Signature verification method, key acquisition method, and related device

Abstract

Embodiments of the present application provide a signature verification method, a key acquisition method and related equipment, which can be used in the field of trusted computing. The method comprises: a first node acquiring a first aggregated signature, the first aggregated signature being obtained by aggregating n first signatures, the n first signatures comprising a first signature of each of n second nodes, the first signature of each second node being obtained by signing with a private key of each second node, and n being an integer greater than 1; and verifying the first aggregated signature based on a public key of each of the n second nodes. If the first aggregated signature is verified successfully, it means that the n first signatures are all verified successfully, and if the first aggregated signature is verified unsuccessfully, it means that the n first signatures are all verified unsuccessfully. The first node can complete the verification of the signatures of the n second nodes at one time, and an efficient verification scheme is provided.

Description

Technical Field

[0001] This application relates to computer technology, and more particularly to a signature verification method, a key acquisition method, and related equipment. Background Technology

[0002] To enhance computing power, a worker node cluster can be constructed, which consists of multiple worker nodes. To ensure the trustworthiness of these multiple worker nodes, it is necessary to perform trust verification on them. An efficient verification scheme is urgently needed. Summary of the Invention

[0003] This application provides a signature verification method, a key acquisition method, and related equipment for verifying n first signatures of n second nodes in one go, providing an efficient verification scheme.

[0004] This application provides the following technical solution:

[0005] Firstly, this application provides a signature verification method applicable to the field of trusted computing. In this method, a first node obtains a first aggregated signature, which is obtained by aggregating n first signatures. These n first signatures include the first signature of each of the n second nodes, and each second node's first signature is obtained by signing using its private key, where n is an integer greater than 1. Furthermore, the first aggregated signature can be verified based on the public key of each of the n second nodes.

[0006] For example, if the signature verification of the first aggregated signature is successful, it means that all n first signatures have been successfully verified; if the signature verification of the first aggregated signature fails, it means that all n first signatures have failed to be verified.

[0007] In this context, the first node can be understood as a verification node. For example, the first node can be represented as a server, or it can be called a verification server. For instance, n second nodes can belong to the same node cluster; for example, the n second nodes can be n compute nodes, or n second nodes can be n storage nodes, or the n second nodes can include both compute nodes and storage nodes, etc.

[0008] For example, the signature algorithm used by the second node when signing can be: the Boneh-Lynn-Shacham (BLS) signature algorithm, the Ron Rivest-Adi Shamir-Leonard Adleman (RSA) signature algorithm, or other types of signature algorithms.

[0009] For example, the first node can verify the first aggregated signature using the BLS signature algorithm based on the public keys of each of the n second nodes (i.e., n public keys). Alternatively, the first node can verify the first aggregated signature using the RSA signature algorithm based on the public keys of each of the n second nodes (i.e., n public keys). Alternatively, the first node can also use other signature algorithms to verify the first aggregated signature, etc.

[0010] In this implementation, after n first signatures are obtained by each of the n second nodes using their respective private keys, the n first signatures from the n second nodes can be aggregated to obtain a first aggregated signature. Then, the first node verifies the first aggregated signature based on the public key of each of the n second nodes. If the verification of the first aggregated signature is successful, it means that all n first signatures have been verified successfully. If the verification of the first aggregated signature fails, it means that all n first signatures have failed to be verified. The first node can complete the verification of the signatures of the n second nodes at one time, providing an efficient verification scheme.

[0011] In one possible implementation, the first signature of each second node is obtained by signing the measurement content of each second node using its private key. The measurement content of each second node includes the data required for trusted verification of each second node. The method may further include: if the signature verification after the first aggregation is successful and the measurement content verification of n second nodes is successful, determining that the n second nodes have been successfully verified; if the signature verification after the first aggregation fails or the measurement content verification of n second nodes fails, determining that the n second nodes have failed verification.

