Aggregated signature and verification method

Abstract

The application discloses a kind of polymerization signature and verification method, it is related to information security technical field, including: initiation polymerization signature request: business system applies for digital certificate and generates polymerization signature request;Generate authorized credentials: sign person applies for digital certificate and confirms polymerization signature request, simultaneously generates authorized credentials;Calculate aggregation key: business system receives authorized credentials and key, and calculates polymerization signature private key and verifies polymerization signature public key;Using polymerization signature private key signature: business system uses polymerization signature private key and signs authorized credentials, obtains polymerization signature result;Verify polymerization signature: calculate polymerization signature public key, and verify the validity of polymerization signature, authorized credentials, sign person signature;The application enhances the legal effect of electronic signature.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security technology, in particular to a kind of aggregation signature and verification method. BACKGROUND

[0002] At present, the digital signature technology based on PKI / CA is widely used in various digital transformation information system construction, and the security functions such as identity authentication, electronic signature and electronic seal of various subjects in network application can be realized through digital certificate, so as to ensure the authenticity of the identity of the participants, data integrity and non-repudiation. The digital certificate is issued by the CA institution with electronic authentication service license, and the user uses his own signature private key to sign the hash value of the data text in the process of using the digital certificate to sign the data text, and the CA institution and the business system do not participate in the signature value calculation process.

[0003] The traditional digital signature is only participated by the signer in execution, without the participation of other parties in the calculation process of signature voucher, and the signing behavior of the signer lacks the signature voucher recognized by multiple parties. When a dispute arises afterwards, if the signature evidence is not favorable to the signer, the signer usually denies the authenticity of the electronic signature data and intention with the reasons of being unaware, not willing, illegal calling of business system, etc., so that the legal effect of the electronic signature is difficult to be determined. SUMMARY

[0004] In order to solve the problems existing in the prior art, the purpose of the present application is to provide an aggregation signature and verification method, which enhances the legal effect of electronic signature.

[0005] In order to achieve the above-mentioned purpose, the technical scheme adopted by the present application is as follows: an aggregation signature and verification method, comprising the following steps:

[0006] Step 1, initiating aggregation signature request: the business system applies for digital certificate and generates aggregation signature request;

[0007] Step 2, generating authorization voucher: the signer applies for digital certificate and confirms the aggregation signature request, and generates authorization voucher;

[0008] Step 3, calculating aggregation key: the business system receives the authorization voucher and the key, and calculates the aggregation signature private key and verifies the aggregation signature public key;

[0009] Step 4, signing with aggregation signature private key: the business system signs the authorization voucher with the aggregation signature private key to obtain the aggregation signature result;

[0010] Step 5, verifying aggregation signature: calculating aggregation signature public key, and verifying the validity of aggregation signature, authorization voucher and signer signature.

[0011] As a further improvement of the present application, the service system applies for a digital certificate specifically as follows:

[0012] The service system calls the aggregation signature system interface, registers identity information, calls the server cryptomachine to generate an SM2 key pair and a certificate request, applies for a digital certificate of SM2 algorithm to the CA system through the aggregation signature system, the digital certificate is recorded as Cert_S, the certificate private key is recorded as CertPri_S, and the certificate public key is recorded as CertPub_S.

[0013] According to the principle of the SM2 elliptic curve algorithm, CertPub_S=CertPri_S[*]G is obtained, wherein G is a base point of the SM2 elliptic curve, [*] represents elliptic curve point multiplication operation, and CertPub_S is a point on the SM2 elliptic curve, and the x and y coordinate bit strings of CertPub_S are represented as x-CertPub_S and y-CertPub_S respectively.

[0014] As a further improvement of the present application, the service system generates an aggregation signature request specifically as follows:

[0015] When a responsibility identification signature operation is needed, the service system generates a to-be-signed original text recorded as MSG, and uses the national SM3 hash algorithm to calculate a corresponding hash value recorded as H_MSG, H_MSG=SM3(MSG); meanwhile, a URL address capable of displaying MSG is generated and recorded as URL_MSG.

[0016] The service system calls the server cryptomachine to generate a random number k1∈[1,n-1], wherein n is the order of the base point G, and Pub_k1=k1[*]G is calculated.

[0017] The service system splices a to-be-signed string of the aggregation signature request recorded as STR1, STR1=URL_MSG||H_MSG||Cert_S||Pub_k1, wherein || represents splicing; the service system uses the self certificate private key CertPri_S to perform digital signature on STR1 through the SM2 signature algorithm, a generated signature value is recorded as SV1, SV1=SM2Sign(STR1,CertPri_S), and STR1 and SV1 are spliced to obtain the aggregation signature request recorded as PSR, PSR=STR1||SV1=URL_MSG||H_MSG||Cert_S||Pub_k1||SV1.

[0018] The service system sends the aggregation signature request PSR to the aggregation signature system and the signer.

