An anonymous communication method, system and medium based on blind signature

Abstract

The application relates to the technical field of anonymous communication and provides an anonymous communication method and system based on blind signature and a medium, the method comprising the following steps: a sender generates a blind signature request containing public metadata and a message token, sends the blind signature request to a signature server, and the signature server performs blind signature; the sender performs de-blinding on the received blind signature result, obtains an anonymous token, and sends an authorization request to a bulletin board server; the bulletin board server verifies the validity of the anonymous token, allocates a mailbox and a corresponding writing time window to the sender; the sender obtains the writing permission of the mailbox within the time window, and then delivers a ciphertext to the mailbox; a receiver sends a private information retrieval request to the bulletin board server based on the mailbox identifier informed by the sender, and receives returned response ciphertext; and the receiver uses a PIR private key and a session key to decrypt the response ciphertext, and obtains a plaintext message. The application guarantees the strong privacy of both communication parties and realizes the safe transmission of confidential messages.

Description

Technical Field

[0001] This invention belongs to the field of anonymous communication technology, and in particular relates to an anonymous communication method, system and medium based on blind signature. Background Technology

[0002] In the information age, the internet has become a core platform for information transmission and social interaction, but the resulting privacy breaches are becoming increasingly serious. Although end-to-end encryption technologies (such as the Signal protocol) can protect communication content, the metadata generated during the communication process—including the identities of the communicating parties, time, frequency, and social relationships—remains exposed to the monitoring of signature servers or internet service providers. Research shows that sensitive personal information can be inferred solely from metadata, posing a significant threat to personal privacy and security.

[0003] While existing anonymous communication systems such as Tor routing and hybrid networks improve anonymity to some extent, Tor can still identify communicating parties by analyzing traffic patterns, and Mix-Nets struggle to support real-time communication due to high latency. Furthermore, classic blind signatures are primarily used to achieve unconditional anonymity. However, in real-world communication scenarios, it is often necessary to impose "context" or "permission" constraints on communication behavior while maintaining user anonymity. Current blind signature systems generally employ static communication models, assigning fixed email addresses to users and lacking dynamic management capabilities for communication permissions, failing to bind communication behavior to specific contexts or access control policies. This static model not only lacks flexibility, but its inherent write patterns can still potentially leak metadata clues. Summary of the Invention

[0004] To address the problems existing in the prior art, the present invention provides an anonymous communication method based on blind signatures, the communication method comprising the following steps:

[0005] S1: Based on the public key generated by the signature server, the sender generates a blind signature request containing public metadata and a message token;

[0006] S2: The sender sends the blind signature request to the signature server, so that the signature server performs a blind signature on the blind signature request based on the blind signature request and the private key generated by the signature server and returns the blind signature result;

[0007] S3: The sender deblindifies the received blind signature result, obtains an anonymous token, and sends an authorization request to the bulletin board server. After verifying the validity of the anonymous token, the bulletin board server allocates a mailbox and a corresponding writing time window to the sender.

[0008] S4: After obtaining write permission to the mailbox within the time window, the sender delivers ciphertext to the mailbox provided by the bulletin board server. The ciphertext is an encrypted plaintext message.

[0009] S5: The receiver initiates a privacy information retrieval request to the bulletin board server based on the mailbox identifier provided by the sender, and receives the encrypted response returned by the bulletin board server;

[0010] S6: The receiver uses the PIR private key and session key to decrypt the ciphertext of the response and obtain the plaintext message.

[0011] Based on the above scheme, the method for the signature server to generate public and private keys specifically includes:

[0012] S1.11: Choose two safe prime numbers p and q Calculate the strong RSA modulus N = p·q ;

[0013] S1.12: Generate a cryptographically secure random byte string as a public salt. salt ;

[0014] S1.13: Generate public key pk SP = ( N, salt ), φ ( N )=( p -1)·( q -1) is used as the private key.

[0015] Specifically, the public metadata is contextual information that is visible to the recipient, sender, signature provider, and bulletin board server.

[0016] Based on the above scheme, the steps for the sender to generate a blind signature request are as follows:

[0017] S1.3: Generate a λ-bit random string as a message token;

[0018] S1.4: Using a hash function H MD Calculate the public key index bound to the public metadata. e D ;

[0019] S1.5: Selecting a random blinding factor r ;

[0020] S1.6: Calculate the commitment value of the blind signature request using the hash function H. h ;

[0021] S1.7: Calculate the blinded message based on the commitment value, blinding factor, and public key index;

[0022] S1.8: Send a blind signature request to the signature server. The blind signature request includes a blind message and public metadata.

