Traceable anonymous token method and system based on completely extractable n-time signatures

Abstract

The invention discloses a method capable of extracting an n-time signature, a method capable of completely extracting the n-time signature, and a traceable anonymous authentication method and system based on the n-time signature, in the n-time signature capable of being extracted, a public key and a private key are generated by a polynomial commitment scheme, and the private key comprises a core polynomial and a mask polynomial; an identifier bound with a public key can be extracted from the effective signature exceeding the signature capacity, and a user private key can also be extracted by the method for completely extracting the signatures for n times. Based on the fact that the application capable of completely extracting the signatures for n times is a traceable anonymous token, anonymity of the user is achieved through the signatures in the authentication process, and when the preset number of times is exceeded, the identity of the user can be traced by extracting the identifiers. The traceable anonymous token is jointly maintained by a plurality of participants, and operations such as key generation, signature verification and identity tracing need to be jointly completed by the participants, so that the traceable anonymous token method based on the extractable n-time signatures is realized.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a method and system for a traceable anonymous token based on fully extractable n signatures. Background Technology

[0002] Anonymous authentication is a core technology in cybersecurity, widely used in e-commerce, anonymous voting, and temporary access control, serving as a crucial mechanism for protecting user privacy in access control. One typical solution is the anonymous token, where a user requests a token from an issuer after identity verification and submits it to the verifier in a non-associative manner. Non-associative means that the submitted token cannot be linked to any token issuance process, thus making it impossible to trace back to a specific user's identity. Anonymous tokens are typically designed for single-use scenarios, meaning each token can only be used once. For multiple-use scenarios, researchers have proposed anonymous credentials, allowing users to perform anonymous authentication any number of times. Although anonymous tokens and credentials have been extensively studied, certain scenarios require functionality that falls somewhere in between. Therefore, it is necessary to design a traceable anonymous token.

[0003] We require users to only use a predefined limit on the number of times a user is restricted. When a user exceeds this limit, the user's identity associated with the issuance process should be exposed to achieve traceability. We call this type of solution a traceable anonymous token.

[0004] Currently, a seemingly suitable solution is k-times anonymous authentication (k-TAA). However, there are two significant differences between the two: First, the authentication process in k-TAA is not correlated, while authentication in TATs supports correlation; second, the rate limit in k-TAA is set by the validator, while the rate limit in TATs is set by the issuer. From a technical perspective, k-TAA can be viewed as k independent one-time credentials, each credential generating the same tag when used twice, thus achieving correlation of the execution process. By analyzing the results of the two executions, identity information can be extracted for user tracking. This traceability mechanism is also used to prevent double-spending of anonymous tokens; that is, when the same token is used twice, the system directly correlates the two executions. However, it is important to note that these techniques cannot be applied to scenarios where the rate limit exceeds the single-use limit.

[0005] Therefore, it can be seen that existing anonymous authentication schemes have problems such as the authentication process being uncorrelated, serious abuse of anonymity, and low efficiency. Summary of the Invention

[0006] To address the technical problems existing in the prior art, this invention designs a method for extractable n-times signatures (ENTS). In ENTS, the public and private keys are generated by a multinomial commitment scheme, with the private key containing a core multinomial and a mask multinomial. Valid signatures exceeding the signature capacity can be extracted by deriving the identifier bound to the public key. Based on this, a variant of ENTS, Fully Extractable n-times Signatures (FENTS), is also proposed. In this variant, both the key and the identifier can be extracted, making it very useful in scenarios requiring stronger enforcement to ensure users do not exceed thresholds. Furthermore, based on Fully Extractable n-times signatures, a traceable anonymous token scheme and system are designed, supporting both the issuer and the application in setting rate limits to prevent abuse due to exceeding the limit. The performance of the proposed schemes has been implemented and evaluated, demonstrating their high efficiency in practical applications.

[0007] Specifically, the first aspect of the present invention provides a method for extracting n signatures, comprising: The parameter initialization step involves inputting security parameters and the maximum signature capacity to generate public parameters. The user key generation step generates a user identifier and a public and private key bound to the user identifier based on the signature capacity input by the user and the pre-bound pre-identifier. In the user signature generation step, the user generates a signature of the message to be signed based on the private key and the message to be signed through polynomial evaluation, quotient polynomial calculation, polynomial commitment calculation, and proof generation steps. The signature does not expose the user identifier. The signature verification step verifies the validity of the user's signature based on the user's public key, signature capacity, message, and corresponding signature. The user identity extraction step involves determining whether the number of signed messages exceeds the user's signature capacity based on the user's public key, signature capacity, and multiple messages and their corresponding user signatures. If so, any verifier can extract the user identifier and obtain the identity information of the signing user; otherwise, no verifier can extract the user identifier.

[0008] In one implementation, the parameter initialization step includes: Based on the input security parameters and signature capacity limit, generate bilinear group parameters and polynomial commitment SRS parameters, where SRS is a structured reference string; The generated bilinear group parameters and the polynomial commitment SRS parameters are used as public parameters.