[0019] As a further improvement of the present application, the signer applies for a digital certificate specifically as follows:

[0020] The signer accesses the aggregation signature system, registers identity information, and after real-name authentication is passed, applies for a digital certificate of an SM2 algorithm to a CA system through the aggregation signature system, the digital certificate is recorded as Cert_U, the certificate private key is recorded as CertPri_U, and the certificate public key is recorded as CertPub_U;

[0021] According to the principle of the SM2 elliptic curve algorithm, CertPub_U=CertPri_U[*]G is obtained, and CertPub_U is a point on the SM2 elliptic curve, and x and y coordinate bit strings of the point are represented as x-CertPub_U and y-CertPub_U respectively.

[0022] As a further improvement of the application, the aggregation signature request is confirmed as follows:

[0023] The signer logs in the aggregation signature system by using the digital certificate Cert_U, receives the aggregation signature request PSR, extracts URL_MSG, H_MSG, Cert_S, Pub_k1 and SV1 in the PSR, uses the SM2 signature verification algorithm to verify the PSR and Cert_S, and if the verification is passed, the next step is entered, otherwise it is indicated that the aggregation signature request is abnormal, and the business system is notified to reinitiate the aggregation signature request.

[0024] The signer clicks URL_MSG, and the aggregation signature system uses the national secret SM3 hash algorithm to verify whether the hash value of MSG is consistent with H_MSG, if the verification is consistent, the next step is entered, otherwise it is indicated that MSG is modified after being submitted by the business system, and the business system is notified to reinitiate the aggregation signature request.

[0025] The signer audits whether Cert_S and MSG are approved, if yes, the next step is entered, otherwise the business system is notified to refuse to sign, and the process is terminated.

[0026] As a further improvement of the application, the generation of the authorization credential is as follows:

[0027] The aggregation signature system extracts CPub_S in Cert_S, calls a server cryptomachine to generate a random number k2∈[1,n-1], generates an authorization credential public key, recorded as CredPub_S, CredPub_S=CertPub_S[+]Pub_k1[+]H_MSG[*]G[+]k2[*]G, wherein [+] represents elliptic curve point addition operation; CredPub_S is a point on the elliptic curve, and x and y coordinate bit strings of the point are represented as x-CredPub_S and y-CredPub_S respectively.

[0028] The signer uses the own certificate private key CertPri_U to perform digital signature on CredPub_S through an SM2 signature algorithm, and a generated signature value is denoted as SV2, and SV2=SM2Sign(CredPub_S,CertPri_U);

[0029] The aggregation signature system calls a CA system to issue a digital certificate of the SM2 algorithm for the authorized credential public key CredPub_S, denoted as CredCert_S, and the certificate public key of CredCert_S is CredPub_S, and CertPub_U, CertPub_S, URL_MSG, H_MSG, SV1 and SV2 are written in a certificate subject or an extension item, and a signature value of the CA system for CredCert_S is denoted as SV3; the digital certificate CredCert_S is used as an authorized credential of the aggregation signature, and the content includes {CredPub_S, CertPub_U, CertPub_S, URL_MSG, H_MSG, SV1, SV2, SV3};

[0030] The aggregation signature system calculates a key factor, denoted as Factor_S, and Factor_S=SM3(H_MSG||x-CredPub_S||y-CredPub_S||x-CertPub_U||y-CertPub_U) mod n, wherein mod represents a modulus operation.

[0031] The aggregation signature system calculates a partial aggregation signature private key, denoted as TPri_S, and TPri_S=k2+Factor_S*CertPri_U mod n; the aggregation signature system encrypts TPri_S using the public key CertPub_S of the business system to generate a ciphertext of the partial aggregation signature private key, denoted as encrypted-TPri_S, and encrypted-TPri_S=SM2Enc(TPri_S,CertPub_S);

[0032] The aggregation signature system splices CredCert_S||encrypted-TPri_S and sends the same to the business system.

[0033] As a further improvement of the application, the step 3 specifically includes the following steps.

[0034] Step 3.1, the business system receives CredCert_S||encrypted-TPri_S, extracts CredCert_S and encrypted-TPri_S, verifies whether the signature of CredCert_S is valid, if yes, the next step is entered, otherwise, it is indicated that the authorized credential is abnormal, and the process is terminated.