[0023] Furthermore, the step of the signature server returning the blind signature specifically includes:

[0024] S2.1: The signature server receives the blind signature request and determines whether the public metadata is valid;

[0025] S2.2: If the public metadata is valid, the signature server calculates the public key index based on the public metadata and the public salt value;

[0026] S2.3: Calculate the private key exponent using the private key. d D ;

[0027] S2.4: Calculate a blind signature using the private key index and return the blind signature result to the sender.

[0028] Based on the above scheme, step S3 specifically includes:

[0029] S3.1: Multiply the blind signature result by the modular inverse of the blinding factor to remove the blinding, and obtain the anonymous token. T A ;

[0030] S3.2: The sending direction sends an authorization request to the bulletin board server, the authorization request including an anonymous token, a message token, and public metadata;

[0031] S3.3: The bulletin board server obtains system parameters associated with the public metadata from the database or cache. The system parameters include the RSA modulus and the public salt value.

[0032] S3.4: The bulletin board server calculates the public key index. e D and commitment value h ,examine If the authorization request is not valid, then reject it; if it is valid, proceed to step S3.5.

[0033] S3.5: The bulletin board server queries the used_tokens database and checks... T A If the anonymous token exists, it means that the anonymous token has been used, and the authorization request is rejected; if it does not exist, proceed to step S3.6.

[0034] S3.6: The bulletin board server generates a λ-bit random string as a handle. token id and specify the effective time window [ t min , t max ];

[0035] S3.7: The bulletin board server returns the handle, time window, and mailbox index to the sender. id x The mailbox index is the index of an idle mailbox allocated by the bulletin board server to the sender.

[0036] Furthermore, the step of delivering encrypted information in step S4 is as follows:

[0037] S4.1: Within the time window, the sender generates a random number as an identifier for message delivery;

[0038] S4.2: Take the session key, associated data, and identifier as input, and use the authentication encryption scheme to encrypt the original plaintext message to be sent to form ciphertext;

[0039] S4.3: The sending direction sends a write request to the bulletin board server, the write request including the encrypted message, handle and mailbox index;

[0040] S4.4: The bulletin board server queries the used_tokens database through the handle, and obtains the mailbox index and valid time window from the database for permission verification;

[0041] S4.5: If the permission verification is successful, the bulletin board server will store the encrypted text in the messages database and associate the encrypted text with the mailbox.

[0042] Based on the above scheme, the method for the recipient to initiate a privacy information retrieval request in step S5 includes:

[0043] S5.1: The receiver construction T A unit vector of dimension , the unit vector of dimension . id x Each component is 1;

[0044] S5.2: Encode the unit vector into a plaintext polynomial;

[0045] S5.3: Encrypt the plaintext polynomial using an encryption algorithm, generate the PIR query ciphertext, and send it to the bulletin board server.

[0046] S5.4: The bulletin board server calculates the homomorphic dot product of the PIR query ciphertext and the database ciphertext vector based on the BFV homomorphic encryption scheme to generate the response ciphertext; wherein the database ciphertext vector is composed of encrypted messages stored in each mailbox.

[0047] Based on the same inventive concept, this invention provides an anonymous communication system based on blind signatures. The system includes a signature server, a bulletin board server, a sender, and a receiver.

[0048] The sender generates a blind signature request containing public metadata and a message token based on the public key generated by the signature server.

[0049] The sender sends the blind signature request to the signature server;

[0050] The signature server performs a blind signature on the blind signature request based on the blind signature request and the private key generated by the signature server, and returns the blind signature result;

[0051] The sender deblindifies the received blind signature result, obtains an anonymous token, and sends an authorization request to the bulletin board server.

[0052] After verifying the validity of the anonymous token, the bulletin board server assigns a mailbox and a corresponding writing time window to the sender.

[0053] After obtaining write permission to the mailbox within the time window, the sender delivers encrypted information to the mailbox provided by the bulletin board server.

[0054] The recipient initiates a privacy information retrieval request to the bulletin board server based on the mailbox identifier provided by the sender, and receives the encrypted response returned by the bulletin board server;

[0055] The receiver uses the PIR private key and session key to decrypt the ciphertext of the response and obtain the plaintext information.

[0056] The present invention also provides a computer-readable storage medium having a computer program that, when executed by a processor, implements the steps of the anonymous communication method based on blind signatures as described above.

[0057] Compared with the prior art, the present invention has the following beneficial effects:

[0058] 1. An anonymous token was successfully obtained through metadata blind signing, and an encrypted message was delivered to the mailbox of the bulletin board server. The bulletin board server only knows that an anonymous token has been stored, but cannot know the identity information of the sender.