[0009] In one implementation, the user key generation step includes: Generate user identifiers based on pre-bound pre-identifiers and public generators; Set the core polynomial and the mask polynomial; Use the combination of multi-core polynomials and mask polynomials as the private key; Calculated based on publicly available parameters A polynomial commitment is used as a public key.

[0010] In one implementation, the user signature generation step includes: The user will send the message to be signed. Substituting these values ​​into the core polynomial and the mask polynomial, we obtain two scalar values; Convert the two calculated scalar values ​​into elements of the multiplication cyclic group; Through standard non-interactive The proof system generates knowledge proofs

[0011] Calculate the quotient polynomial; use The public parameters and the commitment proof of quotient polynomial calculation; The elements in the transformed multiplicative cyclic group, the knowledge proof, and the commitment proof are combined into the final signature.

[0012] In one implementation, the signature verification step includes: The knowledge proof is verified using a pre-defined verification algorithm; If the knowledge proof is verified, the commitment proof is then verified. If the commitment proof is verified, the signature is considered valid.

[0013] In one implementation, the user identity extraction step includes: The signature pairs are validated to check whether the signed message is duplicated with other messages. A preset verification algorithm is called to verify the validity of each signature pair. If there is a duplicate message or any signature is invalid, the extraction fails. The user can be recovered by using the Lagrange difference of each valid signature. .

[0014] Based on the same inventive concept, a third aspect of the present invention provides a method for fully extracting n signatures, comprising: The parameter initialization step involves inputting security parameters and the maximum signature capacity to generate public parameters. The user key generation step generates a user identifier and a public and private key bound to the user identifier based on the signature capacity input by the user and the pre-bound pre-identifier. The user signature generation step involves the user generating a signature for the message to be signed based on their private key and the message to be signed, through polynomial evaluation, quotient polynomial calculation, and proof generation steps. The signature does not expose the user identifier. The signature verification step verifies the validity of the signature based on the user's public key, signature capacity, message, and corresponding signature. The user identity extraction step involves determining whether the number of signed messages exceeds the user's signature capacity based on the user's public key, signature capacity, and multiple messages and their corresponding user signatures. If so, any verifier can extract the user identifier and obtain the identity information of the signing user; otherwise, no verifier can extract the user identifier.

[0015] In one implementation, the user signature generation step includes: The user will send the message to be signed. Substituting these values ​​into the core polynomial and the mask polynomial, we obtain two scalar values; Calculate the quotient polynomial; use The public parameters and the commitment proof of quotient polynomial calculation; The two scalar values ​​are combined with the commitment proof to form the final signature.

[0016] Based on the same inventive concept, a third aspect of this invention provides a traceable anonymous token method based on fully extractable n-times signatures, implemented based on the fully extractable n-times signature method of the second aspect. The traceable anonymous token method includes: The parameter initialization steps described in the second aspect; The issuer key generation step generates a public-private key pair based on publicly available system parameters, which is used for token signing and verification. The token issuance process involves the user generating a fully extractable n-times signature key pair, calculating relevant identification information, and sending it to the issuer. After verifying the user information, the issuer signs the user information, and the user generates a traceable anonymous token based on this, while also saving auxiliary information. The token presentation process involves the user submitting a token to the verifier, who then generates a random challenge and sends it to the user. The user completes the signature response using auxiliary information, and the verifier authenticates the token based on the signature and the challenge. In the identity tracing step, when the same token is presented more than a preset number of times (n), the issuer extracts the token identifier through collaboration and determines the corresponding user identity through the identity mapping relationship.

[0017] Based on the same inventive concept, a fourth aspect of the present invention provides a traceable anonymous token system based on fully extractable n-times signatures, comprising: A parameter initialization module is used to perform the parameter initialization steps described in the third aspect; The issuer key generation module is used to perform the issuer key generation steps, generating a public-private key pair for token signing and verification based on publicly available system parameters. The token issuance module is used to execute the token issuance steps. The user generates a fully extractable n-times signature key pair, calculates the relevant identification information and sends it to the issuer. After the issuer verifies the user information, it signs the user information. The user then generates a traceable anonymous token based on this and saves auxiliary information. The token presentation module is used to perform the token presentation step. The user submits the token to the verifier, the verifier generates a random challenge and sends it to the user, the user completes the signature response using auxiliary information, and the verifier completes token authentication based on the signature and challenge. The identity tracing module is used to perform identity tracing steps. When the same token is presented more than a preset number of times, the issuer extracts the token identifier through collaboration and determines the corresponding user identity through the identity mapping relationship.

[0018] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows: This invention discloses a method based on extractable n signatures. In the extractable n signatures, the public key and private key are generated by a multinomial commitment scheme. The private key contains a core multinomial and a mask multinomial. The valid signature exceeding the signature capacity can extract the identifier bound to the public key. The signature verification and identifier extraction process is highly efficient, the signature structure is simple, and it is suitable for large-scale transactions and high-frequency authentication scenarios, balancing security and practicality.

[0019] Furthermore, a variant based on extractable n signatures is provided: a fully extractable n signature method that can extract the user's private key.

