Optionally, before the prover constructs a set membership proof protocol based on the public-private key pair corresponding to each ring member, the private key ownership certificate, the ring membership certificate, and the message to be signed, and determines the signature information based on the set membership proof protocol, the process further includes:

[0014] Determine private key ownership conditions and ring membership conditions;

[0015] Obtaining proof of ownership of the private key based on zero-knowledge proof of multi-party secure computation and the private key ownership condition;

[0016] The ring membership condition is converted into a set membership certificate to obtain the ring membership certificate.

[0017] Optionally, the prover constructs a set membership proof protocol based on the public-private key pair corresponding to each ring member, the private key ownership certificate, the ring membership certificate, and the message to be signed, and determines signature information based on the set membership proof protocol, including:

[0018] The message to be signed, the public-private key pair, member information, and target vector information are used as input, and a set membership proof protocol based on multi-party secure computing is calculated based on the private key ownership proof and the ring membership proof; wherein the member information is the x-th member in the ring member list; and the target vector information is the vector information in the ring membership proof.

[0019] Optionally, taking the message to be signed, the public-private key pair, the member information, and the target vector information as input, and calculating a set membership proof protocol based on multi-party secure computing based on the private key ownership proof and the ring membership proof, includes:

[0020] Based on the private key ownership proof and the ring membership proof, a first equation, a second equation, a third equation, and a fourth equation are constructed; wherein the first equation is an equation for proving that the public key is equal to the public key obtained based on multi-party secure computation; the second equation is an equation for proving the legitimacy of the public key; the third equation is an equation for indicating that the public key belongs to the public key in the public-private key pair corresponding to each ring member; and the fourth equation is an equation for proving that the target vector information is composed of 0 and 1 vectors.

[0021] The first equation, the second equation, the third equation, and the fourth equation are used as proof targets, and the set membership proof protocol is obtained by achieving the proof targets.

[0022] Optionally, taking the first equation, the second equation, the third equation, and the fourth equation as proof targets, and achieving the proof targets to obtain the set membership proof protocol includes:

[0023] Calculate commitment value, challenge value and response value;

[0024] The set membership proof protocol is obtained based on the commitment value, the challenge value, and the response value.

[0025] Optionally, the verifier verifies the signature information and obtains a verification result, including:

[0026] The signature information currently received by the verifier is ;in, For the set membership proof protocol, Information received by MPC participants, The random number used to calculate the commitment value, is the commitment value of the cth MPC participant, and c is the coded value;

[0027] Determine the verification code value corresponding to the information to be signed based on a hash operation method, and compare the verification code value with the code value;

[0028] When the verification code value and the code value are the same, receiving the signature;

[0029] When the verification code value and the code value are not identical, the signature is rejected.

[0030] An embodiment of the present invention further provides a ring signature device, including:

[0031] The public-private key pair generation module is used by the prover to generate the public-private key pair corresponding to each ring member based on the security parameters;

[0032] A signature information determination module is configured for the prover to construct a set membership proof protocol based on the public-private key pair corresponding to each ring member, proof of private key ownership, proof of ring membership, and the message to be signed, and to determine signature information based on the set membership proof protocol; wherein the proof of private key ownership is a method of proving that the signer owns the private key using zero-knowledge proof; and the proof of ring membership is a method of proving that the public key belongs to a given set of ring member public keys;

[0033] The verification module is used by the verifier to verify the signature information and obtain a verification result.

[0034] An embodiment of the present invention further provides a ring signature device, including:

[0035] memory for storing computer programs;

[0036] A processor is configured to execute the computer program to implement the steps of the ring signature method.

[0037] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the ring signature method described above are implemented.

[0038] An embodiment of the present invention further provides a computer program product, including a computer program / instructions, which implement the steps of the above-mentioned ring signature method when executed by a processor.

[0039] It can be seen that the present invention generates a public-private key pair corresponding to each ring member based on security parameters by the prover; the prover constructs a set membership proof protocol based on the public-private key pair corresponding to each ring member, the private key ownership certificate, the ring membership certificate and the message to be signed, and determines the signature information based on the set membership proof protocol; wherein, the private key ownership certificate is a proof method using zero-knowledge proof to prove that the signer owns the private key; the ring membership certificate is a proof method to prove that the public key belongs to a given set of ring member public keys; the verifier verifies the signature information to obtain a verification result.

