Group signature method based on trusted execution environment

Abstract

The invention relates to the field of cryptography and network security, and discloses a group signature method based on a trusted execution environment, which comprises the following steps of: S1, performing identity authentication and secure session key negotiation between communication participants, and verifying the integrity of the trusted execution environment of a group administrator; s2, the group administrator generates a public parameter of the group signature system and a private key of the group administrator in the trusted execution environment, and encrypts and stores the private key; and S3, the group administrator receives a join application of a new member, generates exclusive private key information of the new member and a unique identifier of the exclusive private key information based on the application in the trusted execution environment, and encrypts and returns the unique identifier to the new member. According to the technical scheme, generation and storage of a group administrator private key and a group member private key and key cryptographic operation are performed in a trusted execution environment, so that the technical effect of enhancing the security of the key is achieved.

Description

Technical Field

[0001] This invention relates to the fields of cryptography and network security, specifically to a group signature method based on a trusted execution environment. Background Technology

[0002] While existing group signature technologies offer some degree of member anonymity and signature verifiability, they still face numerous challenges in practical applications. Current mainstream group signature methods generally lack hardware-level security safeguards, relying primarily on software-level protection. This architecture leads to multiple potential risks and inherent security vulnerabilities.

[0003] First, the security of member private key storage is a major weakness of existing solutions. In most implementations, group members' private keys are stored directly on local devices. This makes the private keys highly vulnerable to malware, viruses, or direct theft by attackers. Once a private key is compromised, an attacker can impersonate a legitimate member to sign, thereby forging the group signature and directly undermining the unforgeability and overall security of the group signature system.

[0004] Secondly, the system's heavy reliance on key management poses a significant risk to its security. The security of existing group signature systems largely depends on the proper management of each group member's personal signing key. If any group member's signing key is leaked due to mismanagement or compromise, an attacker can use the leaked key to forge signatures, thereby jeopardizing the credibility and security of the entire group signature system. This means that the security boundary of the entire group signature system is often determined by its weakest link: key management.

[0005] Furthermore, the security is limited to the software layer, lacking physical hardware security protection. Currently, most group signature systems' security measures are limited to the operating system and application software layers. This means that once an attacker successfully breaches these software-level protection mechanisms—for example, by exploiting operating system vulnerabilities, performing privilege escalation, or injecting code—they can directly access and tamper with sensitive data, or even completely control the signing process. This purely software-dependent security is easily bypassed and cannot effectively defend against more advanced and complex attacks.

[0006] Furthermore, vulnerabilities in the operating system or runtime environment can lead to key leakage or signature tampering. The security of core cryptographic operations such as group signature generation and verification is highly dependent on the integrity and reliability of the underlying operating system. If the operating system itself has vulnerabilities, attackers may use system-level intrusion methods, such as buffer overflows, format string vulnerabilities, or driver defects, to bypass existing security mechanisms and obtain the signing keys of group members. Alternatively, they could inject malicious code during the signing process to interfere with or tamper with the signing results, causing the signature to become invalid or misused.

[0007] Finally, and a core limitation of existing technology, is the lack of proof of trusted execution in the computation process. Traditional computing environments cannot provide mechanisms similar to Trusted Execution Environments (TEEs) to prove whether a specific program or operation is executed in an untampered environment. This means we cannot ensure that every group signature operation is performed in a completely trusted and uncontaminated execution environment. This uncertainty leaves a huge attack window for attackers, who can inject malicious code, modify intermediate computation results, or even forge the final group signature without leaving any traceable evidence. This significantly reduces the overall credibility of the group signature system. Summary of the Invention

[0008] To address the shortcomings of existing technologies, this invention provides a group signature method based on a trusted execution environment, which solves the problems of easy key leakage, easy signature forgery, high system dependence on software environment, and inability to provide trusted execution proof in existing group signature methods due to the lack of hardware-level security.

[0009] To achieve the above objectives, the present invention provides a group signature method based on a trusted execution environment, comprising the following steps:

[0010] S1. Perform identity authentication and secure session key negotiation among the communication participants, and verify the integrity of the trusted execution environment of the group administrator;

[0011] S2. Within the trusted execution environment, the group administrator generates the public parameters of the group signature system and the private key of the group administrator, and stores the private key in encrypted form.

[0012] S3. The group administrator receives a new member's application to join, and within the trusted execution environment, generates the new member's exclusive private key information and its unique identifier based on the application, and encrypts and returns the unique identifier to the new member;

[0013] S4. The group member sends the message to be signed and the unique identifier to the group administrator. The group administrator, within the trusted execution environment, uses the exclusive private key information corresponding to the unique identifier to perform a signature calculation on the message to be signed, generates a group signature result, and encrypts and sends the group signature result to the group member.

[0014] S5. The verifier sends the group signature result to be verified and the message to be signed to the group administrator. The group administrator, within the trusted execution environment, uses the public parameters of the group signature system to verify the validity of the group signature result to be verified, and returns the verification result to the verifier in encryption.

