New SM2 ring signature scheme with revocable and anonymity

Abstract

The invention relates to the technical field of identity authentication and information security, in particular to an SM2 ring signature scheme with revocable and anonymity. According to the scheme, the data can be digitally signed while the privacy security of a signer is protected, and any user can verify the correctness of the digital signature. In addition, identity tracking is performed on the signer of the dishonor, the identity of the dishonor is exposed, and the possibility of occurrence of the dishonor behavior is reduced. When a signer executes a signature process, the signer must firstly send a unique identity tag ID to a third party, and the third party adds the ID into a set L and returns a signature parameter R to the signer. And the signer executes an SM2 ring signature algorithm with revocation and anonymity by using the R to generate a digital signature and a revocation label. And the user requests to use the data, discovers that the data has problems in the use process, requests the third party to cancel the anonymity of the signer, executes a signature cancel algorithm by using a cancel label, and returns the identity of the signer, so that the real signer is exposed.

Description

Technical Field

[0001] The present invention relates to the field of identity authentication and information security technology, and more particularly to the protection of the privacy of signers and the tracking of the identities of malicious signers. Background Art

[0002] In modern digital communications and privacy protection, personal privacy and data security face increasingly severe challenges. Digital signatures, as a key security mechanism, are widely used in areas such as protecting data integrity, identity authentication, and information security. However, many existing scenarios involve personal privacy or sensitive information, making anonymity a crucial requirement in information exchange. The unconditional anonymity of ring signatures provides this guarantee, leading to their widespread use. However, this unconditional anonymity is susceptible to malicious use and can lead to misconduct, thus often facing challenges in credibility and accountability.

[0003] In order to prevent excessive anonymity, Fujisaki et al. designed the first traceable ring signature scheme, which uses labels to restrict ring members and expresses anonymous opinions on issues once. If anonymous opinions are expressed on other issues, the identity will be immediately exposed. Zhang et al. used the characteristics of linkable ring signatures to compare the results of signing different messages with the same ring, expose the signer and store it in a collection, and combined it with the blockchain evidence storage system to execute the tracking algorithm when tracking illegal data. However, some special situations cannot be achieved in actual applications based on linkable ring signatures. In the ring signature without a trusted center, Sun et al. used its anonymity and added some information related to the ring members. If necessary, the true identity of the signer can be tracked through the collaboration of all nodes in the ring. Cheng et al. proposed an identity-based deniable ring signature with a constant size to solve the problems caused by insecure accumulators.

[0004] With the continuous development of national cryptographic technology, domestic cryptography has also proposed a number of ring signature schemes and applications. Han et al., leveraging the properties of one-way functions, proposed the design and research of a ring signature scheme based on the SM2 cryptographic algorithm. Fan et al. proposed a ring signature algorithm and a linkable ring signature for SM2 digital signatures, and also introduced two variants of the SM2 linkable ring signature scheme. The communication and computational complexity of this scheme are both linearly proportional to the number of ring members. Bao et al., in a deniable ring signature, allow ring members to confirm or deny their identity as the signer of the signature without a trusted third party, thus achieving signer confirmation in an interactive manner. Peng et al. proposed a ring signature scheme based on the SM9 identity cryptography algorithm, maintaining the consistency between the user's signature key and the SM9 key generation method. Deng et al. proposed a threshold ring signature scheme based on the national cryptographic SM9 algorithm, improving signature efficiency through threshold values. Summary of the Invention

[0005] This paper introduces a revocable and anonymous SM2 ring signature. Its entities include the signer, a third party, and the user. By introducing a third party to interact with the signer to generate important parameters, this provides evidence for the subsequent anonymity revocation algorithm. Next, when the user requests to reveal the identity of the malicious signer, the third party matches the evidence stored during the interaction to reveal the malicious signer's identity, thereby better protecting the interests of other legitimate signers.