[0040] The beneficial effects of the embodiments of the present invention are as follows: by utilizing the set membership proof protocol to implement ring membership proof, the requirement for the use of Merkle trees and Merkle proofs in existing ring signatures is circumvented. Since no calculations and equality checks are required, the signing process is simplified, thereby improving the efficiency of signing.

[0041] In addition, the present invention also provides a ring signature device, equipment, and computer-readable storage medium, which also have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0043] Figure 1 A flowchart of a ring signature method provided by an embodiment of the present invention;

[0044] Figure 2 A flowchart illustrating a ring signature method according to an embodiment of the present invention.

[0045] Figure 3 A schematic diagram of the structural framework of a ring signature device provided by an embodiment of the present invention;

[0046] Figure 4 A schematic diagram of the structural framework of a ring signature device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0047] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0048] Some of the terms that appear in the description of the embodiments of this application are subject to the following interpretations:

[0049] Ring signatures are a special digital signature scheme that allows any member of a group to sign a message on behalf of the entire group. External verifiers can only verify the validity of the signature, but cannot determine the identity of the signer. This signature method is anonymous and unforgeable, allowing the signer to conceal their identity while ensuring the validity of the signature. Ring signatures have a wide range of applications in anonymous communications, digital currencies, and other scenarios where user identity protection is required.

[0050] MPC-in-the-head (MPCitH) is a technical approach within multi-party computation (MPC) that aims to preserve privacy during computation while reducing or eliminating the reliance on external protocols and communications in traditional MPC protocols. MPCitH transforms multi-party secure computation into a single-party computation (performed in the head). Specifically, it transforms complex multi-party computation tasks into mental computations through specific protocols (such as hybrid protocols and pseudo-random functions), eliminating the need for complex interactions between parties. MPCitH allows computations and operations within certain MPC protocols to appear to rely solely on a single participant, while still maintaining the security and privacy of multi-party computation. Constructing zero-knowledge proofs based on MPCitH improves computational efficiency while protecting privacy.

[0051] Set Membership Proof is a zero-knowledge proof protocol used to prove that an element belongs to a specific public set without revealing the specific element. In short, it allows the prover to prove that a specific element belongs to a set without directly revealing the element's information. This type of proof is widely used in fields such as privacy protection, identity verification, and blockchain.

[0052] Please refer to Figure 1 , Figure 1 This is a flow chart of a ring signature method provided by an embodiment of the present invention. The method may include:

[0053] S101: The prover generates a public-private key pair corresponding to each ring member based on security parameters.

[0054] The prover in this embodiment refers to the party that possesses the secret information. Its core task is to prove to the verifier that it actually possesses the secret without revealing the secret itself. The security parameter in this embodiment is the core indicator for measuring the security strength of the system. It determines key design factors such as the key length and the complexity of the difficulty problem. It can be understood that when generating a key, the security parameter k is input and the output is: the public and private key pair of each ring member ,in , the corresponding public key , represents a string of all zeros with a length of k. Determined by the number of ring members, PRF stands for pseudo-random function.

[0055] It should be further explained that, based on any of the above embodiments, the prover generates a public-private key pair corresponding to each ring member based on the security parameters, which may include:

[0056] S1011, determining the security parameter to be k;

[0057] S1012, obtaining a private key based on the security parameter, where the private key is a value in a set of binary strings of length k;

[0058] S1013: Generate a public key using a pseudo-random function based on the security parameter k and the private key, and obtain a public-private key pair corresponding to each ring member based on the private key and the public key.

[0059] This embodiment provides a specific process for generating a public-private key pair corresponding to each ring member based on security parameters, thereby improving the accuracy of generating the public-private key pair.

[0060] S102: The prover constructs a set membership proof protocol based on the public-private key pair, private key ownership proof, ring membership proof, and the message to be signed corresponding to each ring member, and determines the signature information based on the set membership proof protocol; wherein, the private key ownership proof is a method of proving that the signer owns the private key using zero-knowledge proof; and the ring membership proof is a method of proving that the public key belongs to a given set of ring member public keys.