[0020] Furthermore, a traceable anonymous token based on fully extractable n-times signatures is provided. During the authentication process, users achieve anonymity through signing. If the preset limit is exceeded, the user's identity can be traced by extracting the identifier. The traceable anonymous token is jointly maintained by multiple parties. Key generation, signature verification, and identity tracing must be completed jointly by the participating parties to realize the traceable anonymous token based on extractable n-times signatures. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart of a method for extracting n signatures provided in an embodiment of the present invention; Figure 2 This is a flowchart of a method for fully extracting n signatures in an embodiment of the present invention; Figure 3 This is a framework diagram of a method for fully extracting n signatures in an embodiment of the present invention; Figure 4 This is an interactive flowchart of the traceable anonymous token method based on fully extractable n signatures in an embodiment of the present invention. Detailed Implementation

[0023] Key aspects of this invention include: 1. This invention designs an efficient scheme for extracting n signatures and a scheme for fully extracting n signatures. Based on polynomial commitment and Lagrange interpolation techniques, the signature verification and identifier extraction processes are highly efficient, the signature structure is simple, and it is suitable for large-scale transactions and high-frequency authentication scenarios, taking into account both security and practicality. 2. The traceable anonymous token designed in this invention allows both the issuer and the application to set rate limits to prevent abuse beyond the allowed number of uses. After implementation and evaluation of the proposed scheme, the results show that these schemes are highly efficient in practical applications.

[0024] Example 1 This embodiment provides a method for extracting n signatures. Please refer to [link to documentation]. Figure 1 ,include: S101: Parameter initialization step, input security parameters and signature capacity limit, generate public parameters.

[0025] Specifically, S1 is parameter initialization, which takes security parameters and a signature capacity limit as input and generates public parameters. This signature capacity limits the number of valid signatures that each private key can generate. By configuring reasonable security parameters, the signer can successfully extract the identifier when the number of signatures reaches the user's signature limit; otherwise, the identifier cannot be extracted, thus ensuring the signer's identity privacy.

[0026] S101 specifically includes: S1011: Generate bilinear group parameters and polynomial commitment SRS parameters based on the input security parameters and signature capacity limit. SRS is a structured reference string. S1012: The generated bilinear group parameters and the polynomial commitment SRS parameters are published as public parameters.

[0027] In specific implementation, the parameter initialization process is based on security parameters. Signature capacity limit Generate structured reference strings for bilinear group parameters and polynomial commitment schemes. Together with cryptographic hash functions, they form the public parameters. .

[0028] According to safety parameters Signature capacity limit Generate bilinear group parameters and polynomial commitment SRS parameters, where the bilinear group parameters are... , For length is prime numbers, For the order of cyclic group To satisfy bilinearity and nondegeneracy, the following condition must be met: (1) Bilinearity: for all and ,have (2) Non-degenerative: ,in and They are respectively and The generators. The polynomial commitment scheme adopts... plan, By randomly selecting secret values ∈ Generate, containing (i=0 to N), for generator, for The generator. The specific implementation is as follows: First, the generating order is a prime number. Multiplication cyclic group , where p is a length of Find prime numbers; then generate a group. public generator Hequn public generator Finally, a polynomial commitment scheme is generated. ,Include (i=0 to N), output the complete public parameters It should be noted here that the secret value and It must be safely destroyed after it is generated.

[0029] S102: User key generation step, generating a user identifier and a public key and private key bound to the user identifier based on the signature capacity input by the user and the pre-bound pre-identifier.

[0030] Specifically, S102 is user key generation. Based on the user signature capacity and pre-identifier, a unique user identifier is generated, and a corresponding public key and private key are generated. The private key is bound to the user identifier, and the user is ensured to generate a valid signature within the signature capacity. The process uses a key generation algorithm to ensure that the generated identifier has sufficient security.

[0031] S102 specifically includes: S1021: Generate a user identifier based on the pre-bound pre-identifier and the public generator; S1022: Set the core polynomial and mask polynomial; S1023: Use the combination of multicore polynomial and mask polynomial as the private key; S1024: Calculated based on publicly available parameters A polynomial commitment is used as a public key.

[0032] In practice, the key generation process depends on the signature capacity. Pre-identifier and publicly available parameters Generate identifiers Public key and private key The public key is publicly available and verifiable.

[0033] Based on signature capacity Pre-identifier Generate identifiers Public key and private key Public key Publicly available, including the core polynomial ,Right now , The mask polynomial The selected polynomial coefficients , , polynomial As a private key ,calculate Polynomial commitment as public key Right now The specific implementation is as follows: First, it can be calculated directly. Then let the polynomial constant term And randomly select coefficients and the coefficients of non-zero higher-order terms , here Represents the order of prime numbers A finite field, using express Except A subfield consisting of all elements outside the subfield, and then, constructing two subfields of exactly the order of... polynomial Set the private key to Next, using the publicly available parameters and Calculate the public key as Finally, output the key pair. By embedding the user's identity within the private key, the desired functionality is achieved. However, it is not explicitly output.