[0015] S6. The applicant for opening the group signature sends a request and the group signature result to the group administrator. The group administrator, within the trusted execution environment, uses the group administrator's private key to calculate the group signature result to deduce the signer's private key information, identifies the signer's identity based on the private key information, and then encrypts and returns the signer's identity information to the applicant for opening the group signature.

[0016] Preferably, step S1 includes:

[0017] Each group member applies for and obtains a digital certificate from the public key infrastructure;

[0018] The group members and the group administrator authenticate their identities and negotiate a session key based on the digital certificate;

[0019] The group administrator invokes the Trusted Execution Environment (TEE) remote authentication program to generate a TEE integrity certificate, and then encrypts the integrity certificate using a negotiated session key and sends it to the group members.

[0020] Preferably, step S2 includes:

[0021] The group administrator selects multiple elements as primitives from a preset cryptographic structure. The primitives include the first element and the second element in the first group, and the third element in the second group.

[0022] The group administrator selects multiple key parameters from a limited domain, including a first key parameter, a second key parameter, and a third key parameter;

[0023] The group administrator calculates the first calculation parameter, the second calculation parameter, and the third calculation parameter based on the first element, the first key parameter, the second key parameter, and the third key parameter in the primitive.

[0024] The group public key includes the primitive as well as the first calculation parameter, the second calculation parameter and the third calculation parameter;

[0025] The group administrator's private key includes the first key parameter and the second key parameter.

[0026] Preferably, step S3 includes:

[0027] The group administrator randomly selects a private key element from a finite field;

[0028] The group administrator calculates a private key derived parameter based on the first element in the primitive and the private key element;

[0029] The new member's exclusive private key information includes the private key derived parameters and the private key elements;

[0030] The unique identifier is the private key ID, which the group administrator encrypts using the negotiated session key and returns to the new member.

[0031] Preferably, in step S4, the group administrator performing the signature operation within the trusted execution environment includes:

[0032] The group administrator randomly selects multiple temporary random parameters from a finite domain;

[0033] The group administrator calculates multiple intermediate parameters based on the primitive, the temporary random parameter, the private key derived parameter in the private key information of the group member, the private key element in the private key information of the group member, and the specific parameter in the private key of the group administrator.

[0034] The group administrator uses a hash function to perform hash calculations on the message to be signed and the intermediate parameters to generate a hash value.

[0035] The group administrator calculates multiple response parameters based on the temporary random parameters, the hash value, and specific parameters in the group member's private key information.

[0036] The group signature result includes the intermediate parameters, the hash value, and the response parameters.

[0037] Preferably, in step S5, the group administrator's validity verification of the group signature result includes:

[0038] The group administrator calculates multiple verification auxiliary parameters based on the group public key, the response parameters in the group signature result, the intermediate parameters in the group signature result, and the hash value in the group signature result;

[0039] The group administrator uses a hash function to perform hash calculations on the message to be signed, the intermediate parameters in the group signature result, and the verification auxiliary parameters to generate a verification hash value.

[0040] The group administrator determines whether the hash value in the group signature result is equal to the verification hash value.

[0041] Preferably, in step S6, the group administrator derives the signer's private key information and identifies the signer's identity by:

[0042] The group administrator calculates a signer private key derived parameter based on specific parameters in the group administrator's private key, intermediate parameters in the group signature result, and response parameters in the group signature result;

[0043] The group administrator compares the signer's private key derivative parameters with the private key derivative parameters stored in the private key information of all group members within the trusted execution environment to determine the signer's identity.

[0044] Preferably, in step S4, the message to be signed and the unique identifier sent by the group member to the group administrator, as well as the group signature result sent by the group administrator, are all encrypted using a negotiated session key.

[0045] Preferably, in step S5, the group signature result to be verified and the message to be signed sent by the verifier to the group administrator, as well as the verification result returned by the group administrator, are all encrypted using a negotiated session key.

[0046] A group signature system based on a trusted execution environment includes:

[0047] Group administrator unit: configured with a trusted execution environment;

[0048] Group member unit: used to apply to the group administrator unit to join the group, send a message to be signed and the unique identifier, and receive the group signature result;

[0049] Verifier unit: used to send the group signature result to be verified and the message to be signed to the group administrator unit, and to receive the verification result;

[0050] Open the signature application unit: used to send a request and the group signature result to the group administrator unit, and to receive the signer's identity information.

[0051] This invention provides a group signature method based on a trusted execution environment. It has the following beneficial effects:

[0052] 1. This invention employs a technical solution that places the generation, storage, and critical cryptographic operations of the group administrator's private key and group members' private keys within a trusted execution environment, thereby enhancing key security. Compared to existing technologies where keys are vulnerable to external system access or malware attacks, this invention effectively addresses the shortcomings of insecure key management and susceptibility to attacks.