[0012] In this implementation, it is clarified that the first signature is obtained by signing the measurement content of the second node using the private key of the second node. The measurement content of each second node includes the data required for trusted verification of each second node. That is, the method provided by this application can be applied to the scenario of trusted verification of the second node, which improves the degree of integration between this solution and specific application scenarios. In addition, if the signature after the first aggregation is successfully verified and the measurement content of n second nodes is successfully verified, it is determined that the n second nodes are successfully verified. This clarifies the integration idea between the batch verification method of the signatures of n second nodes provided by this application and the specific application scenario of trusted verification of n second nodes, further improving the degree of integration between this solution and specific application scenarios.

[0013] In one possible implementation, the first node can further perform a credibility verification on the aggregated metric content. If the aggregated metric content verification is successful, it means that the metric content verification of the n second nodes is successful; if the aggregated metric content verification fails, it means that the metric content verification of the n second nodes fails. The aggregated metric content is obtained by aggregating the n metric contents. Alternatively,

[0014] The first node can also perform trusted verification on the measurement content of each of the n second nodes in sequence. If the measurement content of all n second nodes is successfully verified, it means that the measurement content of the n second nodes has been successfully verified; if the measurement content of any one of the n second nodes fails to be verified, it means that the measurement content of the n second nodes has failed to be verified.

[0015] In one possible implementation, the first node obtains the first aggregated signature by: the first node obtaining the first aggregated signature from the aggregating node; in other words, the first node obtaining the first aggregated signature sent by the aggregating node. The first aggregated signature is obtained by the aggregating node aggregating n first signatures. The aggregating node and the n second nodes belong to the same node cluster, and the n first signatures are obtained by the aggregating node from the n second nodes through the cluster's communication network.

[0016] For example, the communication network within the cluster can be a wired network; in other words, the aggregating node and the n second nodes can communicate via a wired network. The first aggregated signature can be obtained by the first node from the aggregating node via a communication network outside the cluster; for example, the communication network outside the cluster can be the Internet; in other words, the first node and the aggregating node can communicate via the Internet.

[0017] In this implementation, the aggregation node obtains n first signatures from n second nodes, and aggregates these n first signatures to obtain the first aggregated signature. Since the aggregation node and the n second nodes belong to the same node cluster, and the aggregation node communicates with the n second nodes using the cluster's communication network, the communication speed between the aggregation node and the n second nodes is faster. The aggregation node sends the first aggregated signature to the first node, which verifies the first aggregated signature. That is, the first node only needs to obtain the first aggregated signature from the aggregation node, which saves communication time compared to the first node obtaining n first signatures from the n second nodes. In addition, since the aggregation node aggregates the n first signatures, the first node no longer needs to aggregate the n first signatures to obtain the first aggregated signature, but directly receives the first aggregated signature from the aggregation node. This is equivalent to splitting the work of aggregating the n first signatures from the first node to the aggregation node, further reducing the workload of the first node and helping to avoid the first node becoming too busy.

[0018] In one possible implementation, the type of the measurement event corresponding to the measurement content is one of the following: measurement of the basic input output system (BIOS), measurement of the bootloader, measurement of the operating system (OS), measurement of the application, or other types.

[0019] For example, measuring the BIOS of the second node can be understood as performing a trusted verification of the BIOS in the second node. More specifically, it can be to prove that the BIOS in the second node is a trusted verification performed by a trusted execution environment. For example, when measuring the BIOS, the measurement content can include the code of the BIOS currently used on the second node and various preset type status values. Measuring the Bootloader of the second node can be understood as performing a trusted verification of the Bootloader in the second node. More specifically, it can be to prove that the Bootloader in the second node is a trusted verification performed by a trusted execution environment.

[0020] Measuring the OS on the second node can be understood as performing trusted verification on the OS within the second node. More specifically, it can be to prove that the OS on the second node is trusted by a trusted execution environment. Similarly, measuring the applications on the second node can be understood as performing trusted verification on the applications within the second node. More specifically, it can be to prove that the applications on the second node are trusted by a trusted execution environment.

[0021] In this implementation, the type of measurement event corresponding to the measurement content can be BIOS measurement, bootloader measurement, operating system (OS) measurement, or application measurement, which provides multiple application scenarios for the method provided in this application and improves the implementation flexibility of this solution.