[0034] S103: User signature generation step, whereby the user signs the message to be signed based on the private key and the message to be signed, wherein the signature does not expose the user identifier.

[0035] Specifically, S103 is user signature generation. The user signs the message based on their private key and the message to generate a signature. The signing process ensures that the signer's identity information is not disclosed. The signature result is generated by the signature algorithm and protected so that the user's identity is always kept private. After the signature is generated, the user identifier cannot be deduced from the signature.

[0036] S103 specifically includes: S1031: The user will send a message to be signed. Substituting these values ​​into the core polynomial and the mask polynomial, we obtain two scalar values; S1032: Convert the two calculated scalar values ​​into elements in the multiplication cyclic group; S1033: Via standard non-interactive The proof system generates knowledge proofs

[0037] S1034: Calculate the quotient polynomial; S1035: Utilization The public parameters and the commitment proof of quotient polynomial calculation; S1036: Combine the elements in the transformed multiplicative cyclic group, the knowledge proof, and the commitment proof into the final signature.

[0038] In practice, the private key used for signature generation and messages , Request message Belongs to a finite field Non-zero elements Users generate signatures through steps such as polynomial evaluation, quotient polynomial calculation, polynomial commitment calculation, and proof generation. The signature includes the result of the polynomial evaluation, a knowledge proof, and a commitment proof. Signatures not exceeding the signature capacity do not reveal the identifier. The specific implementation is as follows: First, the user will send the message Substitution Two private polynomials yield two scalar values. and , This is the core polynomial. At point The result of the evaluation at the location; This is a mask polynomial. At point The evaluation results at these two points are the core secret information of the signature, but they will not appear directly in the final signature. Then, the user converts them into a group... elements in and , , ,in ,so and It can be publicly transmitted, but it cannot be directly recovered from due to the difficulty of discrete logarithms. or Then, knowledge proofs are generated. This certificate is to prevent forgers from relying solely on... and Claiming to own and Users need to provide a non-interactive interface. - Type of knowledge proof This proves that they did indeed know. and , making , Simultaneously established, this proof is provided by the standard non-interactive... proof system generate, This proof possesses zero-knowledge and unforgeability. We continue calculating the quotient polynomial to construct the subsequent commitment proof. The user needs to calculate two quotient polynomials. These quotient polynomials are used to generate commitment proofs. Users utilize Public parameter calculation ,in This is the maximum number of signatures supported by the system. It is the actual signing capacity of the current key, which must satisfy... Finally, combine the above four parts into a signature. Output the final signature.

[0039] S104: Signature verification step, verifying the validity of the user's signature based on the user's public key, signature capacity, message, and corresponding signature.

[0040] Specifically, S104 is signature verification. The verifier uses a publicly available verification algorithm to determine whether the signature is valid based on the received message, signature, and public key. Through the verification algorithm, it can be determined whether the signature was generated by a legitimate user using a valid private key, ensuring the validity of the signature without disclosing any sensitive information.

[0041] S104 specifically includes: S1041: Verify the knowledge proof using a pre-defined verification algorithm; S1042: If the knowledge proof is verified, then the commitment proof is verified. If the commitment proof is verified, then the signature is valid.

[0042] In practice, the signature verification process is based on the public key. Signature capacity ,information and signature Output the verification results Where 0 indicates invalid and 1 indicates valid. The knowledge proof verification algorithm is used for verification. The validity of π is verified by a commitment proof algorithm that verifies the validity of π through a bilinear mapping, specifically as follows: First, verify the knowledge proof. , call Verify the algorithm, check Does it equal 1? If it is 0, it means the signer cannot prove that they knew. and Invalid signature, return If the value is 1, then continue verifying the commitment proof. That is, to verify whether the following bilinear equality holds: ,in for It is a bilinear mapping; It is a group Generators; It is a secret point in the trusted setup, through Publicly disclose its power, such as wait; and yes and In the group The inverse element in the equation. If both of the above verifications pass, the signature is considered valid, and output b = 1; otherwise, output b = 0.

[0043] S105: User identity extraction step. Based on the user's public key, signature capacity, and multiple messages and their corresponding user signatures, determine whether the number of signed messages exceeds the user signature capacity. If so, any verifier can extract the user identifier and obtain the identity information of the signing user. Otherwise, no verifier can extract the user identifier.

[0044] Specifically, S105 is user identity extraction. When the number of a user's signed messages exceeds the signature capacity, any verifier can extract the user's identifier based on the signature information, thereby obtaining the identity information of the signing user. If the number of signed messages does not exceed the signature capacity, no verifier can extract the user's identifier, thus protecting the user's identity privacy.

[0045] S105 specifically includes: S1051: Perform a validity check on the signature pair, check whether the signed message is duplicated with other messages, and call the preset verification algorithm to verify the validity of each signature pair. If there is a duplicate message or any signature is invalid, the extraction will fail. S1052: Recover the user's identity using Lagrange multiplication tables for each valid signature. .