[0061] The private key ownership proof in this embodiment is a method of proving that the signer owns the private key using zero-knowledge proof; the ring membership proof is a method of proving that the public key belongs to a given set of ring member public keys. This embodiment does not limit the specific private key ownership proof. For example, the private key ownership proof in this embodiment can be a zero-knowledge proof based on MPCitH; or the private key ownership proof in this embodiment can be a zero-knowledge proof based on range proof. This embodiment does not limit the specific ring membership proof. For example, the ring membership proof in this embodiment can be a non-interactive set membership proof; or the ring membership proof in this embodiment can be an interactive set membership proof. This embodiment determines the signature information generation process based on the set membership proof protocol to obtain the signature information.

[0062] It should be further explained that, based on any of the above embodiments, the above prover constructs a set membership proof protocol based on the public-private key pair, private key ownership certificate, ring membership certificate and message to be signed corresponding to each ring member, and before determining the signature information based on the set membership proof protocol, it may also include: determining the private key ownership condition and the ring membership condition; obtaining the private key ownership certificate based on the zero-knowledge proof and private key ownership condition of multi-party secure computing; converting the ring membership condition into a set membership certificate to obtain the ring membership certificate. This embodiment The embodiment of the present invention proposes a ring signature method based on MPC-in-the-head (multi-party secure computing) technology. Assuming that a ring member wants to generate a ring signature on behalf of a group of ring members, in order to avoid leaking his or her own identity information, he or she needs to prove the following two key conditions in a zero-knowledge manner: Private key ownership: The signer can prove that he or she owns the private key ,satisfy , where k is a security parameter, is a pseudo-random function, Represents a zero string of length k. Ring membership: The signer needs to prove his public key The set of public keys belonging to a given ring member Among them, the private key ownership proof can be completed through the zero-knowledge proof based on MPCitH, and the ring membership proof task can be transformed into a set membership proof. Specifically, ;remember is a vector consisting of 0s and 1s, with only one component being 1, and T represents transpose. The signer also needs to prove that: ; ,in, represents bitwise multiplication, express This embodiment provides a specific method for constructing a private key ownership certificate and a ring membership certificate, thereby improving the accuracy of the construction.

[0063] It should be further explained that, based on any of the above embodiments, the above prover constructs a set membership proof protocol based on the public-private key pair, private key ownership certificate, ring membership certificate and the message to be signed corresponding to each ring member, and determines the signature information based on the set membership proof protocol, which may include: taking the message to be signed, the public-private key pair, member information and target vector information as input, and calculating the set membership proof protocol based on multi-party secure computing based on the private key ownership certificate and the ring membership certificate; wherein the member information is the xth member in the ring member list; the target vector information is the vector information in the ring membership certificate. In this embodiment, the input is the message to be signed M, the ring member list , and a signer's private key ; Construct the proof of set membership: Based on the public-private key pair, private key ownership proof, and ring membership proof above, the prover (i.e., the signer)’s secret input is i, and the private key and vector V, the public input is , computing a non-interactive set membership proof protocol based on MPCitH The set membership proof protocol in this embodiment is a non-interactive set membership proof protocol. This embodiment provides a specific process for obtaining the set membership proof protocol, thereby improving the accuracy of determining the set membership proof protocol.

[0064] It should be further explained that, based on any of the above embodiments, the above-mentioned set membership proof protocol based on multi-party secure computation and taking the message to be signed, the public-private key pair, the member information, and the target vector information as input and computing the set membership proof based on private key ownership proof and ring membership proof may include:

[0065] Step 1: Based on the proof of private key ownership and ring membership, construct the first, second, third, and fourth equations. The first equation is used to prove that the public key is equal to the public key obtained based on multi-party secure computation; the second equation is used to prove that the public key is legitimate; the third equation is used to prove that the public key belongs to the public-private key pair corresponding to each ring member; and the fourth equation is used to prove that the target vector information is composed of 0 and 1 vectors.

[0066] Step 2: Take the first, second, third, and fourth equations as proof targets, and achieve the proof targets to obtain the set membership proof protocol.

[0067] In this embodiment, it is assumed that the prover simulates the number of MPC participants n. The prover calculates the secret share of the secret input as follows: Secret sharing share : Random selection Make ; Secret sharing share : Random selection Make ; Secret sharing share : Random selection Make ; Secret sharing share : The prover uses the MPC algorithm Compute the MPCitH-based non-interactive set membership proof protocol for the following relations: . It refers to an MPC algorithm, where j is the number of participants among n; represents and, where the first equation is , used to prove It is legal The second equation is , used to prove is one of the public key sets; the third equation is , used to prove that vector Composed of 0 and 1, the fourth equation , used to prove that vector Only one component of is 1. The proof target of the set membership proof protocol in this embodiment is 4 equations.