[0022] In one possible implementation, the method may further include: a first node generating a first key factor, obtaining a first value based on the first key factor and a first base point, and sending the first value to a target node, where the target node is any one of n second nodes. The first value and the second key factor generated by the target node are used by the target node to obtain a first key. The first key is used by the target node to sign the document transmitted to the first node. The first node receives a second value sent by the target node, the second value being obtained based on the second key factor and the second base point generated by the target node. The first node then obtains a second key based on the first key factor and the second value. The second key is used by the first node to verify the signature from the target node.

[0023] In this case, the key material of the first key and the second key are the same. In other words, the first key and the second key are the same key, or the key content of the first key and the second key are the same. This method can be understood as using a symmetric key in the process of signing and verifying the signature.

[0024] For example, the first base point and the second base point can be the same or different. For example, the first node can obtain a first calculation result based on a first key factor and a second value, obtain key information using a key derivation function based on the first calculation result, and obtain a second key based on the key information. The key information can include M bits of bytes, where M is an integer greater than or equal to M.

[0025] In this implementation, the target node generates a signature transmitted to the first node based on the first key, and the first node verifies the signature transmitted by the target node based on the second key. The first and second keys use the same key material, which greatly improves the efficiency of the first node in verifying the signature of the target node. Optionally, after completing the trusted verification of n second nodes, it can be determined whether the operating environment of the n second nodes is a trusted execution environment. Thus, the first key of the target node can be generated only after ensuring that the operating environment of the n second nodes is trusted, thereby improving the security of the generation process of the first key of the target node.

[0026] In one possible implementation, the method further includes: a first node signing using its private key to obtain a second signature; the first node sending a first value to a target node, including: the first node sending the second signature and the first value to the target node, wherein the verification of the second signature is performed by the target node based on the first node's public key. The first node receiving the second value sent by the target node includes: the first node receiving the second value and a third signature sent by the target node, wherein the third signature of the target node is obtained by signing using the target node's private key; the method further includes: the first node verifying the third signature of the target node based on the target node's public key. The first node obtaining a second key based on a first key factor and a second value includes: if the third signature verification is successful, the first node obtaining the second key based on the first key factor and the second value.

[0027] In this implementation, since the first node obtains the first key based on the first key factor and the second value of the target node, and the target node also sends a third signature when sending the second value to the first node, the third signature of the target node is obtained by signing using the target node's private key. Only when the third signature is successfully verified, that is, when it is guaranteed that the sender of the second value is a secure and reliable sender, will the first node obtain the second key based on the first key factor and the second value, which helps to improve the security of the second key generation process. Correspondingly, the target node obtains the first key based on the second key factor and the first value, and the first node also sends a second signature when sending the first value to the target node. Thus, the target node can obtain the first key based on the second key factor and the first value only when the second signature is successfully verified, that is, when it is guaranteed that the sender of the first value is a secure and reliable sender, which helps to improve the security of the first key generation process.

[0028] In one possible implementation, the first node verifies the third signature of the target node based on the public key of the target node, including: the first node aggregating the n third signatures that correspond one-to-one with the n second nodes to obtain a second aggregated signature; and the first node verifying the second aggregated signature based on the public key of each of the n second nodes.

[0029] For example, if the second aggregated signature verification is successful, it means that all n third signatures have been successfully verified; if the second aggregated signature verification fails, it means that all n third signatures have failed to be verified.

[0030] In this implementation, since the third signature of each of the n second nodes also needs to be verified during the process of generating the first key of each second node, the n third signatures can be aggregated to obtain a second aggregated signature. The second aggregated signature is then verified. If the second aggregated signature is successfully verified, it means that all n third signatures have been successfully verified. If the second aggregated signature fails to be verified, it means that all n third signatures have failed to be verified. This achieves batch verification of the n third signatures, which helps to improve the efficiency of the process of generating the first key of each of the n second nodes.

[0031] In one possible implementation, the first value and the second key factor are also used to provide the target node with a third key. The first node obtains the second key based on the first key factor and the second value, including: the first node obtains a second key and a fourth key based on the first key factor and the target node's second value; wherein, the third key is the key used by the target node to encrypt information transmitted to the first node, and the fourth key is the key used by the first node to decrypt information from the target node. The key materials of the third key and the fourth key are the same. This method can be understood as using a symmetric key in the encryption and decryption process.