[0053] 2. This invention employs a technical solution that provides an isolated operating environment for the entire group signature process at the hardware level, thereby enhancing system security. This isolation mechanism prevents unauthorized access or modification of sensitive information by other operating systems or applications. Compared to existing solutions where general computing environments are easily penetrated, this invention effectively addresses the shortcomings in system security and the vulnerability of data to tampering.

[0054] 3. This invention employs a technical solution that provides a trusted execution environment integrity certification report, thereby achieving the technical effect of preventing tampering. This report ensures that the generation and verification of signatures are carried out in a trusted environment, effectively preventing the signer from denying their actions. Compared with existing technologies that lack environmental integrity proof, leading to the repudiation of signature actions, this invention effectively solves the shortcomings of signature repudiation and the difficulty of tracing responsibility.

[0055] 4. This invention employs a digital certificate-based authentication and session key negotiation solution, thereby preventing unauthorized access, fraud, and man-in-the-middle attacks. This mechanism ensures the trustworthiness of both communicating parties' identities and the confidentiality and integrity of the communication content. Compared to existing technologies that pose risks of identity impersonation or information leakage, this invention effectively solves the problems of insufficient communication security and identity trustworthiness. Attached Figure Description

[0056] Figure 1 This is a schematic diagram of the steps of the present invention;

[0057] Figure 2 A flowchart for establishing trust in this invention;

[0058] Figure 3 This is a flowchart of the process for joining a group according to the present invention;

[0059] Figure 4 This is a flowchart of the group signature process of the present invention;

[0060] Figure 5 This is a flowchart of the group signature verification process of the present invention;

[0061] Figure 6 The flowchart for opening the group signature in this invention is shown. Detailed Implementation

[0062] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0063] Please see the appendix Figure 1 This invention provides a group signature method based on a trusted execution environment, comprising the following steps:

[0064] Please see the appendix Figures 2-6 S1. Perform identity authentication and secure session key negotiation among the communication participants, and verify the integrity of the group administrator's trusted execution environment; including:

[0065] Each group member applies for and obtains a digital certificate from the public key infrastructure;

[0066] Group members and group administrators authenticate their identities and negotiate session keys based on digital certificates;

[0067] The group administrator invokes the Trusted Execution Environment (TEE) remote authentication program to generate a TEE integrity certificate, and then sends the integrity certificate to the group members using the negotiated session key in an encrypted manner.

[0068] S2. Within the trusted execution environment, the group administrator generates public parameters for the group signature system and the group administrator's private key, and encrypts and stores the private key; including:

[0069] The group administrator selects multiple elements as primitives from a preset cryptographic structure. The primitives include the first and second elements in the first group, and the third element in the second group.

[0070] The group administrator selects multiple key parameters from a limited field. The key parameters include a first key parameter, a second key parameter, and a third key parameter.

[0071] The group administrator calculates the first calculation parameter, the second calculation parameter, and the third calculation parameter based on the first element, the first key parameter, the second key parameter, and the third key parameter in the primitive.

[0072] The group public key includes primitives and a first computational parameter, a second computational parameter, and a third computational parameter;

[0073] The group administrator's private key includes a first key parameter and a second key parameter.

[0074] S3. The group administrator receives a new member's application to join, and within the trusted execution environment, generates the new member's exclusive private key information and its unique identifier based on the application, and returns the unique identifier in encryption to the new member; including:

[0075] The group administrator randomly selects a private key element from a finite field;

[0076] The group administrator calculates a private key derived parameter based on the first element and the private key element in the primitive;

[0077] The new member's exclusive private key information includes private key derived parameters and private key elements;

[0078] The unique identifier is the private key ID, which the group administrator encrypts using the negotiated session key and returns to the new member.

[0079] S4. Group members send a message to be signed and a unique identifier to the group administrator. Within the trusted execution environment, the group administrator uses the private key information corresponding to the unique identifier to perform a signature calculation on the message to be signed, generating a group signature result, and then encrypts and sends the group signature result to the group members. The group administrator's signing operation within the trusted execution environment includes:

[0080] The group administrator randomly selects multiple temporary random parameters from a finite domain;

[0081] The group administrator calculates multiple intermediate parameters based on primitives, temporary random parameters, private key derived parameters in the private key information of group members, private key elements in the private key information of group members, and specific parameters in the group administrator's private key.

[0082] The group administrator uses a hash function to perform hash calculations on the message to be signed and intermediate parameters to generate a hash value;

[0083] The group administrator calculates multiple response parameters based on temporary random parameters, hash values, and specific parameters in the group members' private key information;

[0084] The group signature result includes intermediate parameters, hash value, and response parameters. The messages to be signed and unique identifiers sent by group members to the group administrator, as well as the group signature result sent by the group administrator, are all encrypted using the negotiated session key.