[0059] 2. The recipient uses privacy information to retrieve and accurately obtain the target message and complete the decryption without revealing the query intent. The bulletin board server cannot know the target message obtained by the recipient, nor can it associate the message obtained by the recipient with the message stored by the sender.

[0060] 3. Binding public metadata to the RSA blind signature process adds flexible and verifiable context-aware capabilities to anonymous communication, enabling anonymous communication to meet more complex permission management needs while ensuring high privacy, and expanding the application scope of anonymous communication;

[0061] 4. The method of this application fundamentally blocks the possibility of communication data leakage, making the sender and receiver unaware of each other, thus ensuring the privacy and security of both parties in the communication. Attached Figure Description

[0062] Figure 1 This is a flowchart illustrating the overall process of the method described in this application.

[0063] Figure 2 This is a diagram illustrating the overall architecture of this application;

[0064] Figure 3 Flowchart for session key generation in this application;

[0065] Figure 4 Flowchart for obtaining anonymity permission in this application;

[0066] Figure 5 This is a flowchart of the message encryption and delivery process in this application;

[0067] Figure 6 This is a flowchart of the privacy information retrieval process in this application. Detailed Implementation

[0068] The invention will be further described below with reference to specific embodiments.

[0069] It should be noted that in this application, "plaintext message" is equivalent to "original plaintext message", "sender" is equivalent to "Alice" or "A", "receiver" is equivalent to "Bob" or "B", "signature server" is equivalent to "signature service provider" or "SP", "bulletin board server" is equivalent to "bulletin board" or "BB", and "public metadata" is equivalent to "metadata". Therefore, if the above or other terms with the same meaning are present at the same time, there is no ambiguity.

[0070] Table 1. Main Symbols and Their Meanings

[0071]

[0072] Traditional anonymous communication aims to hide identity. However, in practical applications, anonymous communication requires authentication of user qualifications or permissions. Based on this practical application requirement, this invention provides an anonymous communication method, system, and medium based on blind signatures, allowing users to anonymously obtain a "temporary communication license" bound to public metadata, and communicate only with this license in a specified time, space, or logical "mailbox".

[0073] Example 1

[0074] like Figure 1 and Figure 2 As shown, this invention provides an anonymous communication method based on blind signatures, the communication method comprising the following steps:

[0075] S1: Based on the public key generated by the signature server, the sender generates a blind signature request containing public metadata and a message token;

[0076] Among them, such as Figure 3 As shown, the method for the signature server to generate public and private keys specifically includes the following steps:

[0077] S1.11: Choose two safe prime numbers p and q Calculate the strong RSA modulus N = p·q ;

[0078] In this embodiment, safe prime pairs p and q The method of obtaining it is:

[0079] (1) The signature server selects two large prime numbers of size λ bits. p' , q' ,calculate p =2 p' +1, q =2 q' +1, where λ is a safety parameter;

[0080] (2) Judgment p and q Are all numbers prime? If not all numbers are prime, the signature server repeats step (1) above. If all numbers are prime, then at this time... p , q ) are safe prime pairs.

[0081] S1.12: The signature server generates a cryptographically secure random byte string as a public salt. salt This public salt value is used in the hashing process.

[0082] S1.13: Generate public key pk SP= ( N , salt The public key is public and can be accessed; the signature server... N Euler's totient function value φ ( N ) as private key sk SP = φ ( N This private key is kept strictly confidential by the signing server and is used to calculate blind signatures.

[0083] Through the steps described above in this embodiment, the signature server generates a public key associated with the blind signature bound to the metadata, as well as its own private key. Simultaneously, the receiver and sender negotiate a session key. The generation of the session key includes the following steps:

[0084] S1.21: The sender generates a temporary elliptic curve key pair ( s A , P A ): Select a random scalar s A ← Z q * Use it as your private key and calculate the corresponding public key. P A ←s A ·G , s A ∈{1,2,..., q -1};

[0085] Where G is the base point of the elliptic curve. q Let be the order of the elliptic curve. s A For the sender's temporary private key, P A This is the sender's temporary public key;

[0086] The receiver generates a temporary elliptic curve key pair ( s B , P B ), select random scalar s B ← Z q * Use it as your private key and calculate the corresponding public key. P B ←s B ·G ,s B ∈{1,2,..., q -1};

[0087] Where G is the base point of the elliptic curve. q Let be the order of the elliptic curve. s B For the recipient's temporary private key, P B This is the recipient's temporary public key.

[0088] In other embodiments, elliptic curves such as Curve448 or Goldilocks can be used.