[0068] It should be further explained that, based on any of the above embodiments, the first, second, third and fourth equations are used as proof targets, and the proof targets are achieved to obtain the set membership proof protocol, which may include: calculating the commitment value, the challenge value and the response value; and obtaining the set membership proof protocol based on the commitment value, the challenge value and the response value. All information obtained in the agreement is , the prover chooses a random value , for all Calculating Commitment Value . For the i-th participant All information obtained in the MPC protocol; a random value is selected for each PI; Represents a commitment algorithm. Calculate the challenge value: the prover calculates , where H is a hash function, and the output of the hash function is encoded as M is the message to be signed, c is any number from 1 to n, and the challenge value is c. Calculate the response value: , the prover outputs 、 、 Output Signatures: Non-Interactive Set Membership Proof Protocol , π is the signature value (signature information). This embodiment provides a specific process for obtaining signature information, thereby improving the accuracy of determining signature information.

[0069] S103: The verifier verifies the signature information and obtains a verification result.

[0070] In this embodiment, the verifier verifies the signature information and obtains a verification result. This means that the verifier reconstructs the verification equation based on the information in the signature information, determines whether the recalculated challenge value is the same as the challenge value in the signature information, and verifies the result. The verification result in this embodiment can include acceptance of the signature and rejection of the signature.

[0071] It should be further explained that, based on any of the above embodiments, the above verifier verifies the signature information and obtains the verification result, which may include:

[0072] S1031, the signature information received by the current verifier is ;in, For the set membership proof protocol, Information received by MPC participants, The random number used to calculate the commitment value, is the commitment value of the cth MPC participant, and c is the coded value;

[0073] S1032, determining a verification code value corresponding to the information to be signed based on a hash operation method, and comparing the verification code value with the code value;

[0074] S1033, when the verification code value and the code value are the same, the signature is received;

[0075] S1034: When the verification code value and the code value are not the same, the signature is rejected.

[0076] In this embodiment, the verifier verifies the correctness of the zero-knowledge proof, thereby determining the legitimacy of the signature. If the π verification passes, the signature is accepted, otherwise it is rejected. For example, input: signature Message to be signed , Ring member public key list ; The output is 0 or 1. The specific process of verification may include: the verifier calculates , combined with the calculation, the output result of the hash function is encoded as, if, then the verification passes and output 1, otherwise the verification fails and output 0.

[0077] A ring signature method provided by an embodiment of the present invention may include: S101, a prover generates a public-private key pair corresponding to each ring member based on security parameters; S102, the prover constructs a set membership proof protocol based on the public-private key pair corresponding to each ring member, proof of private key ownership, proof of ring membership, and the message to be signed, and determines signature information based on the set membership proof protocol; wherein the proof of private key ownership is a zero-knowledge proof method that proves that the signer possesses the private key; and the proof of ring membership is a method that proves that the public key belongs to a given set of ring member public keys; S103, a verifier verifies the signature information and obtains a verification result. Existing ring signature schemes typically use Merkle trees to store ring member public keys. Merkle proofs must be invoked during the ring signature generation process, and both signing and verification involve additional authentication paths, resulting in low computational and communication efficiency. By utilizing the set membership proof protocol to implement ring member identity proof, the need for Merkle trees and Merkle proofs in existing ring signatures is avoided. Since computation and equality checks are not required, the signing process is simplified, thereby improving signature efficiency.

[0078] In order to make the present invention easier to understand, please refer to Figure 2 , Figure 2 A flowchart illustrating a ring signature method according to an embodiment of the present invention may include:

[0079] S201, the prover determines the private key ownership condition and the ring membership condition.

[0080] It should be noted that the names mentioned in this embodiment have the same meanings as those described above.

[0081] S202: The prover obtains proof of private key ownership based on the zero-knowledge proof of multi-party secure computation and the private key ownership condition.

[0082] S203: The prover converts the ring membership condition into a set membership certificate to obtain a ring membership certificate.

[0083] S204: The prover generates a public-private key pair corresponding to each ring member based on the security parameters.

[0084] S205 , the prover determines the first equation, the second equation, the third equation, and the fourth equation based on the public-private key pair, the set membership certificate, the ring membership certificate, and the message to be signed.