[0046] In practice, user identity extraction is performed using public keys. Signature capacity , Message-signature pair , where all m i The i-th signature message is distinct from the others, and the extracted identifier is obtained. ,or This indicates that the extraction failed. The specific implementation is as follows: First, perform a validity check on the signature pair, for each examine Whether it is a duplicate of other messages, and call Verify the validity of each signature pair. If a duplicate message exists or any signature is invalid, the extraction fails and outputs the result. Next, using each valid signature... Perform Lagrange difference recovery for users , That is, the user has been successfully recovered. .

[0047] Example 2 Based on the same inventive concept, this embodiment discloses a method for completely extracting n signatures. Please refer to [link to relevant documentation]. Figure 2 ,include: S201 parameter initialization steps: Input security parameters and signature capacity limit, and generate public parameters; The S202 user key generation step generates a user identifier and a public and private key bound to the user identifier based on the signature capacity input by the user and the pre-bound pre-identifier. The S203 user signature generation step involves the user generating a signature for the message to be signed based on their private key and the message to be signed, through polynomial evaluation, quotient polynomial calculation, and proof generation steps. The signature does not expose the user identifier. The S204 signature verification step verifies the validity of the signature based on the user's public key, signature capacity, message, and corresponding signature. The S205 user identity extraction step involves determining whether the number of signed messages exceeds the user's signature capacity based on the user's public key, signature capacity, and multiple messages and their corresponding user signatures. If so, any verifier can extract the user identifier and obtain the identity information of the signing user; otherwise, no verifier can extract the user identifier.

[0048] Specifically, this embodiment provides a variant of the extractable n-times signature method, namely the fully extractable n-times signature method. Similar to the extractable n-times signature method in Embodiment 1, the process is the same with minor differences. The signature construction scheme incorporates the extractable n-times signature... and Replace with and ,in and It's a message. In the core polynomial and mask polynomial The value of the key changes accordingly in the verification and user identity tracing parts, and ultimately, both the key and the identifier can be extracted when extracting the user's identity. Furthermore, the n-times signature extraction scheme requires that even if an attacker obtains more than n message signature pairs, it must still maintain unforgeability.

[0049] Please see Figure 3 This is a framework diagram of a method for extracting n signatures in an embodiment of the present invention.

[0050] Parameter initialization: Input security parameters and signature capacity limit to generate public parameters.

[0051] In one implementation, the parameter initialization process is based on security parameters. Signature capacity limit Generate structured reference strings for bilinear group parameters and polynomial commitment schemes. Together with cryptographic hash functions, they form the public parameters. .

[0052] According to safety parameters Signature capacity limit Generate bilinear group parameters and polynomial commitment SRS parameters, where the bilinear group parameters are... , For length is prime numbers, For the order of cyclic group To satisfy bilinearity and nondegeneracy, the following condition must be met: (1) Bilinearity: for all and ,have (2) Non-degenerative: ,in and They are respectively and The generators. The polynomial commitment scheme adopts... plan, By randomly selecting secret values ∈ Generate, containing (i=0 to N), for generator, for The generator. The specific implementation is as follows: First, the generating order is a prime number. Multiplication cyclic group , where p is a length of Find prime numbers; then generate a group. public generator Hequn public generator Finally, a polynomial commitment scheme is generated. ,Include (i=0 to N), output the complete public parameters Among them, the secret value and It must be safely destroyed after it is generated.

[0053] Key generation, input signature capacity and pre-identifier Generate user identifier Public key and private key . In one implementation, the key generation process is based on the signature capacity. Pre-identifier and publicly available parameters Generate identifiers Public key and private key The public key is publicly available and verifiable.

[0054] Based on signature capacity Pre-identifier Generate identifiers Public key and private key Public key Publicly available, including the core polynomial ,Right now , The mask polynomial The selected polynomial coefficients , , polynomial As a private key ,calculate Polynomial commitment as public key Right now The specific implementation is as follows: First, it can be calculated directly. Then let the polynomial constant term And randomly select coefficients and the coefficients of non-zero higher-order terms , here Represents the order of prime numbers A finite field, using express Except A subfield consisting of all elements outside the subfield, and then, constructing two subfields of exactly the order of... polynomial Set the private key to Next, using the publicly available parameters and Calculate the public key as Finally, output the key pair. The user's identity is hidden in the private key, satisfying... However, it is not explicitly output.

[0055] Signature generation involves the user signing the message using their private key and the message itself. The signature does not expose the identifier.

[0056] In one implementation, the signature generation process uses a private key. and messages , Request message Belongs to a finite field Non-zero elements Users generate signatures through steps such as polynomial evaluation, quotient polynomial calculation, polynomial commitment calculation, and proof generation. The signature includes the result of the polynomial evaluation, a knowledge proof, and a commitment proof. Signatures not exceeding the signature capacity do not reveal the identifier. The specific implementation is as follows: First, the user will send the message Substitution From the two private polynomials, we obtain two scalar values. This is the core polynomial. At point The result of the evaluation at the location; This is a mask polynomial. At point The result of the evaluation at that point is then used to construct the subsequent commitment proof. The user needs to calculate two quotient polynomials. These quotient polynomials are used to generate commitment proofs. Users utilize Public parameter calculation ,in This is the maximum number of signatures supported by the system. It is the actual signing capacity of the current key, which must satisfy... Combine the above three parts into a signature. Output the final signature.