[0032] For example, the first node can obtain a first calculation result based on a first key factor and a second value, obtain key information using a key derivation function based on the first calculation result, and obtain a second key and a fourth key based on the key information. The key information may include M bits of bytes. Optionally, the first node can split the key information to obtain the second key and the fourth key. For example, the first node may use the first m bits of the M bits of bytes as the second key and the last Mm bits of the M bits of bytes as the fourth key.

[0033] In this implementation, not only are symmetric keys (i.e., the first key and the second key) generated in the signing process, but also symmetric keys (i.e., the third key and the fourth key) generated in the encryption and decryption process. Thus, the same key is used when the target node encrypts the information transmitted to the first node and when the first node decrypts the information from the target node, which helps to improve the efficiency of the encryption and decryption process.

[0034] In one possible implementation, the first node receives a second value and a third signature sent by the target node, including: the first node receiving the second value, the third signature, a fourth signature, and second information sent by the target node, wherein the fourth signature of the target node is obtained by signing the second information using a first key; after the first node obtains a second key based on the first key factor and the second value, the method further includes: the first node verifying the fourth signature of the target node based on the second key and the second information of the target node. The first node signs a fifth signature based on the second key and the third information; exemplarily, the third information is publicly available information. The first node sends the fifth signature and the third information to the target node, wherein the third information is used for the target node to verify the fifth signature based on the first key and the third information.

[0035] In this implementation, after the target node obtains the first key and the first node obtains the second key, both nodes will use the obtained keys to sign and send the signature to the other party, allowing the other party to verify the signature using the obtained key. This ensures that the key materials of the first key obtained by the target node and the second key obtained by the first node are the same, which helps to improve the smoothness and stability of the subsequent process of signing and verifying the signature using symmetric keys.

[0036] In one possible implementation, the first node receives a second value and a third signature sent by the target node, including: the first node receives the second value, the third signature, and encrypted information sent by the target node, wherein the encrypted information of the target node is obtained by encrypting with a third key; the method further includes: the first node decrypts the encrypted information of the target node using a fourth key.

[0037] In this implementation, after obtaining the third key, the target node will use the third key to encrypt the encrypted information and send it to the first node. The first node will then use the fourth key to decrypt the encrypted information. If the first node successfully decrypts the encrypted information using the fourth key, it can determine that it has obtained the symmetric key from the target node. This helps to improve the smoothness and stability of subsequent encryption and decryption processes using the symmetric key.

[0038] In one possible implementation, the first aggregated signature is obtained by aggregating n first signatures using a preset algorithm. For example, the preset algorithm could be multiplication, addition, averaging, or other algorithms. This implementation clarifies the specific method for aggregating n first signatures to obtain the first aggregated signature, thus improving the feasibility of this solution.

[0039] Secondly, this application provides a signature verification method that can be used in the field of trusted computing. In this method, an aggregation node obtains n first signatures that correspond one-to-one with n second nodes. The aggregation node and the n second nodes belong to the same node cluster. The n first signatures are obtained by the aggregation node from the n second nodes through the communication network within the cluster. The first signature of each second node is obtained by signing using the private key of each second node, where n is an integer greater than 1. The n first signatures are aggregated to obtain a first aggregated signature. The first aggregated signature is sent to the first node, which verifies the first aggregated signature based on the public key of each of the n second nodes.

[0040] In the second aspect of this application, the aggregation node is also used to perform the steps performed by the aggregation node in the first aspect and various possible implementations of the first aspect. The meanings of the terms in the second aspect of this application and various possible implementations of the second aspect, as well as the beneficial effects brought about by each possible implementation, can be referred to the descriptions in the various possible implementations of the first aspect, and will not be repeated here.

[0041] Thirdly, this application provides a key acquisition method that can be used in the field of trusted computing. In this method, a first node generates a first key factor and obtains a first value based on the first key factor and a first base point; sends the first value to a target node, and the first value and a second key factor generated by the target node are used for the target node to obtain a first key. The first key is used for the target node to sign and obtain a signature transmitted to the first node; receives a second value sent by the target node, and the second value is obtained based on the second key factor and the second base point; obtains a second key based on the first key factor and the second value, wherein the second key is used for the first node to verify the signature from the target node, and the key material of the first key and the second key is the same.