[0035] Step 3.2, the business system uses the CertPri_S to decrypt the encrypted-TPri_S, and obtains the TPri_S=SM2Dec(encrypted-TPri_S, CertPri_S), if the decryption fails, it indicates that the ciphertext of the partial aggregation signature private key is abnormal, and the process is terminated; the business system calculates the complete aggregation signature private key, and is recorded as BusiPri_S, BusiPri_S=CertPri_S+TPri_S+k1+H_MSG mod n;

[0036] Step 3.3, the business system extracts the CredPub_S and H_MSG from the CredCert_S; the business system calculates the key factor, Factor_S=SM3(H_MSG||x-CredPub_S||y-CredPub_S||x-CertPub_U||y-CertPub_U) mod n; the business system calculates the complete aggregation signature public key, and is recorded as BusiPub_S, BusiPub_S=CredPub_S[+]Factor_S[*]CertPub_U; the business system verifies the correctness of the complete aggregation signature public key, and confirms whether BusiPub_S is equal to BusiPri_S[*]G; if they are equal, it indicates that BusiPub_S and BusiPri_S match a pair of SM2 public and private keys, BusiPri_S is used for signing the business data, and BusiPub_S is used for verifying the signature value of the business data; if they are not equal, the process is terminated.

[0037] As a further improvement of the application, the step 4 is specifically as follows:

[0038] The business system uses the aggregation signature private key BusiPri_S to generate an aggregation signature value by using the SM2 signature algorithm on the authorization certificate CredCert_S, and is recorded as SV4, SV4=SM2Sign(CredCert_S, BusiPri_S), the CredCert_S and the SV4 are spliced to obtain an aggregation signature result, and is recorded as RES, RES=CredCert_S||SV4.

[0039] As a further improvement of the application, the calculation of the aggregation signature public key is specifically as follows:

[0040] The business system extracts the CredCert_S from the aggregation signature result RES, extracts the H_MSG, CredPub_S and CertPub_U from the CredCert_S, obtains the x and y coordinate bit strings of the points on the elliptic curve corresponding to the CredPub_S and the CertPub_U, and obtains x-CredPub_S, y-CredPub_S, x-CertPub_U and y-CertPub_U respectively.

[0041] The business system uses the national secret SM3 hash algorithm to calculate a key factor, Factor_S=SM3(H_MSG||x-CredPub_S||y-CredPub_S||x-CertPub_U||y-CertPub_U) mod n;

[0042] The business system calculates an aggregated signature public key, BusiPub_S=CredPub_S[+]Factor_S[*]CertPub_U.

[0043] As a further improvement of the application, the validity of the aggregated signature, the authorized credential, and the signature of the signer is verified as follows:

[0044] The business system extracts the authorized credential CredCert_S and the aggregated signature value SV4 from the aggregated signature result RES, and verifies whether CredCert_S is valid using the aggregated signature public key BusiPub_S and SV4, if valid, the next step is entered, otherwise the aggregated signature is abnormal, and the process is terminated.

[0045] The business system extracts the authorized credential CredCert_S from the aggregated signature result RES, and verifies the validity of the signature of CredCert_S by the CA system, i.e. whether CredCert_S is valid by the CA certificate public key and SV3, if valid, the next step is entered, otherwise the authorized credential is abnormal, and the process is terminated.

[0046] The business system extracts the authorized credential CredCert_S from the aggregated signature result RES, extracts CertPub_U, CredPub_S, and SV2 from CredCert_S, and verifies whether CredPub_S is valid using the signer public key CertPub_U and SV2, if valid, it means that CredPub_S has not been tampered with after being signed by the signer, and is approved by the signer, and since CredPub_S is the public key of CredCert_S, the signer cannot deny the signature.

[0047] In the aggregated signature link, the respective private keys, public keys, random private keys of the signer, the business system, and the aggregated signature system, and the hash value of the signature original text are used to generate an aggregated signature private key, the private key is one-time, different each time, and can be discarded after being used for business data signature, without the need for storage, so that the risk of private key data leakage can be avoided.

[0048] In the verification of aggregated signatures, this invention uses the signer's public key, the signer's authorization certificate for the aggregated signature, the business system's public key, and the hash value of the original signature text to synthesize the aggregated signature public key. This public key does not need to be stored after use; it can be calculated by the electronic signature-dependent party using relevant public data when needed. If the verification is successful, the signer, the business system, the aggregated signature system, and the CA system can all prove the validity of the aggregated signature.

[0049] The beneficial effects of this invention are:

[0050] 1. The present invention uses digital certificates of the business system and the signer to confirm the application-authorization relationship of the aggregated signature. The authorization certificate is related to the certificate keys of both parties, the hash value of the original text to be signed and the random key. It is a one-time certificate. The certificate is attached to the signing object and the signing result during the aggregated signature, which makes it easier for the electronic signature-dependent party to verify the reliability of the authorization certificate.

[0051] 2. The aggregated signature of this invention comes with an authorization certificate, and the authorization certificate has been confirmed by multiple parties. The signer, the business system, the aggregated signature system and the CA institution can all prove the validity of the authorization. The authorization certificate is automatically stored in the third-party CA system in the form of a certificate, which facilitates subsequent judicial evidence collection. Attached Figure Description

[0052] Figure 1 This is a flowchart of an embodiment of the present invention;

[0053] Figure 2 This is a system block diagram according to an embodiment of the present invention. Detailed Implementation

[0054] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0055] Example:

[0056] like Figure 1 As shown, an aggregate signature and verification method employs, as follows: Figure 2 The implementation of the aggregated signature and verification system shown includes the following steps:

[0057] S100: Initiate an aggregate signature request.