[0089] The receiver and sender then exchange temporary public keys through the established authentication channel. P A and P B .

[0090] S1.22: The sender uses s A and P B Computational shared secrets K raw ← s A ·P B =s A · ( s B ·G )=( s A s B ) ·G The receiver uses s B and P A Calculate the same shared secret K raw ← s B ·P A =s B · ( s A ·G )=( s B s A ) ·G ;

[0091] S1.23: Using SHA-256 as the underlying hash function, a context-sensitive string is provided as the info parameter, and a session key is generated based on the shared secret and the info parameter. k AB ←HKDF SHA-256 ( salt = K raw , info , L =32 bytes), where L is the length of the session key;

[0092] Using the info parameter ensures that the same shared secret can derive different keys in different scenarios, protocols, or roles, preventing reflection and cross-protocol compatibility, and improving the security of the key. In this embodiment, the info parameter may include a protocol fixed label and version number, cipher suite identifier, role label, transcription hash of the current session and subsequent mailbox index, and time window.

[0093] In this embodiment, through the above steps, the receiver and sender negotiate and generate a one-time symmetric session key. k AB The session key enables end-to-end encryption of communication content. In this case, it is assumed that the receiver and the sender exchange their long-term identity authentication information through an out-of-band secure channel, which is either a physical meeting or other encrypted communication that has established trust.

[0094] Before the sender delivers the message, it needs to interact with the signature server and the bulletin board server to obtain anonymous communication permission. First, the sender generates a blind signature request, which allows it to obtain a digital signature from the signature server authorizing the message without revealing its specific content. Figure 4 As shown, the specific steps for the sender to generate a blind signature request are as follows:

[0095] S1.3: The sender generates a λ-bit random string as a unique identifier for this request; this unique identifier is called a message token. m tok ←{0,1} λ ;

[0096] S1.4: The sender uses a hash function. H MD Calculate and the public metadata D Bound public key index e D ← H MD ( salt || DThe public metadata is contextual information that is visible to the recipient, sender, signature provider, and bulletin board server.

[0097] Any contextual information that is visible to the recipient, sender, signature provider, and bulletin board server can be used as public metadata, such as date, service domain name, or version number.

[0098] In this embodiment, the hash function H MD As a variant of SHA-256, this hash function can output an odd number with a length much smaller than 1. p' , q' public key index e D Thus ensuring e D and φ ( N (mutual primes.) G For the hash function, first calculate the length as... γ hash value G ( D ), and then returned G ( D ) || 1, that is 2 · G ( D ) + 1.

[0099] S1.5: The sender selects a random blinding factor. r ← Z N * ;

[0100] S1.6: The sender uses a hash function. H Calculate the commitment value of the blind signature request. h ← H ( salt || D||m tok );

[0101] S1.7: The sender calculates the blinded message based on the commitment value, the blinding factor, and the public key exponent. ;

[0102] S1.8: The sending direction sends a blind signature request to the signature server. X , D The blind signature request includes a blinding message. X and public metadata D .

[0103] S2: The sender sends the blind signature request to the signature server, so that the signature server performs a blind signature on the blind signature request based on the blind signature request and the private key generated by the signature server and returns the blind signature result;

[0104] Step S2 is used to obtain the blind signature result. The specific steps of the signature server returning the blind signature include:

[0105] S2.1: The signature server receives a blind signature request ( X , D ), determine whether the public metadata is valid;

[0106] In step S2.1, the signature server generates a relevant metadata set MD based on geographical information, time, etc. The public metadata is generated by the signature server. At this time, it checks whether the public metadata in the blind signature request sent by the sender belongs to the set MD. If it belongs to the set, the public metadata is valid; if it does not belong to the set, the metadata is invalid.

[0107] S2.2: If the public metadata is valid, the signature server calculates the public key index based on the public metadata and the public salt value. e D ← H MD ( salt || D );

[0108] S2.3: The signing server uses its private key φ ( N The private key exponent is calculated using the extended Euclidean algorithm. d D ← e D -1 mod φ ( N );

[0109] In this embodiment, if D is appearing for the first time, the signature server will ( D , salt , e D , d D , N The public and private keys corresponding to D, along with the parameters required for computation, are stored in the service_params database. When performing the same D computation in subsequent communications, the keys and parameters can be directly retrieved from the database without needing to be generated again, thus improving efficiency.

[0110] S2.4: Calculate a blind signature using the private key exponent. The blind signature result is then returned to the sender.

[0111] S3: The sender deblindifies the received blind signature result, obtains an anonymous token, and sends an authorization request to the bulletin board server. After verifying the validity of the anonymous token, the bulletin board server allocates a mailbox and a corresponding writing time window to the sender.