[0042] In the third aspect of this application, the first node is also used to perform the steps performed by the first node in the first aspect and various possible implementations of the first aspect. The meanings of the terms in the third aspect of this application and various possible implementations of the third aspect, as well as the beneficial effects brought about by each possible implementation, can be referred to the descriptions in the various possible implementations of the first aspect, and will not be repeated here.

[0043] Fourthly, this application provides a key acquisition method that can be used in the field of trusted computing. In this method, a target node receives a first value sent by a first node, the first value being obtained based on a first key factor and a first base point generated by the first node; generates a second key factor, and obtains a second value based on the second key factor and the second base point; sends the second value to the first node, the second value and the first key factor being used for the first node to obtain a second key, the second key being used for the first node to verify the signature from the target node; and obtains a first key based on the second key factor and the first value, wherein the first key is used for the target node to sign to obtain the signature transmitted to the first node, and the key materials of the first key and the second key are the same.

[0044] In the fourth aspect of this application, the target node is also used to perform the steps performed by the target node and / or the second node in the first aspect and various possible implementations of the first aspect. The meanings of the terms in the fourth aspect of this application and various possible implementations of the fourth aspect, as well as the beneficial effects brought about by each possible implementation, can be referred to the descriptions in the various possible implementations of the first aspect, and will not be repeated here.

[0045] Fifthly, this application provides a signature verification device that can be used in the field of trusted computing. The signature verification device is contained in a first node and includes: an acquisition module for acquiring a first aggregated signature, wherein the first aggregated signature is obtained by aggregating n first signatures, the n first signatures including the first signature of each of the n second nodes, and the first signature of each second node is obtained by signing using the private key of each second node, where n is an integer greater than 1; and a verification module for verifying the first aggregated signature based on the public key of each of the n second nodes.

[0046] In the fifth aspect of this application, the signature verification device is also used to perform the steps executed by the first node in the first aspect and various possible implementations of the first aspect. The meanings of the terms in the fifth aspect and various possible implementations of the fifth aspect, as well as the beneficial effects brought about by each possible implementation, can be referred to the descriptions in the various possible implementations of the first aspect, and will not be repeated here.

[0047] Sixthly, this application provides a signature verification device that can be used in the field of trusted computing. The signature verification device is contained in an aggregation node and includes: an acquisition module for acquiring n first signatures corresponding one-to-one with n second nodes, wherein the aggregation node and the n second nodes belong to the same node cluster, the n first signatures are obtained by the aggregation node from the n second nodes through the communication network within the cluster, and the first signature of each second node is obtained by signing using the private key of each second node, where n is an integer greater than 1; an aggregation module for aggregating the n first signatures to obtain a first aggregated signature; and a sending module for sending the first aggregated signature to the first node, wherein the first aggregated signature is used by the first node to verify the first aggregated signature based on the public key of each of the n second nodes.

[0048] In the sixth aspect of this application, the signature verification device is also used to perform the steps executed by the aggregation node in the first aspect and various possible implementations of the first aspect. The meanings of the terms in the sixth aspect and various possible implementations of the sixth aspect, as well as the beneficial effects brought about by each possible implementation, can be referred to the descriptions in the various possible implementations of the first aspect, and will not be repeated here.

[0049] Seventhly, this application provides a key acquisition device that can be used in the field of trusted computing. The key acquisition device is included in a first node and includes: a generation module for generating a first key factor and obtaining a first value based on the first key factor and a first base point; a sending module for sending the first value to a target node, wherein the first value and a second key factor generated by the target node are used for the target node to obtain a first key, and the first key is used for the target node to sign to obtain a signature transmitted to the first node; a receiving module for receiving a second value sent by the target node, wherein the second value is obtained based on a second key factor and a second base point; and a processing module for obtaining a second key based on the first key factor and the second value, wherein the second key is used for the first node to verify the signature from the target node, and the key materials of the first key and the second key are the same.

[0050] In the seventh aspect of this application, the key acquisition device is also used to perform the steps executed by the first node in the first aspect and various possible implementations of the first aspect. The meanings of the terms in the seventh aspect and various possible implementations of the seventh aspect, as well as the beneficial effects brought about by each possible implementation, can be referred to the descriptions in the various possible implementations of the first aspect, and will not be repeated here.