[0006] The object of the present invention is achieved through the following family plan: Step 1: In the initialization phase, input security parameters and output system common parameters; Step 2: In the key generation phase, the user key pair is calculated based on the system parameters; Step 3: During the signer identity tag generation phase, the user sends the unique identity to the third party, which stores the identity in the collection and returns the signature parameters to the user. Step 4: In the signing phase, the signer randomly selects the public keys of (n-1) individuals and the important parameters returned by the third party, performs the signing process on the proxy-signed message, and outputs the signature result; Step 5: In the verification phase, the verifier verifies the obtained signature result. If the conditions are met, the verification succeeds, otherwise it fails. Step 6: During the anonymity revocation phase, the third party uses the revocation tag to execute the anonymity revocation algorithm to arbitrate the true signer, revealing the true signer's identity. In addition, any user can verify whether the revocation was executed by the third party using the third party's public key. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0008] Figure 1 This is a schematic diagram of the SM2 ring signature scheme system with revocability and anonymity according to an embodiment of the present invention. Figure 2 Flowchart of the present invention. Specific implementation

[0009] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, and do not constitute a limitation of the present invention. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0010] Figure 1 This is a schematic diagram of a system for a revocable and anonymous SM2 ring signature scheme according to an embodiment of the present invention. The steps include: 1) Initialize system parameters: input system parameters λ, output system parameters Where p is a large prime number, E(F p ) is defined in the finite field F p The elliptic curve on the elliptic curve, the points that satisfy the equation form an Abelian group of order q G is the group The base point, H1: It is a secure hash function. 2) Key generation: User U i Random selection As its private key and keep it secret, calculate pk i =d i G as user U i Output the public-private key pair (pk i ,d i ). 3) Signer identity tag generation: The signer π will uniquely identify the ID π Pass it to a third party, and the third party will use the ID π Put it into the set L, and use a secure hash function (for example: National Secret SM3) to identify the signer π Perform hash calculation to get Q=H3(ID π ), and then use the third-party private key tpk to calculate the signature to get R = TS tspk (Q), returns R to the signer as an important signature parameter. 4) Signature: The signer π spontaneously selects the public keys of (n-1) individuals and adds his own public key to form a public key set PK = {pk1, pk2, .... pk n}, d π For the signer's private key, the following algorithm is performed on the signed message m: A. Generate random numbers Calculate c π+1 =H1(PK,R,m,k π G); B. For i = π+1,···,n,1,···,π-1, perform the following operations in sequence: Generate random numbers Calculate Z i =s i ·G+(s i +c i )·pk i , c i+1 =H1(PK,R,m,Z i ), let c1=c n+1 ; C. Calculate the signature value s π =((1+d π ) -1 ·(k π -c π ·d π ))modp; D. Output the signature value σ of message m on PK PK (m)=(c1,s1,s2,···,s n ). 5) Verification: The verifier receives the message m' and the ring signature value σ'=(c'1,s'1,...,s' n ), first verify Is it true? If not, the verification fails. Otherwise, for i=1,2,···,n, calculate Z' in sequence i =s' i ·G+(s' i +c' i )·pk i , c' i+1 =H1(PK,R,m,Z' i ), check c'1 = c' n+1 If they are equal, the verification succeeds, otherwise it fails. 6) Anonymity revocation: The third party generates a revocation tag tag = (σ, R) based on the signature value and important parameters. When the user requests arbitration for illegal data provided by the signer, the third party uses its own public key tpk to verify the signature of R and obtains Q = TV tpk (R), any user can also verify whether the third party is malicious, and then the third party judges the hash value through the set L Tracking, if they are equal, j is the signer π, thus exposing its ID. This scheme is based on elliptic curves. It ensures anonymity while preventing excessive anonymity and exposing the identity of malicious signers, thus protecting user privacy and enabling arbitration for malicious signers.