[0085] S5. The verifier sends the group signature result to be verified and the message to be signed to the group administrator. Within a trusted execution environment, the group administrator verifies the validity of the group signature result using the public parameters of the group signature system and returns the encrypted verification result to the verifier. The group administrator's verification of the group signature result includes:

[0086] The group administrator calculates multiple verification auxiliary parameters based on the group public key, the response parameters in the group signature result, the intermediate parameters in the group signature result, and the hash value in the group signature result;

[0087] The group administrator uses a hash function to perform hash calculations on the message to be signed, intermediate parameters in the group signature result, and verification auxiliary parameters to generate a verification hash value.

[0088] The group administrator checks whether the hash value in the group signature result is equal to the verification hash value. The group signature result to be verified and the message to be signed sent by the verifier to the group administrator, as well as the verification result returned by the group administrator, are all encrypted using the negotiated session key.

[0089] S6. The applicant requesting to open the group signature sends a request and the group signature result to the group administrator. Within a trusted execution environment, the group administrator uses the administrator's private key to calculate the group signature result to deduce the signer's private key information, identifies the signer based on the private key information, and then encrypts and returns the signer's identity information to the applicant. The group administrator's deduction of the signer's private key information and identification of the signer includes:

[0090] The group administrator calculates a signer's private key derived parameter based on specific parameters in the group administrator's private key, intermediate parameters in the group signature result, and response parameters in the group signature result;

[0091] The group administrator compares the signer's private key derivative parameters with the private key derivative parameters stored in the private key information of all group members within the trusted execution environment to determine the signer's identity.

[0092] Specifically, step S1 (trust establishment step) is crucial as the cornerstone of the entire system's security. This step aims to build a secure and verifiable chain of trust among all communication participants, ensuring the reliability and tamper-proof nature of subsequent group signature operations. First, to establish trust among communication participants, this invention introduces Public Key Infrastructure (PKI). Specifically, before joining the group signature system, each group member must apply for and obtain their own digital certificate from the pre-deployed PKI. This digital certificate is issued by the PKI's root certificate or intermediate certificate and contains the group member's public key and identity information. This approach, through authoritative third-party authentication, effectively solves the problem of identity forgery and ensures the authenticity of participants' identities.

[0093] Secondly, building upon identity authentication, this invention further implements secure session key negotiation between group members and group administrators. Group members and administrators authenticate each other using their respective digital certificates. This authentication process typically involves challenge-response mechanisms and digital signature verification to ensure that both parties confirm each other's legitimate identities before communication. After successful identity authentication, both parties dynamically generate a shared session key for use only in the current session using encryption protocols such as Elliptic Curve Diffie-Hellman (ECDH) key negotiation. This session key has forward security; even if the key is leaked long-term, historical communication content will not be decrypted. All subsequent sensitive data transmissions, including the transmission of TEE integrity certificates, will be encrypted using this session key, thereby ensuring the confidentiality and integrity of communication content and effectively resisting eavesdropping and tampering attacks.

[0094] Furthermore, to ensure the security of the critical computing environment on the group administrator's side, this invention emphasizes the integrity verification of the group administrator's Trusted Execution Environment (TEE). After successful session key negotiation, the group administrator invokes a remote authentication program within its TEE. This remote authentication program executes within the secure isolation environment of the TEE and generates an integrity certificate containing metrics of the TEE's current running state, version information, and other security attributes. This certificate is essentially a declaration by the TEE that its own hardware and software environment has not been tampered with. The group administrator then encrypts this integrity certificate using the negotiated session key and sends it to the group members.

[0095] After receiving the encrypted integrity certificate, group members decrypt it using the same session key and verify it based on the preset root of trust and integrity metric baseline. If the verification passes, the group members are convinced that the group administrator's TEE is in a trusted state and has not been affected by malware or external attacks, thus providing a solid foundation of trust for subsequent group signature key management and signature calculations within the TEE.

[0096] After completing the trust establishment and TEE integrity verification in step S1, this invention proceeds to step S2 (group creation). The core of this step lies in the group administrator generating the public parameters necessary for the group signature system to operate, as well as the group administrator's own private key, within a highly secure TEE. This process is crucial to the security of the entire group signature scheme, as the quality of the generated group key and the security of the stored private key directly affect the system's cryptographic strength and resistance to attacks. First, the group administrator selects multiple elements from a pre-defined cryptographic structure as basic elements.

[0097] For example, in a group signature scheme based on bilinear pairing, primitives may include elements from two different groups (e.g., and ). These primitives serve as the shared foundation for all subsequent key generation, signature computation, and verification, and their selection must meet cryptographic security requirements. Secondly, within a Trusted Execution Environment (TEE), the group administrator securely and randomly selects multiple key parameters from a finite field of a large prime order, such as a first key parameter (α), a second key parameter (β), and a third key parameter (reliable and unpredictable by external systems). Furthermore, within the TEE, the group administrator uses the first element from the previously selected primitives and these three key parameters to perform a series of cryptographic calculations to derive the public computational parameters for the group signature, such as calculating the first, second, and third computational parameters. These calculations are also performed within the security boundaries of the TEE, ensuring the correctness of the computation process and preventing the exposure of any intermediate values. Finally, the group administrator publishes the selected primitives and the calculated first, second, and third computational parameters externally as the group public key (GPK) for the entire group signature system.