[0112] like Figure 4 As shown, step S3 specifically includes:

[0113] S3.1: Multiply the blind signature result by the blinding factor. r The modular inverse is used to remove blinding and obtain the anonymous token. T A ← Y·r -1 mod N ;

[0114] S3.2: The sending direction sends an authorization request to the bulletin board server ( assign , T A ,m tok ,D The authorization request includes an anonymous token, a message token, and public metadata, with assign serving as the identifier for the authorization request;

[0115] In this embodiment, the sender obtains write permission by sending an anonymous token to the bulletin board server, specifically including:

[0116] S3.3: The bulletin board server retrieves system parameters associated with the public metadata from the database or cache, the system parameters including... N and salt ;

[0117] S3.4: The bulletin board server calculates the public key index. e D ←H MD ( salt || D ) and commitment value h ← H ( salt || D| |m tok ), Notice board server-side inspection If the authorization request is not valid, then reject it; if it is valid, proceed to step S3.5.

[0118] S3.5: The bulletin board server queries its used_token database and checks... TA If the anonymous token exists in the database, it means that the anonymous token has been used, and the authorization request is rejected; if it does not exist, proceed to step S3.6.

[0119] S3.6: Verification passed. The bulletin board server performs the following operations:

[0120] (1) Atomically allocate a mailbox index from a pool that maintains free mailboxes. id x ;

[0121] (2) Generate a λ-bit random string as the unique handle for this communication. token id ;

[0122] (3) Based on the effective time window size set by the system policy, set this... token id Effective time window [ t min , t max ];

[0123] (4) Insert a new record into the used_tokens database, the new record including ( token id , id x , t min , t max )and T A ;

[0124] (5) Insert into the used_tokens database T A The record.

[0125] S3.7: The bulletin board server returns the handle to the sender. token id Time window t min , t max ] and mailbox index id x The mailbox index is the index of an idle mailbox allocated by the bulletin board server to the sender.

[0126] The above steps in this embodiment involve inserting data into the database. T AThis mechanism records and prevents the token from being used multiple times, granting the sender a one-time write permission bound to metadata and valid within a specific time window. This effectively prevents token reuse and replay attacks, ensuring the uniqueness and security of write operations.

[0127] S4: After obtaining write permission to the mailbox within the time window, the sender delivers ciphertext to the mailbox provided by the bulletin board server. The ciphertext is an encrypted plaintext message.

[0128] like Figure 5 As shown, the step of delivering encrypted information in step S4 is as follows:

[0129] S4.1: Within the time window, the sender generates a 96-bit random number that is unique to the message to be communicated. nonce ← {0,1} 96 As an identifier for message delivery;

[0130] S4.2: Taking the session key, associated data, and identifier as input, encrypt the original plaintext message to be sent using the Authentication Encryption Scheme (AEAD) to form ciphertext c. ← AEAD.Enc(k AB , nonce, m, AD) .

[0131] It is important to note that AD is data that is authenticated but not encrypted along with the ciphertext. First, it must contain the public metadata D used. In addition to this required D, other information can be added, such as: fixed tags and version, package identifier, direction and other contextual information.

[0132] In this embodiment, AES-256-GCM is used for encryption when delivering encrypted messages, where AD represents associated data. AD It includes contextual information to prevent ciphertext from being used in incorrect contexts. Tag verification will fail if there is any difference between the AD provided during decryption and the AD provided during encryption.

[0133] S4.3: The sending direction sends a write request to the bulletin board server ( write , token id , id x , c The write request includes the ciphertext, handle, and mailbox index;

[0134] S4.4: The bulletin board server performs permission verification:

[0135] via handle token idQuery the used_tokens database to retrieve the stored mailbox index. idx' and the effective time window [ t min , t max ];

[0136] If written in the request id x = id x ' If the current time is within the valid time window, the verification is successful.

[0137] The permission verification in S4.4 is matched with the data stored in the database when the bulletin board server processes the authorization request in step S3.6, to ensure that the sender can only write to a specific mailbox that is authorized and has not expired during communication.

[0138] S4.5: If the permission verification passes, the bulletin board server will send the encrypted message. c Store it in the messages database.

[0139] Through the above steps, the sender securely writes the encrypted message into the mailbox of the bulletin board server, enabling the receiver to retrieve it.

[0140] S5: The receiver sends a privacy information retrieval request to the bulletin board server based on the mailbox index provided by the sender, and receives the encrypted response returned by the bulletin board server. The mailbox index is provided by the sender through an out-of-band secure channel.