Claims

1. A new SM2 ring signature scheme with revocability and anonymity, characterized by: The techniques include: Step 1: In the initialization phase, input security parameters and output system common parameters; Step 2: In the key generation phase, the user key pair is calculated based on the system parameters; Step 3: During the signer identity tag generation phase, the user sends the unique identity to the third party, which stores the identity in the collection and returns the signature parameters to the signer. Step 4: In the signing phase, the signer randomly selects the public keys of (n-1) individuals and the important parameters returned by the third party, executes the signing process on the message to be signed, and outputs the signature result; Step 5: In the verification phase, the verifier verifies the obtained signature result. If the conditions are met, the verification succeeds, otherwise it fails. Step 6: During the anonymity revocation phase, the third party uses the revocation tag to execute the anonymity revocation algorithm to arbitrate the true signer, revealing the true signer's identity. In addition, any user can verify whether the revocation was executed by the third party using the third party's public key.

2. The SM2 ring signature scheme with revocability and anonymity according to claim 1, characterized in that: The process of step 1 is specifically as follows: First initialize the system, input the system parameter λ, and output the system parameter Where p is a large prime number, E(F p ) is defined in the finite field F p The elliptic curve on the elliptic curve, the points that satisfy the equation form an Abelian group of order q G is the group The base point, It is a secure hash function.

3. The SM2 ring signature scheme with revocability and anonymity according to claim 1, characterized in that: The process of step 2 is specifically as follows: User U i Random selection As its private key and keep it secret, calculate pk i =d i G as user U i Output the public-private key pair (pk i ,d i ).

4. The SM2 ring signature scheme with revocability and anonymity according to claim 1, characterized in that: The process of step 3 is specifically as follows: The signer π will uniquely identify the ID π Pass it to a third party, and the third party will use the ID π Put it into the set L, and use a secure hash function (for example: National Secret SM3) to identify the signer π Perform hash calculation to get Q=H3(ID π ), and then use the third-party private key tpk to calculate the signature to get R = TS tspk (Q), returns R to the signer as an important signature parameter.

5. The SM2 ring signature scheme with revocability and anonymity according to claim 1, characterized in that: The process of step 4 is specifically as follows: The signer π spontaneously selects the public keys of (n-1) individuals and adds his own public key to form the public key set PK = {pk1, pk2, .... pk n }, d π For the signer's private key, the following algorithm is performed on the signed message m: (1) Generate random numbers Calculate c π+1 =H1(PK,R,m,k π G); (2) For i = π+1, ···, n, 1, ···, π-1, perform the following operations in sequence: Generate random numbers Calculate Z i =s i ·G+(s i +c i )·pk i , c i+1 =H1(PK,R,m,Z i ), let c1=c n+1 ; (3) Calculate the signature value s π =((1+d π ) -1 ·(k π -c π ·d π ))modp; (4) Output the signature value σ of message m on PK PK (m)=(c1,s1,s2,···,s n ).

6. The SM2 ring signature scheme with revocability and anonymity according to claim 1, characterized in that: The process of step 5 is specifically as follows: The verifier receives the message m' and the ring signature value σ'=(c'1,s'1,...,s' n ), first verify Is it true? If not, the verification fails. Otherwise, for i=1,2,···,n, calculate Z' in sequence i =s' i ·G+(s' i +c' i )·pk i , c' i+1 =H1(PK,R,m,Z' i ), check c'1 = c' n+1 If they are equal, the verification succeeds, otherwise it fails.

7. The SM2 ring signature scheme with revocability and anonymity according to claim 1, characterized in that: The process of step 6 is specifically as follows: The third party generates a revocation tag tag = (σ, R) based on the signature value and important parameters. When the data user requests arbitration on the data provided by the signer, the third party uses its own public key tpk to verify R and obtain Q = TV tpk (R), any user can also verify whether the third party is malicious, and then the third party judges the hash value through the set L Tracking, if they are equal, j is the signer π, thus exposing its ID.

Images