[0058] S101: Business system applies for digital certificate.

[0059] S10101: If the business system has applied for a digital certificate and the certificate is valid, skip the following steps.

[0060] S10102: The business system calls the aggregation signature system interface, registers identity information, calls the server cryptomachine to generate an SM2 key pair and a certificate request, applies for a digital certificate of the SM2 algorithm from the CA system through the aggregation signature system, the digital certificate is recorded as Cert_S, the certificate private key is recorded as CertPri_S, and the certificate public key is recorded as CertPub_S.

[0061] S10103: According to the principle of the SM2 elliptic curve algorithm, CertPub_S = CertPri_S [*] G, wherein G is a base point of the SM2 elliptic curve, [*] represents elliptic curve point multiplication (the same below), and CertPub_S is a point on the SM2 elliptic curve, and x and y coordinate bit strings of the point are represented as x-CertPub_S and y-CertPub_S respectively.

[0062] S102: An aggregation signature request is generated.

[0063] S10201: When a responsibility identification signature operation needs to be performed, a to-be-signed original text is generated by the business system and is recorded as MSG, the business system calculates a corresponding hash value by using the national SM3 hash algorithm and the hash value is recorded as H_MSG, and H_MSG = SM3(MSG); meanwhile, a URL address capable of displaying MSG is generated and is recorded as URL_MSG.

[0064] S10202: The business system calls the server cryptomachine to generate a random number k1 ∈ [1, n-1], wherein n is the order of the base point G (the same below), and Pub_k1 = k1 [*] G is calculated.

[0065] S10203: The business system splices a to-be-signed string of the aggregation signature request and is recorded as STR1, STR1 = URL_MSG || H_MSG || Cert_S || Pub_k1, wherein || represents splicing (the same below); the business system uses the self certificate private key CertPri_S to perform digital signature on STR1 by using the SM2 signature algorithm, a generated signature value is recorded as SV1, SV1 = SM2Sign(STR1, CertPri_S), and STR1 and SV1 are spliced, that is, an aggregation signature request is obtained, which is recorded as PSR, PSR = STR1 || SV1 = URL_MSG || H_MSG || Cert_S || Pub_k1 || SV1.

[0066] S10204: The business system sends the aggregation signature request PSR to the aggregation signature system and the signer.

[0067] S200: An authorization credential is generated.

[0068] S201: The signer applies for a digital certificate.

[0069] S20101: If the signer has applied for a digital certificate and the certificate is valid, the following steps are skipped.

[0070] S20102: The signer accesses the aggregated signature system, registers identity information, and after real-name authentication is passed, applies for a digital certificate of SM2 algorithm to the CA system through the aggregated signature system, the digital certificate is recorded as Cert_U, the certificate private key is recorded as CertPri_U, and the certificate public key is recorded as CertPub_U.

[0071] S20103: According to the principle of the SM2 elliptic curve algorithm, CertPub_U = CertPri_U [*] G, CertPub_U is a point on the SM2 elliptic curve, and the x and y coordinate bit strings are represented as x-CertPub_U and y-CertPub_U respectively.

[0072] S202: The signer confirms the aggregated signature request.

[0073] S20201: The signer logs in to the aggregated signature system using the digital certificate Cert_U, receives the aggregated signature request PSR, extracts URL_MSG, H_MSG, Cert_S, Pub_k1, and SV1 in PSR, uses the SM2 signature verification algorithm to verify PSR and Cert_S, and if the verification is passed, the next step is entered, otherwise it is indicated that the aggregated signature request is abnormal, and the business system is notified to reinitiate the aggregated signature request.

[0074] S20202: The signer clicks URL_MSG, and the aggregated signature system uses the national SM3 hash algorithm to verify whether the hash value of MSG is consistent with H_MSG, and if the verification is consistent, the next step is entered, otherwise it is indicated that MSG has been modified after being submitted by the business system, and the business system is notified to reinitiate the aggregated signature request.

[0075] S20203: The signer audits whether Cert_S and MSG are approved, and if approved, the next step is entered, otherwise the business system is notified to refuse to sign, and the process is terminated.

[0076] S203: Generate an authorization credential.

[0077] S20301: The aggregated signature system extracts CPub_S in Cert_S, calls a server cryptomachine to generate a random number k2∈[1,n-1], generates an authorization credential public key, recorded as CredPub_S, CredPub_S = CertPub_S[+] Pub_k1[+] H_MSG [*] G[+] k2 [*] G, wherein [+] represents elliptic curve point addition operation (the same below); CredPub_S is a point on the elliptic curve, and the x and y coordinate bit strings are represented as x-CredPub_S and y-CredPub_S respectively.