[0141] like Figure 6 As shown, the method for the recipient to retrieve privacy information in step S5 includes:

[0142] S5.1: The receiver constructs a T-dimensional unit vector. v ∈{0,1} T The unit vector of the first id x One component is 1, and all other components are 0;

[0143] S5.2: The receiver will transfer the unit vector v Encoded as BFV plaintext polynomial p ( x );

[0144] S5.3: Encrypt the plaintext polynomial using the BFV encryption algorithm to generate the PIR query ciphertext. q ← HE.Enc(pk PIR , p ( xAnd send it to the bulletin board server;

[0145] S5.4: Using the BFV scheme, the bulletin board server will set the database DB=( mailbox 1, mailbox 2,..., mailbox 1T Each mailbox's content is treated as a ciphertext vector. Without knowing the mailbox index, the query ciphertext is calculated. q The response ciphertext is generated by the homomorphic dot product of the ciphertext vector and the ciphertext vector. a The ciphertext vector is the encrypted message stored in each mailbox.

[0146] In this embodiment, the BFV scheme is used, which treats a ciphertext as a vector. A single homomorphic operation can be applied to multiple components of the vector simultaneously, enabling a single communication query to be efficiently computed in parallel on the row level, significantly reducing CPU overhead.

[0147] In this embodiment, the homomorphic dot product operation utilizes the ciphertext-plaintext multiplication and ciphertext addition properties of the BFV scheme. Because... q yes v Encryption, v It is a unit vector, and has < v, DB > = mailbox idx Therefore, the calculation of the homomorphic dot product... HE.Enc(pk PIR , < v, DB >) = ⊕ T i=1 (HE.Enc(pk PIR ,v i ) mailbox i In cryptography, this is equivalent to computation. HE.Enc(pk PIR , DB idx ).

[0148] S6: The receiver uses the PIR private key and session key to decrypt the ciphertext of the response and obtain the plaintext message. This step specifically includes:

[0149] S6.1: The receiver uses a PIR private key. sk Answer ciphertext a The plaintext content in the target mailbox was recovered; this plaintext content was the AEAD ciphertext stored by the sender. c' ← HE.Dec ( sk, a );

[0150] S6.2: The receiver uses the session keyk AB and from c' Extracted from nonce' For the AEAD ciphertext c' Decrypt m' ← AEAD.Dec ( k AB , nonce' , c' AD ' );

[0151] S6.3: If the AEAD authentication tag verification is successful, output the final plaintext message. m' Otherwise, it is considered an invalid message and discarded.

[0152] Based on the same technical concept, this invention also provides an anonymous communication system based on blind signatures, including a signature server, a bulletin board server, a sender, and a receiver, wherein...

[0153] The sender generates a blind signature request containing public metadata and a message token based on the public key generated by the signature server.

[0154] The sender sends the blind signature request to the signature server;

[0155] The signature server performs a blind signature on the blind signature request based on the blind signature request and the private key generated by the signature server, and returns the blind signature result;

[0156] The sender deblindifies the received blind signature result, obtains an anonymous token, and sends an authorization request to the bulletin board server.

[0157] After verifying the validity of the anonymous token, the bulletin board server assigns a mailbox and a corresponding writing time window to the sender.

[0158] After obtaining write permission to the mailbox within the time window, the sender delivers encrypted information to the mailbox provided by the bulletin board server.

[0159] The recipient initiates a privacy information retrieval request to the bulletin board server based on the mailbox identifier provided by the sender, and receives the encrypted response returned by the bulletin board server;

[0160] The receiver uses the PIR private key and session key to decrypt the ciphertext of the response and obtain the plaintext information.

[0161] The bulletin board server includes an encrypted message database containing multiple mailboxes, and the signature server includes a metadata database for storing metadata-related information.

[0162] The specific implementation of this system is the same as the implementation of the anonymous communication method described above, and will not be repeated here.

[0163] Furthermore, the anonymous communication method according to the present invention can be recorded in a computer-readable recording medium. Specifically, according to the present invention, a computer-readable recording medium storing computer-executable instructions can be provided, which, when executed by a processor, cause the processor to execute the anonymous communication method as described above.

[0164] Example 2

[0165] This embodiment provides an anonymous communication method based on blind signatures. The method is the same as in Embodiment 1, except that the public metadata includes, but is not limited to, the following elements:

[0166] Geographic information is used to constrain the applicable domains of licenses, supporting geographic-based policy control and auditing;

[0167] UTC time base uses a unified time zone to eliminate time zone ambiguity and serves as the aiming point for window switching;

[0168] Anonymous bucket IDs are derived by the signature server based on the user's internal identifier (UID) and geographic information, with the first b bits mapped to B=2. b When using this anonymous bucket ID, only the bucket number is disclosed, not the UID.