[0085] S206: The prover obtains a non-interactive set membership proof protocol based on multi-party secure computation based on the first, second, third and fourth equations as proof targets, and obtains signature information based on the non-interactive set membership proof protocol.

[0086] S207: The verifier verifies the signature information and obtains the verification result.

[0087] This embodiment of the present invention utilizes a non-interactive set membership proof protocol to authenticate ring membership, eliminating the need for Merkle trees and Merkle proofs. The ring signature task is decomposed into proof of the signer's private key ownership and proof of ring membership, which can be accomplished using MPCitH technology. In a ring signature scheme, the security of the underlying cryptographic components does not rely on traditional hard problem assumptions, thus providing quantum security. Ring membership proof does not require the use of Merkle trees or Merkle proofs, improving computational efficiency.

[0088] The following describes a ring signature apparatus provided in an embodiment of the present invention. The ring signature apparatus described below and the ring signature method described above can be referenced in conjunction with each other.

[0089] Please refer to Figure 3 , Figure 3 A schematic diagram of the structural framework of a ring signature device provided in an embodiment of the present invention may include:

[0090] The public-private key pair generation module 100 is used by the prover to generate a public-private key pair corresponding to each ring member based on security parameters;

[0091] The signature information determination module 200 is configured for the prover to construct a set membership proof protocol based on the public-private key pair corresponding to each ring member, the private key ownership certificate, the ring membership certificate, and the message to be signed, and to determine the signature information based on the set membership proof protocol. The private key ownership certificate is a zero-knowledge proof method that proves that the signer owns the private key. The ring membership certificate is a proof method that proves that the public key belongs to a given set of ring member public keys.

[0092] The verification module 300 is used by a verifier to verify the signature information and obtain a verification result.

[0093] It should be further explained that, based on any of the above embodiments, the public-private key pair generation module 100 may include:

[0094] a security parameter determining unit, configured to determine the security parameter as k;

[0095] a private key determination unit, configured to obtain a private key based on the security parameter, the private key being a value in a set of binary character strings of length k;

[0096] The public key determining unit is configured to generate a public key based on the security parameter k and the private key through a pseudo-random function, and obtain a public-private key pair corresponding to each ring member based on the private key and the public key.

[0097] Furthermore, based on any of the above embodiments, the ring signature device may further include:

[0098] A condition determination module for determining private key ownership conditions and ring membership conditions;

[0099] A private key ownership proof determination module, configured to obtain the private key ownership proof based on zero-knowledge proof of multi-party secure computing and the private key ownership condition;

[0100] The ring membership certificate determination module is used to convert the ring membership condition into a set membership certificate to obtain the ring membership certificate.

[0101] Further, based on any of the above embodiments, the signature information determination module 200 may include:

[0102] A set membership proof protocol determining unit is configured to take the message to be signed, the public-private key pair, member information, and target vector information as input, and calculate a set membership proof protocol based on multi-party secure computing based on the private key ownership proof and the ring membership proof; wherein the member information is the x-th member in the ring member list; and the target vector information is the vector information in the ring membership proof.

[0103] Furthermore, based on any of the above embodiments, the set membership proof protocol determination unit may include:

[0104] an equation determination subunit, configured to construct a first equation, a second equation, a third equation, and a fourth equation based on the private key ownership certificate and the ring membership certificate; wherein the first equation is an equation for proving that the public key is equal to the public key obtained based on multi-party secure computation; the second equation is an equation for proving the legitimacy of the public key; the third equation is an equation for indicating that the public key belongs to the public key in the public-private key pair corresponding to each ring member; and the fourth equation is an equation for proving that the target vector information is composed of 0 and 1 vectors;

[0105] The proof target determination subunit is configured to take the first equation, the second equation, the third equation, and the fourth equation as proof targets, and achieve the proof targets to obtain the set membership proof protocol.

[0106] Further, based on any of the above embodiments, the proof target determination subunit may include:

[0107] A commitment value, challenge value and response value determination subunit, used for calculating the commitment value, challenge value and response value;

[0108] The set membership proof protocol determination subunit is used to obtain the set membership proof protocol based on the commitment value, the challenge value and the response value.