[0098] This group public key is public information used by all group members when generating the group signature and by all validators when verifying the group signature; it contains no secret parameters. Finally, the group administrator uses the first and second key parameters (i.e., the key generated within the TEE) as their proprietary GroupManagerPrivateKey (GMPK). This private key is crucial because it grants the group administrator unique permissions to manage the group (such as enabling signer identities). More importantly, this group administrator private key, after generation, is directly and encrypted and stored in a secure storage area within the TEE, such as a secure NVM (non-volatile memory) or encrypted file system provided by the TEE. This encryption process utilizes a hardware key within the TEE or a unique key accessible only to the TEE itself, ensuring that even if an attacker gains physical access to the storage medium, they cannot directly extract the private key. This secure storage mechanism is the core safeguard against the leakage of the group administrator's private key.

[0099] After completing the trust establishment in step S1 and the generation of group parameters and the group administrator's private key in step S2, this invention proceeds to step S3 (joining the group). This step aims to securely introduce new members into the group signature system. Its core lies in the group administrator generating a unique private key for each new member within the Trusted Execution Environment (TEE) and assigning a unique identifier. This process is crucial for maintaining the anonymity, traceability, and confidentiality of the private key information in the group signature. When a new member wishes to join the group signature, it sends a join request to the group administrator, which typically includes the new member's identity information. Upon receiving the request, the group administrator transfers all private key generation operations to the TEE, which has been verified through step S1. Within the secure isolation of the TEE, the group administrator begins constructing a unique private key for the new member and assigns a unique identifier within the group for subsequent identification when opening the signature. Within the TEE, the group administrator uses a pre-defined, sufficiently large finite field... In step S2, a private key element (e.g., x) is randomly selected, and its randomness is guaranteed by the secure random number generator (TRNG) inside the TEE. Next, the group administrator uses the first element (g1) of the primitive of the group public key determined in step S2 and the newly selected private key element (x) to calculate a private key derivative parameter (e.g., g1) through cryptographic operations (such as group exponentiation). ).

[0100] At this point, the private key information generated for the new member consists of two parts: the calculated private key derivative parameters (A) and a randomly selected private key element (x). These two parameters together constitute the credentials for the new member to perform group signature operations. Finally, the group administrator will bind a private key ID (PKID) to the new member's private key information and symmetrically encrypt this PKID (or the PKID and the encrypted private key information) using the session key negotiated with the new member in step S1. The encrypted PKID will be returned to the new member through a secure communication channel, and the new member will decrypt and save it. This encrypted transmission ensures the confidentiality of the PKID during transmission, preventing unauthorized parties from stealing the PKID and associating it with a specific member.

[0101] After completing the member joining process, this invention proceeds to step S4 (generating the group signature). This step is one of the core functions of group signing, designed to allow group members to digitally sign specific messages while maintaining anonymity. All sensitive computational parts of the signature generation process are securely executed within the group administrator's Trusted Execution Environment (TEE), thereby ensuring the isolation and protection of the signing key and the integrity of the signing process. Group members first send the message to be signed and their unique identifier (PKID) obtained in step S3 to the group administrator. These transmitted contents are encrypted using the session key negotiated in step S1.

[0102] Upon receiving the encryption request, the group administrator first decrypts it within the TEE. Then, the group administrator uses the PKID to look up and load the private key information corresponding to the group member. All subsequent signature calculations are performed within the isolated environment of the TEE. Specifically, the group administrator randomly selects multiple temporary random parameters from a finite field; the randomness of these parameters is guaranteed by the TEE's hardware random number generator. Next, based on the primitives of the group public key determined in step S2, these temporary random parameters, the group member's private key information, and specific parameters in the group administrator's private key, the group administrator performs complex cryptographic calculations to generate multiple intermediate parameters.

[0103] Subsequently, the group administrator uses a preset hash function to hash the message to be signed and these intermediate parameters, generating a hash value. Next, based on the previously generated temporary random parameters, this hash value, and specific parameters from the group members' private key information, the group administrator calculates multiple response parameters. Finally, within the TEE, the group administrator integrates all the calculated intermediate parameters, hash values, and response parameters into a complete group signature result.

[0104] Before leaving the TEE, the group signature result is encrypted again using the session key negotiated with the group members, and then sent to the group members. The core advantage of this S4 step is that the group members' private key information never leaves the protection of the TEE, and all sensitive signature calculations are completed within the hardware-isolated TEE, which greatly enhances the security of group signatures and prevents private key leakage and signature forgery.