[0078] S20302: The signer uses the own certificate private key CertPri_U to perform digital signature on CredPub_S by SM2 signature algorithm, and a generated signature value is denoted as SV2, SV2 = SM2Sign(CredPub_S, CertPri_U).

[0079] S20303: The aggregation signature system calls the CA system to issue a digital certificate of SM2 algorithm for the authorized credential public key CredPub_S, denoted as CredCert_S, and the certificate public key of CredCert_S is CredPub_S. CertPub_U, CertPub_S, URL_MSG, H_MSG, SV1, SV2 are written in the certificate subject or extension item. The signature value of the CA system for CredCert_S is denoted as SV3. The digital certificate CredCert_S serves as the authorized credential of the aggregation signature, and the content includes {CredPub_S, CertPub_U, CertPub_S, URL_MSG, H_MSG, SV1, SV2, SV3}.

[0080] S20304: The aggregation signature system calculates a key factor, denoted as Factor_S, Factor_S = SM3(H_MSG || x-CredPub_S || y-CredPub_S || x-CertPub_U || y-CertPub_U) mod n, wherein mod represents a modulus operation (the same below).

[0081] S20305: The aggregation signature system calculates a partial aggregation signature private key, denoted as TPri_S, TPri_S = k2 + Factor_S * CertPri_U mod n.

[0082] S20306: The aggregation signature system encrypts TPri_S by using the public key CertPub_S of the business system, to generate a ciphertext of the partial aggregation signature private key, denoted as encrypted-TPri_S, encrypted-TPri_S = SM2Enc(TPri_S, CertPub_S).

[0083] S20307: The aggregation signature system concatenates CredCert_S || encrypted-TPri_S, and sends to the business system.

[0084] S300: Calculate an aggregation key.

[0085] S301: The business system receives the authorized credential and the key.

[0086] S30101: The business system receives CredCert_S||encrypted-TPri_S, extracts CredCert_S and encrypted-TPri_S, verifies whether the signature of CredCert_S is valid, if valid, enters the next process, otherwise, it is indicated that the authorization certificate is abnormal, and the process terminates.

[0087] S302: The business system calculates the aggregated signature private key.

[0088] S30201: The business system decrypts encrypted-TPri_S using CertPri_S to obtain TPri_S = SM2Dec(encrypted-TPri_S, CertPri_S), if the decryption fails, it is indicated that part of the ciphertext of the aggregated signature private key is abnormal, and the process terminates.

[0089] S30202: The business system calculates the complete aggregated signature private key, denoted as BusiPri_S, BusiPri_S = CertPri_S + TPri_S + k1 + H_MSG mod n.

[0090] S303: The business system verifies the aggregated signature public key.

[0091] S30301: The business system extracts CredPub_S and H_MSG from CredCert_S.

[0092] S30302: The business system calculates the key factor, Factor_S = SM3(H_MSG||x-CredPub_S||y-CredPub_S||x-CertPub_U||y-CertPub_U) mod n.

[0093] S30303: The business system calculates the complete aggregated signature public key, denoted as BusiPub_S, BusiPub_S = CredPub_S[+] Factor_S[*] CertPub_U.

[0094] S30304: The business system verifies the correctness of the complete aggregated signature public key, and confirms whether BusiPub_S is equal to BusiPri_S[*] G.

[0095] S30305: If equal, it is indicated that BusiPub_S and BusiPri_S can be matched as a pair of SM2 public and private keys, BusiPri_S is used for signing business data, and BusiPub_S is used for verifying the signature of the business data signature value; if not equal, the process terminates.

[0096] The following proves the correctness of BusiPub_S == BusiPri_S [*] G, where the variables are defined as follows (the integer modulo addition operation is omitted mod n):

[0097] BusiPub_S = CredPub_S [+] Factor_S [*] CertPub_U (1)

[0098] CredPub_S = CertPub_S [+] Pub_k1 [+] H_MSG [*] G [+] k2 [*] G (2)

[0099] CertPub_S = CertPri_S [*] G (3)

[0100] Pub_k1 = k1 [*] G (4)

[0101] CertPub_U = CertPri_U [*] G (5)

[0102] BusiPri_S = CertPri_S + TPri_S + k1 + H_MSG (6)

[0103] TPri_S = k2 + Factor_S * CertPri_U (7)

[0104] Substitute equations (3) and (4) into equation (2) to obtain:

[0105] CredPub_S = CertPri_S [*] G [+] k1 [*] G [+] H_MSG [*] G [+] k2 [*] G (8)

[0106] Substitute equations (8) and (5) into equation (1) to obtain:

[0107] BusiPub_S = CertPri_S [*] G [+] k1 [*] G [+] H_MSG [*] G [+] k2 [*] G [+] Factor_S [*] CertPri_U [*] G (9)

[0108] Simplify equation (9) to obtain:

[0109] BusiPub_S = (CertPri_S + k1 + H_MSG + k2 + Factor_S * CertPri_U) [*] G (10)

[0110] Substitute equation (7) into equation (6) to obtain:

[0111] BusiPri_S = CertPri_S + k2 + Factor_S * CertPri_U + k1 + H_MSG (11)

[0112] Adjust the right side value order of formula (11), and obtain:

[0113] BusiPri_S=CertPri_S+k1+H_MSG+k2+Factor_S*CertPri_U(12)

[0114] Substitute the right side of formula (12) into formula (10), and obtain BusiPub_S==BusiPri_S[*]G, and the proof is completed.

[0115] S400: Sign using the aggregation signature private key.

[0116] S40001: The business system uses the aggregation signature private key BusiPri_S to generate an aggregation signature value by the SM2 signature algorithm on the authorization certificate CredCert_S, denoted as SV4, SV4=SM2Sign(CredCert_S,BusiPri_S), and splices CredCert_S and SV4 to obtain the aggregation signature result, denoted as RES, RES=CredCert_S||SV4.

[0117] S500: Verify the aggregation signature.

[0118] When the electronic signature relying party needs to verify the validity of the aggregation signature result and the authorization certificate, the following process can be used for verification.

[0119] S501: Calculate the aggregation signature public key.

[0120] S50101: The business system extracts CredCert_S from the aggregation signature result RES, extracts H_MSG, CredPub_S, and CertPub_U from CredCert_S, obtains the x and y coordinate bit strings of the points on the elliptic curve corresponding to CredPub_S and CertPub_U, and obtains x-CredPub_S, y-CredPub_S, x-CertPub_U, and y-CertPub_U.

[0121] S50102: The business system calculates the key factor using the national SM3 hash algorithm, Factor_S=SM3(H_MSG||x-CredPub_S||y-CredPub_S||x-CertPub_U||y-CertPub_U) mod n.

[0122] S50103: The business system calculates the aggregation signature public key, BusiPub_S=CredPub_S[+]Factor_S[*]CertPub_U.

[0123] S502: verifying validity of the aggregated signature.

[0124] S50201: the business system extracts the authorization credential CredCert_S and the aggregated signature value SV4 from the aggregated signature result RES, verifies whether the CredCert_S is valid by using the aggregated signature public key BusiPub_S and the SV4, if valid, proceeds to the next step, otherwise, the aggregated signature is abnormal, and the process terminates.

[0125] S503: verifying validity of the authorization credential.

[0126] S50301: the business system extracts the authorization credential CredCert_S from the aggregated signature result RES, verifies validity of the signature of the CA system on the CredCert_S, that is, verifies whether the CredCert_S is valid by using the CA certificate public key and the SV3, if valid, proceeds to the next step, otherwise, the authorization credential is abnormal, and the process terminates.

[0127] S504: verifying validity of the signature of the signer.

[0128] S50401: the business system extracts the authorization credential CredCert_S from the aggregated signature result RES, extracts the CertPub_U, CredPub_S and SV2 from the CredCert_S, verifies whether the CredPub_S is valid by using the signer public key CertPub_U and the SV2, if valid, it is proved that the CredPub_S has not been tampered with after being signed by the signer and is approved by the signer, and since the CredPub_S is the public key of the CredCert_S, the signer cannot deny the signature.

[0129] In the embodiment, the signer needs to participate in the calculation process of the signature value by multiple parties when signing, form the aggregated signature authorization credential, and rely on the automatic evidence storage of the CA system of the CA institution; when verifying, the verification public key is calculated by the digital certificates of the multiple parties, and the aggregated signature authorization credential is verified, so as to solve the problem of the traditional signature which is only signed by the single signer and lacks the signature credential approved by multiple parties, and enhance the legal effect of the electronic signature.

[0130] The above-described embodiments only express the specific implementation of the present application, and the description is more specific and detailed, but it cannot be understood as a limitation on the scope of the patent of the present application. It should be noted that for ordinary skilled persons in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application.