[0109] Furthermore, based on any of the above embodiments, the verification module 300 may include:

[0110] The signature information determination unit is used to determine whether the signature information currently received by the verifier is ;in, For the set membership proof protocol, Information received by MPC participants, The random number used to calculate the commitment value, is the commitment value of the cth MPC participant, and c is the coded value;

[0111] a comparing unit, configured to determine a verification code value corresponding to the information to be signed based on a hash operation method, and compare the verification code value with the code value;

[0112] a signature receiving unit, configured to receive a signature when the verification code value and the code value are identical;

[0113] The signature rejection unit is used to reject the signature when the verification code value is different from the code value.

[0114] It should be noted that the order of the modules and units in the above ring signature device can be changed without affecting the logic.

[0115] A ring signature device provided by an embodiment of the present invention may include: a public-private key pair generation module 100, for a prover to generate a public-private key pair corresponding to each ring member based on security parameters; a signature information determination module 200, for the prover to construct a set membership proof protocol based on the public-private key pair corresponding to each ring member, a private key ownership certificate, a ring membership certificate, and a message to be signed, and to determine signature information based on the set membership proof protocol; wherein the private key ownership certificate is a method of proving that the signer owns the private key using zero-knowledge proof; the ring membership certificate is a method of proving that the public key belongs to a given set of ring member public keys; and a verification module 300, for the verifier to verify the signature information and obtain a verification result. By utilizing the set membership proof protocol to implement ring member identity proof, the need for existing ring signatures to use Merkle trees and Merkle certificates is circumvented. Since calculation and equality verification are not required, the signature process is simplified, thereby improving signature efficiency.

[0116] The following describes a ring signature device provided by an embodiment of the present invention. The ring signature device described below and the ring signature method described above can be referenced in conjunction with each other.

[0117] Please refer to Figure 4 , Figure 4 A schematic diagram of the structural framework of a ring signature device provided in an embodiment of the present invention may include:

[0118] Memory 10, for storing computer programs;

[0119] The processor 20 is configured to execute a computer program to implement the above-mentioned ring signature method.

[0120] The memory 10 , the processor 20 , and the communication interface 30 all communicate with each other via a communication bus 40 .

[0121] In the embodiment of the present invention, the memory 10 is used to store one or more programs. The program may include program code, and the program code includes computer operation instructions. In the embodiment of the present invention, the memory 10 may store programs for implementing the following functions:

[0122] The prover generates a public-private key pair corresponding to each ring member based on the security parameters;

[0123] The prover constructs a set membership proof protocol based on the public-private key pair corresponding to each ring member, proof of private key ownership, proof of ring membership, and the message to be signed. The prover then determines the signature information based on the set membership proof protocol. The proof of private key ownership uses zero-knowledge proof to prove that the signer owns the private key. The proof of ring membership proves that the public key belongs to a given set of ring member public keys.

[0124] The verifier verifies the signature information and obtains the verification result.

[0125] In one possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function, etc.; the data storage area may store data created during use.

[0126] In addition, the memory 10 may include a read-only memory and a random access memory, and provides instructions and data to the processor. A portion of the memory may also include NVRAM. The memory stores an operating system and operating instructions, executable modules or data structures, or a subset or an extended set thereof. The operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and processing hardware-based tasks.

[0127] The processor 20 may be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field programmable gate array, or other programmable logic device. The processor 20 may be a microprocessor or any conventional processor. The processor 20 may call a program stored in the memory 10 .

[0128] The communication interface 30 may be an interface of a communication module, and is used to connect to other devices or systems.

[0129] Of course, it needs to be explained that Figure 4 The structure shown does not constitute a limitation on the ring signature device in the embodiment of the present invention. In actual applications, the ring signature device may include Figure 4 More or fewer components than shown, or combinations of certain components.

[0130] The following describes a computer-readable storage medium provided in an embodiment of the present invention. The computer-readable storage medium described below and the ring signature method described above can be referenced in correspondence with each other.

[0131] The present invention also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the above-mentioned ring signature method are implemented.

[0132] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., which can store program codes.

[0133] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0134] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0135] Finally, it should be noted that, in this document, relationships such as first and second, etc., are used solely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0136] The above describes in detail the ring signature method, apparatus, device, and computer-readable storage medium provided by the present invention. Specific examples are used herein to illustrate the principles and implementations of the present invention. The description of the above embodiments is intended only to facilitate understanding of the method and core concepts of the present invention. Furthermore, those skilled in the art will appreciate that variations in the specific implementations and scope of application are possible based on the concepts of the present invention. Therefore, this specification should not be construed as limiting the present invention.