[0051] Eighthly, this application provides a key acquisition device for use in the field of trusted computing. The key acquisition device is contained in a target node and includes: a receiving module for receiving a first value sent by a first node, the first value being obtained based on a first key factor and a first base point generated by the first node; a generating module for generating a second key factor and obtaining a second value based on the second key factor and the second base point; a sending module for sending the second value to the first node, the second value and the first key factor being used by the first node to obtain a second key, the second key being used by the first node to verify a signature from the target node; and a processing module for obtaining a first key based on the second key factor and the first value, the first key being used by the target node to sign and obtain a signature transmitted to the first node, the key materials of the first key and the second key being the same.

[0052] In the eighth aspect of this application, the key acquisition device is also used to perform the steps executed by the target node and / or the second node in the first aspect and various possible implementations of the first aspect. The meanings of the terms in the eighth aspect of this application and various possible implementations of the eighth aspect, as well as the beneficial effects brought about by each possible implementation, can be referred to the descriptions in the various possible implementations of the first aspect, and will not be repeated here.

[0053] Ninthly, this application provides an apparatus including a processor coupled to a memory storing program instructions, which, when executed by the processor, implement the method described in any one of the first to fourth aspects.

[0054] In a tenth aspect, this application provides a computer-readable storage medium storing a computer program that, when run on a computer, causes the computer to perform the method described in any one of the first to fourth aspects.

[0055] In one aspect, this application provides a computer program product comprising a program that, when run on a computer, causes the computer to perform the method described in any one of the first to fourth aspects.

[0056] In a twelfth aspect, this application provides a chip system including a processor for supporting the implementation of the functions involved in the foregoing aspects, such as transmitting or processing data and / or information involved in the foregoing methods. In one possible design, the chip system further includes a memory for storing program instructions and data necessary for the terminal device or communication device. This chip system may be composed of chips or may include chips and other discrete devices.

[0057] The second to twelfth aspects of this application correspond to the first aspect or multiple possible ways of the first aspect, and have corresponding beneficial effects. Attached Figure Description

[0058] Figure 1 A schematic flowchart illustrating a signature verification method provided in an embodiment of this application;

[0059] Figure 2 Another flowchart illustrating the signature verification method provided in this application embodiment;

[0060] Figure 3 A schematic diagram illustrating signature verification provided in an embodiment of this application;

[0061] Figure 4 Another flowchart illustrating the signature verification method provided in this application embodiment;

[0062] Figure 5 Another flowchart illustrating the signature verification method provided in this application embodiment;

[0063] Figure 6 A schematic diagram of a process for registering n second nodes provided in an embodiment of this application;

[0064] Figure 7 A schematic diagram of a signature verification device provided in an embodiment of this application;

[0065] Figure 8 Another schematic diagram of the signature verification device provided in the embodiments of this application;

[0066] Figure 9 This is a schematic diagram of the structure of a device provided in an embodiment of this application. Detailed Implementation

[0067] The embodiments of this application will now be described with reference to the accompanying drawings. Obviously, the described embodiments are merely some, and not all, of the embodiments of this application. Those skilled in the art will recognize that, with the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0068] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms are interchangeable where appropriate; this is merely a way of distinguishing objects with the same attributes in the description of embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of units is not necessarily limited to those units, but may include other units not explicitly listed or inherent to those processes, methods, products, or apparatuses.

[0069] In the embodiments of this application, "send" and "receive" indicate the direction of signal transmission. For example, "send information to node XX" can be understood as the destination of the information being node XX, which may include direct transmission via the air interface or indirect transmission by other units or modules via the air interface. "Receive information from node YY" can be understood as the source of the information being node YY, which may include direct reception from node YY via the air interface or indirect reception from node YY via other units or modules via the air interface. "Send" can also be understood as the "output" of the chip interface, and "receive" can also be understood as the "input" of the chip interface. In other words, sending and receiving can occur between nodes or within a node, for example, through a bus, trace, or interface between components, modules, chips, software modules, or hardware modules within a node. It is understood that information may undergo necessary processing, such as encoding and modulation, between the source and destination of the information transmission, but the destination can understand the valid information from the source. Similar expressions in this application can be understood in a similar way and will not be elaborated further.