[0169] To ensure security and interoperability, public metadata uses a uniquely resolvable encoding (such as length prefix concatenation) and is bound to the AD association parameters of subsequent AES-256-GCM for integrity protection, preventing degradation, mismatch, and replay.

[0170] This embodiment introduces public metadata containing geographic information, UTC time base, and anonymous bucket ID, and employs a unique and resolvable encoding method to achieve a structured description of the anonymous communication context. This metadata is bound to the AD parameters of AES-256-GCM for integrity, effectively preventing metadata tampering, degradation, and replay attacks.

[0171] It should be noted that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, program segment, or portion of code containing at least one executable instruction for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0172] In general, various exemplary embodiments of the present invention can be implemented in hardware or dedicated circuitry, software, firmware, logic, or any combination thereof. Some aspects can be implemented in hardware, while others can be implemented in firmware or software that can be executed by a controller, microprocessor, or other computing device. When aspects of embodiments of the present invention are illustrated or described as block diagrams, flowcharts, or represented using certain other images, it will be understood that the blocks, apparatuses, systems, techniques, or methods described herein can be implemented as non-limiting examples in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or controllers or other computing devices, or certain combinations thereof.

[0173] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

[0174] While the specific embodiments of the present invention have been described above, they are not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. An anonymous communication method based on blind signatures, characterized in that, The communication method includes the following steps: S1: Based on the public key generated by the signature server, the sender generates a blind signature request containing public metadata and a message token; The sender uses a hash function to calculate the public key index bound to the public metadata, and calculates the blinded message based on the commitment value, blinding factor and public key index of the blind signature request calculated using the hash function. S2: The sender sends the blind signature request to the signature server, so that the signature server performs a blind signature on the blind signature request based on the blind signature request and the private key generated by the signature server and returns the blind signature result; Wherein, after receiving a blind signature request and determining that the public metadata is valid, the signature server calculates the public key index based on the public metadata and the system public salt value, and uses the private key index corresponding to the public key index to calculate the blind signature result; S3: The sender deblindifies the received blind signature result, obtains an anonymous token, and sends an authorization request to the bulletin board server. After verifying the validity of the anonymous token, the bulletin board server allocates a mailbox and a corresponding writing time window to the sender. S4: After obtaining write permission to the mailbox within the time window, the sender delivers ciphertext to the mailbox provided by the bulletin board server. The ciphertext is an encrypted plaintext message. S5: The receiver initiates a privacy information retrieval request to the bulletin board server based on the mailbox identifier provided by the sender, and receives the encrypted response returned by the bulletin board server; The receiver constructs a unit vector, encodes the unit vector into a plaintext polynomial, and uses an encryption algorithm to generate a PIR query ciphertext; the bulletin board server, based on the BFV scheme, calculates the homomorphic dot product of the PIR query ciphertext and the ciphertext vector composed of ciphertexts stored in each mailbox to generate the response ciphertext. S6: The receiver uses the PIR private key and session key to decrypt the ciphertext of the response and obtain the plaintext message.

2. The anonymous communication method based on blind signatures according to claim 1, characterized in that, The method for the signature server to generate public and private keys specifically includes: S1.11: Choose two safe prime numbers p and q Calculate the strong RSA modulus N=p·q ; S1.12: Generate a cryptographically secure random byte string as a public salt. salt ; S1.13: Generate public key pk SP =(N, salt) , φ ( N ) = ( p- 1) · ( q- 1) As a private key.

3. The anonymous communication method based on blind signatures according to claim 1, characterized in that, The public metadata is contextual information that is visible to the recipient, sender, signature provider, and bulletin board server.

4. The anonymous communication method based on blind signatures according to claim 3, characterized in that, The steps for the sender to generate a blind signature request are as follows: S1.3: Generate a λ-bit random string as a message token; S1.4: Using a hash function H MD Calculate the public key index bound to the public metadata. e D ; S1.5: Selecting a random blinding factor r ; S1.6: Calculate the commitment value of the blind signature request using the hash function H. h ; S1.7: Calculate the blinded message based on the commitment value, blinding factor, and public key index; S1.8: Send a blind signature request to the signature server. The blind signature request includes a blind message and public metadata.

5. The anonymous communication method based on blind signatures according to claim 4, characterized in that, The steps for the signature server to return a blind signature specifically include: S2.1: The signature server receives the blind signature request and determines whether the public metadata is valid; S2.2: If the public metadata is valid, the signature server calculates the public key index based on the public metadata and the public salt value; S2.3: Calculate the private key exponent using the private key. d D ; S2.4: Calculate a blind signature using the private key index and return the blind signature result to the sender.