Claims

1. A method of aggregating signatures and verification, characterized by, The method comprises the following steps: Step 1, initiating an aggregated signature request: a business system applies for a digital certificate and generates an aggregated signature request; In step 1, the business system generates the aggregated signature request as follows: When a responsibility identification signature operation is required, the business system generates a to-be-signed original text MSG, calculates a corresponding hash value H_MSG using a national secret SM3 hash algorithm, and generates a URL address URL_MSG that can display MSG; The business system calls a server cryptographic machine to generate a random number k1∈[1,n-1], wherein n is an order of a base point G, and calculates Pub_k1=k1[*]G; The business system splices a to-be-signed string of the aggregated signature request, denoted as STR1, STR1=URL_MSG||H_MSG||Cert_S||Pub_k1, wherein || represents splicing; the business system uses a private key CertPri_S of a self certificate to perform digital signature on STR1 through an SM2 signature algorithm to generate a signature value SV1, SV1=SM2Sign(STR1,CertPri_S), and splices STR1 and SV1 to obtain the aggregated signature request, denoted as PSR, PSR=STR1||SV1=URL_MSG||H_MSG||Cert_S||Pub_k1||SV1; The business system sends the aggregated signature request PSR to an aggregated signature system and a signer; Step 2, generating an authorization credential: the signer applies for a digital certificate and confirms the aggregated signature request, and simultaneously generates an authorization credential; In step 2, the authorization credential is generated as follows: The aggregated signature system extracts CPub_S in Cert_S, calls the server cryptographic machine to generate a random number k2∈[1,n-1], generates an authorization credential public key CredPub_S, CredPub_S=CertPub_S[+]Pub_k1[+]H_MSG[*]G[+]k2[*]G, wherein [+] represents an elliptic curve point addition operation; the x and y coordinate bit strings of CredPub_S are represented as x-CredPub_S and y-CredPub_S, respectively; The signer uses a private key CertPri_U of a self certificate to perform digital signature on CredPub_S through an SM2 signature algorithm to generate a signature value SV2, SV2=SM2Sign(CredPub_S,CertPri_U); The CA system issues a digital certificate of SM2 algorithm for the authorized credential public key CredPub_S, denoted as CredCert_S, and the certificate public key of CredCert_S is CredPub_S. The certificate subject or extension item is written with CertPub_U, CertPub_S, URL_MSG, H_MSG, SV1, SV2, and the signature value of CredCert_S by the CA system is denoted as SV3. The digital certificate CredCert_S is used as the authorized credential of the aggregated signature, and the content includes {CredPub_S, CertPub_U, CertPub_S, URL_MSG, H_MSG, SV1, SV2, SV3}; The aggregated signature system calculates a key factor, denoted as Factor_S, and the Factor_S=SM3(H_MSG||x-CredPub_S||y-CredPub_S||x-CertPub_U||y-CertPub_U) mod n, wherein mod represents a modulus operation; The aggregated signature system calculates a partial aggregated signature private key, denoted as TPri_S, and the TPri_S=k2+Factor_S*CertPri_U mod n. The aggregated signature system encrypts TPri_S using the public key CertPub_S of the business system to generate a ciphertext of the partial aggregated signature private key, denoted as encrypted-TPri_S, and the encrypted-TPri_S=SM2Enc(TPri_S, CertPub_S); The aggregated signature system concatenates CredCert_S||encrypted-TPri_S and sends the concatenated result to the business system; Step 3, calculating an aggregated key: the business system receives the authorized credential and the key, and calculates an aggregated signature private key and verifies an aggregated signature public key; The step 3 specifically includes the following steps: Step 3.1, the business system receives CredCert_S||encrypted-TPri_S, extracts CredCert_S and encrypted-TPri_S, verifies whether the signature of CredCert_S is valid, if valid, the process proceeds to the next step, otherwise, the authorized credential is abnormal, and the process is terminated; Step 3.2, the business system decrypts encrypted-TPri_S using CertPri_S to obtain TPri_S=SM2Dec(encrypted-TPri_S, CertPri_S), if the decryption fails, the ciphertext of the partial aggregated signature private key is abnormal, and the process is terminated. The business system calculates a complete aggregated signature private key, denoted as BusiPri_S, and the BusiPri_S=CertPri_S+TPri_S+k1+H_MSG mod n; Step 3.3, the business system extracts CredPub_S, H_MSG from CredCert_S; the business system calculates the key factor, Factor_S = SM3(H_MSG||x-CredPub_S||y-CredPub_S||x-CertPub_U||y-CertPub_U) mod n; the business system calculates the complete aggregate signature public key, denoted as BusiPub_S, BusiPub_S = CredPub_S[+] Factor_S[*] CertPub_U; the business system verifies the correctness of the complete aggregate signature public key, confirms whether BusiPub_S is equal to BusiPri_S[*] G; if equal, BusiPub_S and BusiPri_S match as a pair of SM2 public and private keys, BusiPri_S is used for signing business data, and BusiPub_S is used for verifying the signature of business data signature value; if not equal, the process terminates; Step 4, signing using aggregate signature private key: the business system signs the authorization credential using the aggregate signature private key to obtain the aggregate signature result; Step 5, verifying the aggregate signature: calculating the aggregate signature public key and verifying the validity of the aggregate signature, the authorization credential and the signer's signature.