[0057] Verify the signature by using the public key, signature capacity, message, and corresponding signature to verify the validity of the signature.

[0058] In one implementation, the signature verification process is based on the public key. Signature capacity ,information and signature Output the verification results Where 0 indicates invalid and 1 indicates valid. The commitment proof verification algorithm verifies the commitment using a bilinear mapping. The legitimacy is specifically achieved as follows: Verify whether the following bilinear equality holds: ,in for It is a bilinear mapping; It is a group If all the above verifications pass, the signature is considered valid, and b = 1 is output; otherwise, b = 0 is output.

[0059] To trace user identity, based on the user's public key, signature capacity, and multiple messages and their corresponding user signatures, if the number of signed messages exceeds the user's signature capacity, anyone can extract the identifier bound to that user and obtain the identity information of the signing user; otherwise, no one can effectively determine the user identifier and obtain the identity information of the signing user.

[0060] In one implementation, user identity is traced via a public key. Signature capacity , Message-signature pair , of which all They are all different, so we get the extracted identifiers. ,or This indicates that the extraction failed. The specific implementation is as follows: First, perform a validity check on the signature pair, for each Check m i Whether it is a duplicate of other messages, and call Verify the validity of each signature pair. If a duplicate message exists or any signature is invalid, the extraction fails and outputs the result. Next, using each valid signature... Perform Lagrange difference recovery for users ,in This means the user's private key has been recovered. , .

[0061] Example 3 Based on the same inventive concept, this embodiment discloses a method for traceable anonymous tokens based on fully extractable n-times signatures, implemented based on the fully extractable n-times signature method in Embodiment 3. The traceable anonymous token method includes: The parameter initialization steps described in the second aspect; The issuer key generation step generates a public-private key pair based on publicly available system parameters, which is used for token signing and verification. The token issuance process involves the user generating a fully extractable n-times signature key pair, calculating relevant identification information, and sending it to the issuer. After verifying the user information, the issuer signs the user information, and the user generates a traceable anonymous token based on this, while also saving auxiliary information. The token presentation process involves the user submitting a token to the verifier, who then generates a random challenge and sends it to the user. The user completes the signature response using auxiliary information, and the verifier authenticates the token based on the signature and the challenge. In the identity tracing step, when the same token is presented more than a preset number of times (n), the issuer extracts the token identifier through collaboration and determines the corresponding user identity through the identity mapping relationship.

[0062] Specifically, parameter initialization, based on fully extractable n-times signatures, involves parameters shared by all participants, including users, issuers, and validators, and must guarantee the system's security and reliability. The initialization process is essentially the initialization process for fully extractable n-times signatures, accepting security parameters and a rate limit as input to generate a set of system parameters.

[0063] Please see Figure 4 This is an interactive flowchart of the traceable anonymous authentication method in an embodiment of the present invention.

[0064] In one implementation, the parameter initialization step is specifically implemented as follows: First, the generating order is a prime number. Multiplication cyclic group ,in For length is Find prime numbers; then generate a group. public generator Hequn public generator Finally, a polynomial commitment scheme is generated. ,Include (i=0 to N), output the complete public parameters It is important to emphasize here that the secret value... and It must be safely destroyed after it is generated; The issuer key generation process first takes the public parameters as input, parses the public parameters, then sets the parameters, and finally uses the key generation algorithm to generate the issuer's public key and private key, and finally outputs the generated issuer's public key and private key; In one implementation, the issuer key generation step is specifically implemented as follows: First of all Common parameters As input, parsing for Then set the parameters Finally use Generate the issuer's public key The issuer's private key Finally, the generated output and ,in Based on of This scheme allows for joint randomization of the message and its signature, ensuring that the original signature and the randomized signature are indistinguishable. It consists of the following algorithms presented in the PPT: Key Generation Function Given a bilinear group and a vector length, a key generation algorithm generates a public-key and private-key pair; a signature function... Given a private key and a message representative, the signature algorithm generates a signature for that message representative; the representative's change function. Given a public key, message, signature, and scalar, a randomization algorithm generates a new representative and an updated signature; verification function. Given a public key, a message, and a signature, the verification algorithm checks whether the signature is valid; key verification function. Check if the key pair is valid.

[0065] The token issuance process is as follows: On the user side, the initial operation involves inputting the issuer's public key and rate parameters to receive a preprocessed message containing user identity information, other necessary data for token generation, and status information for the next step. Then, the issuer performs a signing operation, accepting the rate parameters and preprocessed message, and signing the preprocessed signature with its private key. This digital signature, generated by the issuer using its private key, is the unique identifier assigned to the token and is the crucial part of the token that traces back to the corresponding user. An exception in this step indicates operation failure. Finally, the user performs the final operation, taking the preprocessed signature and status information as input, and outputting the token. In one implementation, the token issuance step is specifically implemented as follows: user To the publisher The user randomly selects the requested credentials. That is, to randomly select an element from a finite field. That is, to select a non-zero element from a finite field, using Solution generation , , Analysis for and generate proof ,user send To the publisher Then the publisher One party verifies that if If invalid, the output fails; otherwise, the issuer... Sign with private key Publisher send The user, at the end user's end, uses the issuer's public key to verify the signature. ,if Output Otherwise, users can... Extract vouchers, final output .