6. The anonymous communication method based on blind signatures according to claim 5, characterized in that, Step S3 specifically includes: S3.1: Multiply the blind signature result by the modular inverse of the blinding factor to remove the blinding, and obtain the anonymous token. T A ; S3.2: The sending direction sends an authorization request to the bulletin board server, the authorization request including an anonymous token, a message token, and public metadata; S3.3: The bulletin board server obtains system parameters associated with the public metadata from the database or cache. The system parameters include the RSA modulus and the public salt value. S3.4: The bulletin board server calculates the public key index. e D and commitment value h ,examine If the authorization request is not valid, then reject it; if it is valid, proceed to step S3.

5. S3.5: The bulletin board server queries the used_tokens database and checks... T A If the anonymous token exists, it means that the anonymous token has been used, and the authorization request is rejected; if it does not exist, proceed to step S3.

6. S3.6: The bulletin board server generates a λ-bit random string as a handle. token id and specify the effective time window [ t min , t max ]; S3.7: The bulletin board server returns the handle, time window, and mailbox index to the sender. id x The mailbox index is the index of an idle mailbox allocated by the bulletin board server to the sender.

7. The anonymous communication method based on blind signatures according to claim 6, characterized in that, The step of delivering encrypted information in step S4 is as follows: S4.1: Within the time window, the sender generates a random number as an identifier for message delivery; S4.2: Take the session key, associated data, and identifier as input, and use the authentication encryption scheme to encrypt the original plaintext message to be sent to form ciphertext; S4.3: The sending direction sends a write request to the bulletin board server, the write request including the encrypted message, handle and mailbox index; S4.4: The bulletin board server queries the used_tokens database through the handle, and obtains the mailbox index and valid time window from the database for permission verification; S4.5: If the permission verification is successful, the bulletin board server will store the encrypted text in the messages database and associate the encrypted text with the mailbox.

8. The anonymous communication method based on blind signatures according to claim 7, characterized in that, The method by which the receiver initiates a privacy information retrieval request in step S5 includes: S5.1: The receiver construction T A unit vector of dimension , the unit vector of dimension . id x Each component is 1; S5.2: Encode the unit vector into a plaintext polynomial; S5.3: Encrypt the plaintext polynomial using an encryption algorithm, generate the PIR query ciphertext, and send it to the bulletin board server; S5.4: The bulletin board server uses the BFV homomorphic encryption scheme to calculate the homomorphic dot product of the PIR query ciphertext and the database ciphertext vector to generate the response ciphertext; wherein, the database ciphertext vector is composed of encrypted messages stored in each mailbox.

9. An anonymous communication system based on blind signatures, characterized in that, This includes a signature server, a bulletin board server, a sender, and a receiver. The sender generates a blind signature request containing public metadata and a message token based on the public key generated by the signature server. The sender uses a hash function to calculate the public key index bound to the public metadata, and calculates the blinded message based on the commitment value, blinding factor and public key index of the blind signature request calculated using the hash function. The sender sends the blind signature request to the signature server, so that the signature server performs a blind signature on the blind signature request based on the blind signature request and the private key generated by the signature server and returns the blind signature result; Wherein, after receiving a blind signature request and determining that the public metadata is valid, the signature server calculates the public key index based on the public metadata and the system public salt value, and uses the private key index corresponding to the public key index to calculate the blind signature result; The sender deblindifies the received blind signature result, obtains an anonymous token, and sends an authorization request to the bulletin board server. After verifying the validity of the anonymous token, the bulletin board server assigns a mailbox and a corresponding writing time window to the sender. After obtaining write permission to the mailbox within the time window, the sender delivers encrypted information to the mailbox provided by the bulletin board server. The recipient initiates a privacy information retrieval request to the bulletin board server based on the mailbox identifier provided by the sender, and receives the encrypted response returned by the bulletin board server; The receiver constructs a unit vector, encodes the unit vector into a plaintext polynomial, and uses an encryption algorithm to generate a PIR query ciphertext; the bulletin board server, based on the BFV scheme, calculates the homomorphic dot product of the PIR query ciphertext and the ciphertext vector composed of ciphertexts stored in each mailbox to generate the response ciphertext. The receiver uses the PIR private key and session key to decrypt the ciphertext of the response and obtain the plaintext information.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium has a computer program that, when executed by a processor, implements the anonymous communication method based on blind signatures as described in any one of claims 1-8.

Images