2. The method of aggregated signature and verification according to claim 1, wherein, In step 1, the business system applies for a digital certificate as follows: The business system calls the aggregate signature system interface, registers identity information, calls the server password machine to generate an SM2 key pair and a certificate request, applies for a digital certificate of SM2 algorithm to the CA system through the aggregate signature system, the digital certificate is denoted as Cert_S, the certificate private key is denoted as CertPri_S, and the certificate public key is denoted as CertPub_S; According to the principle of SM2 elliptic curve algorithm, CertPub_S = CertPri_S[*] G, wherein G is the base point of the SM2 elliptic curve, [*] represents elliptic curve point multiplication operation; CertPub_S is a point on the SM2 elliptic curve, and the x and y coordinate bit strings are denoted as x-CertPub_S and y-CertPub_S respectively.

3. The method of aggregate signature and verification according to claim 1, wherein, In step 2, the signer applies for a digital certificate as follows: The signer accesses the aggregate signature system, registers identity information, and after real-name authentication, applies for a digital certificate of SM2 algorithm to the CA system through the aggregate signature system, the digital certificate is denoted as Cert_U, the certificate private key is denoted as CertPri_U, and the certificate public key is denoted as CertPub_U; According to the principle of SM2 elliptic curve algorithm, CertPub_U = CertPri_U[*] G, CertPub_U is a point on the SM2 elliptic curve, and the x and y coordinate bit strings are denoted as x-CertPub_U and y-CertPub_U respectively.

4. The method of aggregated signature and verification according to claim 3, wherein, In step 2, the confirmation of the aggregate signature request is as follows: The signer logs in the aggregation signature system using the digital certificate Cert_U, receives an aggregation signature request PSR, extracts the URL_MSG, H_MSG, Cert_S, Pub_k1 and SV1 in the PSR, uses an SM2 signature verification algorithm to verify the PSR and the Cert_S, and if the verification is passed, proceeds to the next step, otherwise, it is indicated that the aggregation signature request is abnormal, and the business system is notified to reinitiate the aggregation signature request; The signer clicks the URL_MSG, and the aggregation signature system uses a national secret SM3 hash algorithm to verify whether the hash value of the MSG is consistent with the H_MSG, and if the verification is consistent, proceeds to the next step, otherwise, it is indicated that the MSG is modified after being submitted by the business system, and the business system is notified to reinitiate the aggregation signature request; The signer audits whether the Cert_S and the MSG are approved, and if approved, proceeds to the next step, otherwise, the business system is notified to refuse to sign, and the process is terminated.

5. The method for aggregated signature and verification according to claim 1, wherein, The step 4 is specifically as follows: The business system uses an aggregation signature private key BusiPri_S to generate an aggregation signature value by using an SM2 signature algorithm on the authorization certificate CredCert_S, denoted as SV4, SV4=SM2Sign(CredCert_S,BusiPri_S), splices the CredCert_S and the SV4 to obtain an aggregation signature result, denoted as RES, RES=CredCert_S||SV4.

6. The method of aggregated signature and verification according to claim 5, wherein, In the step 5, the aggregation signature public key is calculated as follows: The business system extracts the H_MSG, CredPub_S and CertPub_U from the CredCert_S from the aggregation signature result RES, obtains the x and y coordinate bit strings of the points on the elliptic curve corresponding to the CredPub_S and the CertPub_U, and obtains x-CredPub_S, y-CredPub_S, x-CertPub_U and y-CertPub_U respectively; The business system uses a national secret SM3 hash algorithm to calculate a key factor, Factor_S=SM3(H_MSG||x-CredPub_S||y-CredPub_S||x-CertPub_U||y-CertPub_U) mod n; The business system calculates the aggregation signature public key, BusiPub_S=CredPub_S[+]Factor_S[*]CertPub_U.

7. The method of aggregated signature and verification according to claim 6, wherein, In the step 5, the validity of the aggregation signature, the authorization certificate and the signer's signature is verified as follows: The business system extracts the authorization certificate CredCert_S and the aggregation signature value SV4 from the aggregation signature result RES, uses the aggregation signature public key BusiPub_S and the SV4 to verify whether the CredCert_S is valid, and if valid, proceeds to the next step, otherwise, it is indicated that the aggregation signature is abnormal, and the process is terminated; The business system extracts the authorization credential CredCert_S from the aggregated signature result RES, verifies the signature validity of CredCert_S by the CA system, that is, verifies whether CredCert_S is valid by the CA certificate public key and SV3, if valid, enters the next process, otherwise, the authorization credential is abnormal, and the process terminates; The business system extracts the authorization credential CredCert_S from the aggregated signature result RES, extracts CertPub_U, CredPub_S and SV2 from CredCert_S, and verifies whether CredPub_S is valid by using the signer public key CertPub_U and SV2, if valid, it is proved that CredPub_S has not been tampered with after being signed by the self-signer and is approved by the signer, and since CredPub_S is the public key of CredCert_S, the signer cannot deny the signature behavior.

Images