[0066] The meanings of the relevant characters are as follows: tid: A unique token identifier marked each time the token issuance protocol is executed.

[0067] PID: The user first selects a pre-identifier, which is randomly selected during the initial phase of the token issuance protocol. ∈F as pid; Id: The identifier id corresponding to pk in fents will be used to generate the token identifier tid in the token issuance protocol.

[0068] Aux: The token issuance protocol outputs the token t and its corresponding auxiliary information for U to use, which is the private key part in fents.

[0069] r: The user uses a randomly selected r ∈ This is used to perform blinding processing on pk.

[0070] cm: This is the public key portion of Fents, a KZG commitment, cm=

[0071] cm Another polynomial =rf(X) is a KZG commitment that the polynomial has the same degree and its evaluation value at point 0 is ra0.

[0072] .

[0073] Psig: Publisher The result after signing with the private key.

[0074] : indicates to .

[0075] This is the issuer's public key.

[0076] This is the issuer's private key.

[0077] During the token presentation phase, the verifier first randomly selects a value and sends it to the user. Then, the user uses a signature function to generate a proof, and finally, the verifier verifies the validity of the credential through signature verification and zero-knowledge proof.

[0078] In one implementation, the token presentation step is specifically implemented as follows: First, the verifiers randomly select... Send random value Give it to the user, and then the user uses it. Proof of signature function generation: And send it to the verifier, who is the last verifier to verify it. ,and ,as well as ,in From token The parsing indicates that if the output is 1, the credential is valid; it should be noted that... From token Analysis, The analysis result of the body is divided into three parts, which is for ease of use and representation. .

[0079] In the token tracing phase, the token information is first parsed and a series of transformations are performed. Then, the issuer's public key is used to verify the signature. After successful verification, the information is extracted using a fully extractable n-times signature scheme. If the extraction is successful, the token is successfully traced. In one implementation, the token tracing step is specifically implemented as follows: Parse the input information to obtain the token information. and a series Then verify the signature using the issuer's public key. If invalid, output If successful, continue using. Solution Extraction Information: ,if Then output Otherwise, the analysis... for and output .

[0080] It also includes identity tracing. When the same token is presented more than a preset number of times (n), the issuer collaboratively extracts the token identifier and determines the corresponding user identity through an identity mapping relationship, thus tracing the user who exceeded the limit. The identity tracing process uses the identity mapping relationship maintained by the issuer to find the real identity information of the corresponding user, achieving accurate tracking of the token user's identity.

[0081] Example 4 Based on the same inventive concept, this embodiment discloses a traceable anonymous token system based on fully extractable n-times signatures, including: The parameter initialization module is used to execute the parameter initialization steps described in Embodiment 2. The issuer key generation module is used to perform the issuer key generation steps, generating a public-private key pair for token signing and verification based on publicly available system parameters. The token issuance module is used to execute the token issuance steps. The user generates a fully extractable n-times signature key pair, calculates the relevant identification information and sends it to the issuer. After the issuer verifies the user information, it signs the user information. The user then generates a traceable anonymous token based on this and saves auxiliary information. The token presentation module is used to perform the token presentation step. The user submits the token to the verifier, the verifier generates a random challenge and sends it to the user, the user completes the signature response using auxiliary information, and the verifier completes token authentication based on the signature and challenge. The identity tracing module is used to perform identity tracing steps. When the same token is presented more than a preset number of times, the issuer extracts the token identifier through collaboration and determines the corresponding user identity through the identity mapping relationship.

[0082] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0083] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0084] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various modifications and variations to the embodiments of the invention without departing from the spirit and scope of the invention. Thus, if these modifications and variations of the embodiments of the invention fall within the scope of the claims of the invention and their equivalents, the invention also intends to include these modifications and variations.

Claims

1. A method for extracting n signatures, characterized in that, include: The parameter initialization step involves inputting security parameters and the maximum signature capacity to generate public parameters. The user key generation step generates a user identifier and a public and private key bound to the user identifier based on the signature capacity input by the user and the pre-bound pre-identifier. In the user signature generation step, the user generates a signature of the message to be signed based on the private key and the message to be signed through polynomial evaluation, quotient polynomial calculation, polynomial commitment calculation, and proof generation steps. The signature does not expose the user identifier. The signature verification step verifies the validity of the user's signature based on the user's public key, signature capacity, message, and corresponding signature. The user identity extraction step involves determining whether the number of signed messages exceeds the user's signature capacity based on the user's public key, signature capacity, and multiple messages and their corresponding user signatures. If so, any verifier can extract the user identifier and obtain the identity information of the signing user; otherwise, no verifier can extract the user identifier.