Claims

1. A ring signature method, characterized in that: include: The prover generates a public-private key pair corresponding to each ring member based on the security parameters; The prover constructs a set membership proof protocol based on the public-private key pair corresponding to each ring member, proof of private key ownership, proof of ring membership, and the message to be signed, and determines signature information based on the set membership proof protocol. The proof of private key ownership is a zero-knowledge proof that proves the signer owns the private key. The proof of ring membership is a proof that proves that the public key belongs to a given set of ring member public keys. The verifier verifies the signature information and obtains a verification result.

2. The ring signature method according to claim 1, wherein: The prover generates a public-private key pair for each ring member based on security parameters, including: Determine the security parameter as k; Obtaining a private key based on the security parameter, the private key being a value in a set of binary strings of length k; A public key is generated based on the security parameter k and the private key through a pseudo-random function, and a public-private key pair corresponding to each ring member is obtained based on the private key and the public key.

3. The ring signature method according to claim 1, wherein: Before the prover constructs a set membership proof protocol based on the public-private key pair corresponding to each ring member, the private key ownership certificate, the ring membership certificate, and the message to be signed, and determines the signature information based on the set membership proof protocol, the method further includes: Determine private key ownership conditions and ring membership conditions; Obtaining proof of ownership of the private key based on zero-knowledge proof of multi-party secure computation and the private key ownership condition; The ring membership condition is converted into a set membership certificate to obtain the ring membership certificate.

4. The ring signature method according to any one of claims 1 to 3, characterized in that The prover constructs a set membership proof protocol based on the public-private key pair corresponding to each ring member, the private key ownership certificate, the ring membership certificate, and the message to be signed, and determines the signature information based on the set membership proof protocol, including: The message to be signed, the public-private key pair, member information, and target vector information are used as input, and a set membership proof protocol based on multi-party secure computing is calculated based on the private key ownership proof and the ring membership proof; wherein the member information is the x-th member in the ring member list; and the target vector information is the vector information in the ring membership proof.

5. The ring signature method according to claim 4, wherein: The method includes taking the message to be signed, the public-private key pair, the member information, and the target vector information as input, and calculating a set membership proof protocol based on multi-party secure computing based on the private key ownership proof and the ring membership proof, including: Based on the private key ownership proof and the ring membership proof, a first equation, a second equation, a third equation, and a fourth equation are constructed; wherein the first equation is an equation for proving that the public key is equal to the public key obtained based on multi-party secure computation; the second equation is an equation for proving the legitimacy of the public key; the third equation is an equation for indicating that the public key belongs to the public key in the public-private key pair corresponding to each ring member; and the fourth equation is an equation for proving that the target vector information is composed of 0 and 1 vectors. The first equation, the second equation, the third equation, and the fourth equation are used as proof targets, and the set membership proof protocol is obtained by achieving the proof targets.

6. The ring signature method according to claim 5, wherein: Taking the first equation, the second equation, the third equation, and the fourth equation as proof targets, achieving the proof targets to obtain the set membership proof protocol includes: Calculate commitment value, challenge value and response value; The set membership proof protocol is obtained based on the commitment value, the challenge value, and the response value.

7. The ring signature method according to claim 1, wherein: The verifier verifies the signature information and obtains a verification result, including: The signature information currently received by the verifier is ;in, For the set membership proof protocol, Information received by MPC participants, The random number used to calculate the commitment value, is the commitment value of the cth MPC participant, and c is the coded value; Determine the verification code value corresponding to the information to be signed based on a hash operation method, and compare the verification code value with the code value; When the verification code value and the code value are the same, receiving the signature; When the verification code value and the code value are not identical, the signature is rejected.

8. A ring signature device, characterized in that: include: The public-private key pair generation module is used by the prover to generate the public-private key pair corresponding to each ring member based on the security parameters; A signature information determination module is configured for the prover to construct a set membership proof protocol based on the public-private key pair corresponding to each ring member, proof of private key ownership, proof of ring membership, and the message to be signed, and to determine signature information based on the set membership proof protocol; wherein the proof of private key ownership is a method of proving that the signer owns the private key using zero-knowledge proof; and the proof of ring membership is a method of proving that the public key belongs to a given set of ring member public keys; The verification module is used by the verifier to verify the signature information and obtain a verification result.

9. A ring signature device, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program to implement the steps of the ring signature method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the ring signature method according to any one of claims 1 to 7.

Images