[0105] After the group signature is generated, the present invention proceeds to step S5 (the group signature verification step). This step allows any external verifier (or entity requiring signature verification) to confirm whether a group signature is legitimate, whether it was issued by a legitimate member of the group, and whether the message has been tampered with. Similar to signature generation, the sensitive computations for group signature verification are also securely performed by the group administrator's Trusted Execution Environment (TEE) to ensure the authority and non-repudiation of the verification result. The verifier first sends the group signature result to be verified and the corresponding message to be signed to the group administrator. This data is also encrypted and transmitted using the session key negotiated in step S1.

[0106] Upon receiving the encryption request, the group administrator decrypts the data within the TEE. Then, using the group public key (GPK) revealed in step S2, along with the response parameters, intermediate parameters, and hash value from the received group signature result, the group administrator performs a series of complex cryptographic verification calculations within the secure isolation environment of the TEE. Specifically, these calculations aim to check whether the group signature satisfies its underlying mathematical relationships. Through these operations, the group administrator calculates several verification auxiliary parameters. Next, using the same hash function as in step S4, the group administrator performs hash calculations on the message to be signed, the intermediate parameters in the group signature result, and the previously calculated verification auxiliary parameters, thereby generating a verification hash value.

[0107] Finally, the group administrator within the TEE checks whether the hash value contained in the group signature result is equal to the newly generated verification hash value. If they are equal, the group signature is valid and authentic; otherwise, the signature is invalid. This verification result (valid or invalid) is encrypted using the session key negotiated with the verifier before leaving the TEE and then returned to the verifier. The core advantage of step S5 is that the logic and execution environment of group signature verification are strictly protected by the TEE, avoiding the risk of verification logic being tampered with or verification results being forged, thus ensuring that any verifier can obtain a trustworthy and tamper-proof signature verification result.

[0108] Finally, when retrospective review or identity verification of the group signature is required, the invention proceeds to step S6 (opening the group signature step). This step aims to, when necessary, allow an authorized group administrator, under the strict control of a Trusted Execution Environment (TEE), to reveal the true issuer of a specific group signature, thereby achieving accountability. This function is a key feature that distinguishes group signatures from ordinary digital signatures, and its security directly depends on the confidentiality of the group administrator's private key and the integrity of the TEE operation. The person requesting to open the group signature sends an opening request and the group signature result to the group administrator. This information is also transmitted encrypted using the session key negotiated in step S1. Upon receiving the encryption request, the group administrator decrypts this data within the TEE.

[0109] Subsequently, within the secure isolation environment of the TEE, the group administrator, using the group administrator private key (GMPK) generated in step S2, along with the intermediate and response parameters from the received group signature result, performs a specific cryptographic calculation to derive a signer's private key derivative parameter. This calculation is a unique "open algorithm" in the group signature scheme, using the group administrator's private key as a trapdoor to associate the group signature with a specific group member's private key information. Once the signer's private key derivative parameter is derived, the group administrator within the TEE compares it with the private key derivative parameters generated in step S3 for all registered group members and securely stored within the TEE. Through this comparison, the group administrator can accurately determine and identify the matching signer.

[0110] Once the signer's PKID is determined, the group administrator can link it to the corresponding real identity information based on the member registration records maintained internally. Finally, before leaving the TEE, the group administrator encrypts the identified signer's identity information using the session key negotiated with the applicant who requested to open the group signature, and then returns it to the applicant. The implementation of step S6 ensures that the anonymity of group signatures is maintained under normal circumstances, but when legal and necessary, the group administrator can securely and irrefutably trace the source of the signature under the strict protection of the TEE.

[0111] A group signature system based on a trusted execution environment comprises six parts: a trust establishment module, a group creation module, a group joining module, a member signature module, a signature verification module, and a signature opening module.

[0112] Functions of each module:

[0113] The trust establishment module is responsible for verifying the identities of group administrators and other members. If their identities are valid, certificates are issued to them. Each member uses the certificates to authenticate their identity and negotiate session keys with the group administrator. Then, the group administrator calls the TEE remote authentication program to generate a TEE integrity certificate, which is then encrypted using the session key and sent to other members to prove the integrity and trustworthiness of the TEE environment.

[0114] The group creation module is responsible for generating the public encryption parameters required by the group. These parameters are shared by all group members, including the group public key (gpk), encryption algorithm parameters, etc. Additionally, it needs to generate the group administrator's private key (gmsk), which must be strictly kept confidential and not disclosed to the public, and is encrypted and stored in a trusted execution environment. All the generation and storage of public parameters and the group administrator's private key are completed within the TEE, ensuring data privacy and security.

[0115] The "Join Group" module handles group member requests. Applicants request to join the group from the group administrator. After verifying the applicant's identity, the administrator generates and saves a unique member private key and its corresponding private key ID (PKID) within the TEE. Subsequently, the group administrator distributes the PKID to the applicant using session key encryption.