2. The method for extracting n signatures as described in claim 1, characterized in that, The parameter initialization steps include: Based on the input security parameters and signature capacity limit, generate bilinear group parameters and polynomial commitment SRS parameters, where SRS is a structured reference string; The generated bilinear group parameters and the polynomial commitment SRS parameters are used as public parameters.

3. The method for extracting n signatures as described in claim 1, characterized in that, The user key generation steps include: Generate user identifiers based on pre-bound pre-identifiers and public generators; Set the core polynomial and the mask polynomial; Use the combination of multi-core polynomials and mask polynomials as the private key; Calculated based on publicly available parameters A polynomial commitment is used as a public key.

4. The method for extracting n signatures as described in claim 3, characterized in that, The user signature generation steps include: The user will send the message to be signed. Substituting these values ​​into the core polynomial and the mask polynomial, we obtain two scalar values; Convert the two calculated scalar values ​​into elements of the multiplication cyclic group; Through standard non-interactive The proof system generates knowledge proofs Calculate the quotient polynomial; use The public parameters and the commitment proof of quotient polynomial calculation; The elements in the transformed multiplicative cyclic group, the knowledge proof, and the commitment proof are combined into the final signature.

5. The method for extracting n signatures as described in claim 4, characterized in that, The signature verification steps include: The knowledge proof is verified using a pre-defined verification algorithm; If the knowledge proof is verified, the commitment proof is then verified. If the commitment proof is verified, the signature is considered valid.

6. The method for extracting n signatures as described in claim 1, characterized in that, The steps for extracting user identity include: The signature pairs are validated to check whether the signed message is duplicated with other messages. A preset verification algorithm is called to verify the validity of each signature pair. If there is a duplicate message or any signature is invalid, the extraction fails. The user can be recovered by using the Lagrange difference of each valid signature. .

7. A method for completely extracting n signatures, characterized in that, include: The parameter initialization step involves inputting security parameters and the maximum signature capacity to generate public parameters. The user key generation step generates a user identifier and a public and private key bound to the user identifier based on the signature capacity input by the user and the pre-bound pre-identifier. The user signature generation step involves the user generating a signature for the message to be signed based on their private key and the message to be signed, through polynomial evaluation, quotient polynomial calculation, and proof generation steps. The signature does not expose the user identifier. The signature verification step verifies the validity of the signature based on the user's public key, signature capacity, message, and corresponding signature. The user identity extraction step involves determining whether the number of signed messages exceeds the user's signature capacity based on the user's public key, signature capacity, and multiple messages and their corresponding user signatures. If so, any verifier can extract the user identifier and obtain the identity information of the signing user; otherwise, no verifier can extract the user identifier.

8. The method for extracting n signatures as described in claim 7, characterized in that, The user signature generation steps include: The user will send the message to be signed. Substituting these values ​​into the core polynomial and the mask polynomial, we obtain two scalar values; Calculate the quotient polynomial; use The public parameters and the commitment proof of quotient polynomial calculation; The two scalar values ​​are combined with the commitment proof to form the final signature.

9. A method for traceable anonymous tokens based on fully extractable n-times signatures, characterized in that, Based on the fully extractable n-times signature method described in claim 7, the traceable anonymous token method includes: The parameter initialization step as described in claim 7; The issuer key generation step generates a public-private key pair based on publicly available system parameters, which is used for token signing and verification. The token issuance process involves the user generating a fully extractable n-times signature key pair, calculating relevant identification information, and sending it to the issuer. After verifying the user information, the issuer signs the user information, and the user generates a traceable anonymous token based on this, while also saving auxiliary information. The token presentation process involves the user submitting a token to the verifier, who then generates a random challenge and sends it to the user. The user completes the signature response using auxiliary information, and the verifier authenticates the token based on the signature and the challenge. In the identity tracing step, when the same token is presented more than a preset number of times (n), the issuer extracts the token identifier through collaboration and determines the corresponding user identity through the identity mapping relationship.

10. A traceable anonymous token system based on fully extractable n-times signatures, characterized in that, include: A parameter initialization module is used to execute the parameter initialization steps as described in claim 9; The issuer key generation module is used to perform the issuer key generation steps, generating a public-private key pair for token signing and verification based on publicly available system parameters. The token issuance module is used to execute the token issuance steps. The user generates a fully extractable n-times signature key pair, calculates the relevant identification information and sends it to the issuer. After the issuer verifies the user information, it signs the user information. The user then generates a traceable anonymous token based on this and saves auxiliary information. The token presentation module is used to perform the token presentation step. The user submits a token to the verifier, the verifier generates a random challenge and sends it to the user, the user completes the signature response using auxiliary information, and the verifier completes token authentication based on the signature and challenge. The identity tracing module is used to perform identity tracing steps. When the same token is presented more than a preset number of times, the issuer extracts the token identifier through collaboration and determines the corresponding user identity through the identity mapping relationship.

Images