[0116] The member signature module is responsible for generating signatures for group members. Group members encrypt their PKID and message M using the session key and send them to the group administrator. The administrator, within the TEE, uses the corresponding group member's private key based on the PKID to sign M, and then encrypts the signature σ using the session key and sends it to the group member.

[0117] The signature verification module is responsible for verifying the validity of signatures. Anyone can send a signature verification request to the group administrator. The group administrator uses gpk within the TEE to verify the signature validity and returns the result encrypted with the session key.

[0118] The signature module is enabled to track the identity of the signer. In special circumstances requiring signer identification, the group administrator can be requested to track the signature. The group administrator uses their private key within the TEE to calculate the signature, deduce the signer's private key, and compares it with the private keys of group members stored within the TEE. By matching member private keys, the administrator can accurately identify the signer corresponding to the private key and return the result using session encryption.

[0119] The specific process is as follows:

[0120] Trust building:

[0121] Each member applies for a certificate from the PKI;

[0122] PKI verifies identity and issues certificates;

[0123] Each member and the group administrator authenticate their identities and negotiate session keys based on certificates, and all subsequent communications are encrypted using the session key.

[0124] The group administrator calls the TEE remote authentication program to generate a TEE integrity certificate and issues it to prove that the TEE is complete and trustworthy.

[0125] Create a group:

[0126] 1. Load pairing parameters from the configuration file;

[0127] 2. Obtain the G1 group, G2 group, and Zr domain v from the pairing parameters;

[0128] 3. Randomly select an element g1 or h from the G1 group;

[0129] 4. Randomly select an element g2 from the G2 group;

[0130] 5. Randomly select two elements ξ1, ξ2 and γ from the Zr domain;

[0131] 6. Calculation and w = g2 γ ;

[0132] 7. Generate the group public key gpk(g1, g2, h, u, v, w) and the group administrator private key gmsk(ξ1, ξ2).

[0133] Join the group:

[0134] 1. Applicants request to join the group from the group administrator;

[0135] 2. The group administrator reviews the application. If approved, the administrator generates a private key and its corresponding PKID for the member and returns the PKID.

[0136] The process of generating a member's private key is as follows:

[0137] 2.1. The group administrator randomly selects an element xi from the Zr domain;

[0138] 2.2. Group administrator calculation

[0139] 2.3. Generate group member private keys gsk(A i ,xi).

[0140] Generate group signature:

[0141] 1. Group members send their PKID and message M to the group administrator;

[0142] 2. Within the TEE, the group administrator uses the PKID to retrieve the private key of the corresponding group member to sign M and returns the signature value σ;

[0143] The process of generating the signature value is as follows:

[0144] 2.1. Randomly select α, β, r from the Zr domain α r β r x rδ1, rδ2;

[0145] 2.2. Calculate T1 = u α T2 = v β T3 = Ah α+β ,

[0146] 2.3. Calculate the hash value c = H(M,T1,T2,T3,R1,R2,R3,R4,R5) using a hash function;

[0147] 2.4. Calculate s α=r α +cα,s β =r β +cβ,s x =r x +cx, s δ1 =r δ1 +cδ1,s δ2 =r δ2 +cδ2, where δ1=xα, δ2=xβ, signature σ=(T1, T2, T3, c, s α ,s β ,s x ,s δ1 ,s δ2 ).

[0148] Verify group signature:

[0149] 1. The verifier sends a signature to the group administrator, requesting verification of the signature's validity;

[0150] 2. The group administrator uses the group public key to verify the signature and returns the result;

[0151] The verification process is as follows:

[0152] 1. Calculation

[0153] 2. Calculate c′=H(M,T1,T2,T3,R′1,R′2,R′3,R′4,R′5);

[0154] 3. Verify whether c is equal to c′. If they are equal, the signature is valid; otherwise, the signature is invalid.

[0155] Open group signature:

[0156] 1. Send a signature and an open request to the group administrator;

[0157] 2. The administrator verifies the situation and if it is indeed necessary to use the group management private key within the TEE to open the signature and obtain the signing private key, then queries and matches it with the group members' private keys to determine the signer's identity and returns the result;

[0158] The process of opening the signature is as follows:

[0159] 2.1. The group administrator uses the private key gmsk(ξ1, ξ2) to calculate

[0160] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A group signature method based on a trusted execution environment, characterized in that, Includes the following steps: S1. Perform identity authentication and secure session key negotiation among the communication participants, and verify the integrity of the group administrator's trusted execution environment; S2. Within the trusted execution environment, the group administrator generates the public parameters of the group signature system and the private key of the group administrator, and stores the private key in encrypted form. S3. The group administrator receives a new member's application to join, and within the trusted execution environment, generates the new member's exclusive private key information and its unique identifier based on the application, and encrypts and returns the unique identifier to the new member; S4. Group members send a message to be signed and the unique identifier to the group administrator. The group administrator, within the trusted execution environment, uses the exclusive private key information corresponding to the unique identifier to perform a signature calculation on the message to be signed, generates a group signature result, and encrypts and sends the group signature result to the group members. S5. The verifier sends the group signature result to be verified and the message to be signed to the group administrator. The group administrator, within the trusted execution environment, uses the public parameters of the group signature system to verify the validity of the group signature result to be verified, and returns the verification result to the verifier in encryption. S6. The applicant for opening the group signature sends a request and the group signature result to the group administrator. The group administrator, within the trusted execution environment, uses the group administrator's private key to calculate the group signature result to deduce the signer's private key information, identifies the signer's identity based on the private key information, and then encrypts and returns the signer's identity information to the applicant for opening the group signature.

2. The group signature method based on a trusted execution environment according to claim 1, characterized in that: Step S1 includes: Each group member applies for and obtains a digital certificate from the public key infrastructure; The group members and the group administrator authenticate their identities and negotiate a session key based on the digital certificate; The group administrator invokes the Trusted Execution Environment (TEE) remote authentication program to generate a TEE integrity certificate, and then encrypts the integrity certificate using a negotiated session key and sends it to the group members.

3. The group signature method based on a trusted execution environment according to claim 1, characterized in that: Step S2 includes: The group administrator selects multiple elements as primitives from a preset cryptographic structure. The primitives include the first element and the second element in the first group, and the third element in the second group. The group administrator selects multiple key parameters from a limited domain, including a first key parameter, a second key parameter, and a third key parameter; The group administrator calculates the first calculation parameter, the second calculation parameter, and the third calculation parameter based on the first element, the first key parameter, the second key parameter, and the third key parameter in the primitive. The group public key includes the primitive as well as the first calculation parameter, the second calculation parameter, and the third calculation parameter; The group administrator's private key includes the first key parameter and the second key parameter.

4. The group signature method based on a trusted execution environment according to claim 1, characterized in that: Step S3 includes: The group administrator randomly selects a private key element from a finite field; The group administrator calculates a private key derived parameter based on the first element in the primitive and the private key element; The new member's exclusive private key information includes the private key derived parameters and the private key elements; The unique identifier is the private key ID, which the group administrator encrypts using the negotiated session key and returns to the new member.

5. The group signature method based on a trusted execution environment according to claim 1, characterized in that: In step S4, the group administrator performing the signature operation within the trusted execution environment includes: The group administrator randomly selects multiple temporary random parameters from a finite domain; The group administrator calculates multiple intermediate parameters based on the primitive, the temporary random parameter, the private key derived parameter in the private key information of the group member, the private key element in the private key information of the group member, and the specific parameter in the private key of the group administrator. The group administrator uses a hash function to perform hash calculations on the message to be signed and the intermediate parameters to generate a hash value. The group administrator calculates multiple response parameters based on the temporary random parameters, the hash value, and specific parameters in the group member's private key information. The group signature result includes the intermediate parameters, the hash value, and the response parameters.

6. The group signature method based on a trusted execution environment according to claim 1, characterized in that: In step S5, the group administrator's validity verification of the group signature result includes: The group administrator calculates multiple verification auxiliary parameters based on the group public key, the response parameters in the group signature result, the intermediate parameters in the group signature result, and the hash value in the group signature result; The group administrator uses a hash function to perform hash calculations on the message to be signed, the intermediate parameters in the group signature result, and the verification auxiliary parameters to generate a verification hash value. The group administrator determines whether the hash value in the group signature result is equal to the verification hash value.

7. The group signature method based on a trusted execution environment according to claim 1, characterized in that: In step S6, the group administrator derives the signer's private key information and identifies the signer's identity, including: The group administrator calculates a signer private key derived parameter based on specific parameters in the group administrator's private key, intermediate parameters in the group signature result, and response parameters in the group signature result; The group administrator compares the signer's private key derivative parameters with the private key derivative parameters stored in the private key information of all group members within the trusted execution environment to determine the signer's identity.

8. The group signature method based on a trusted execution environment according to claim 1, characterized in that: In step S4, the message to be signed and the unique identifier sent by the group member to the group administrator, as well as the group signature result sent by the group administrator, are all encrypted using the negotiated session key.

9. The group signature method based on a trusted execution environment according to claim 1, characterized in that: In step S5, the group signature result to be verified and the message to be signed sent by the verifier to the group administrator, as well as the verification result returned by the group administrator, are all encrypted using the negotiated session key.

10. A group signature system based on a trusted execution environment, comprising a group signature method based on a trusted execution environment according to any one of claims 1-9, characterized in that, include: Group administrator unit: configured with a trusted execution environment; Group member unit: used to apply to the group administrator unit to join the group, send a message to be signed and a unique identifier, and receive the group signature result; Verifier unit: used to send the group signature result to be verified and the message to be signed to the group administrator unit, and to receive the verification result; Open the signature application unit: used to send a request and the group signature result to the group administrator unit, and to receive the signer's identity information.

Images