[0070] In the embodiments of this application, "instruction" can include direct and indirect instructions, as well as explicit and implicit instructions. The information indicated by a certain piece of information (hereinafter referred to as instruction information) is called the information to be instructed. In specific implementation, there are many ways to indicate the information to be instructed, such as, but not limited to, directly indicating the information to be instructed, such as the information to be instructed itself or its index. It can also indirectly indicate the information to be instructed by indicating other information, where there is an association between the other information and the information to be instructed; or it can indicate only a part of the information to be instructed, while the other parts are known or pre-agreed upon. For example, the instruction can be implemented by using a pre-agreed (e.g., protocol predefined) arrangement of various information, thereby reducing the instruction overhead to a certain extent. This application does not limit the specific method of instruction. It is understood that for the sender of the instruction information, the instruction information can be used to indicate the information to be instructed; for the receiver of the instruction information, the instruction information can be used to determine the information to be instructed.

[0071] The method provided in this application can be applied to trusted computing scenarios, where trusted computing is the foundation of security because security can only be further achieved in a trusted environment. Adding trusted verification to the system and / or program can ensure the integrity of the system and / or program, that is, ensure that the correct system and / or program is used, rather than a tampered system and / or program. Adding trusted verification to the system and / or program can reduce the possibility of being attacked due to the use of a tampered system or program, thereby maximizing the security during the use of the system and / or program.

[0072] For example, to enhance computing power, a worker node cluster can be constructed, which includes multiple worker nodes. To ensure the trustworthiness of the multiple worker nodes in the aforementioned worker node cluster, it is necessary to perform trust verification on the multiple worker nodes in the worker node cluster. In order to provide an efficient verification scheme, this application discloses that: the first node can obtain a first aggregated signature, which is obtained by aggregating n first signatures. The n first signatures include the first signature of each of the n second nodes. The first signature of each second node is obtained by signing using the private key of each second node, where n is an integer greater than 1; then the first node verifies the first aggregated signature based on the public key of each of the n second nodes.

[0073] Since if the signature verification after the first aggregation is successful, it means that all n first signatures have been successfully verified; if the signature verification after the first aggregation fails, it means that all n first signatures have failed to be verified. Therefore, the first node can complete the verification of the signatures of the n second nodes at once. Thus, this application provides an efficient verification scheme.

[0074] Based on the above description, the detailed implementation process of the signature verification method provided in this application is described below. Please refer to [link / reference]. Figure 1 , Figure 1 This is a flowchart illustrating a signature verification method provided in an embodiment of this application. The signature verification method provided in this application may include steps 101 and 102.

[0075] Step 101: The first node obtains the first aggregated signature. The first aggregated signature is obtained by aggregating n first signatures. The n first signatures include the first signature of each of the n second nodes. The first signature of each second node is obtained by signing using the private key of each second node. n is an integer greater than 1.

[0076] In this context, the first node can be understood as a verification node; for example, the first node can be a server, or it can be called a verification server. Exemplarily, the n second nodes can belong to the same node cluster; for example, the n second nodes can be n compute nodes, or n second nodes can be n storage nodes, or the n second nodes can include both compute nodes and storage nodes, etc. The specific nodes included in the n second nodes can be determined based on the actual application scenario. Exemplarily, the first node may not belong to the aforementioned node cluster; in other words, the first node can be a server outside of the aforementioned node cluster.

[0077] For example, the first signature of each second node is obtained by signing the first information of each second node using the private key of each second node. For example, the signature algorithm used in the above signature can be: the boeh-lynn-shacham (BLS) signature algorithm, the Ron Rivest-Adi Shamir-Leonard Adleman (RSA) signature algorithm, or other types of signature algorithms, which can be determined according to the actual application scenario.

[0078] The first information may include measurement content, whereby the measurement content of each second node includes the data required for trusted verification of each second node. Optionally, the first information may also include a nonce. The measurement content may include a mirror image of the current information on the second node that needs to be verified when performing trusted verification on the second node; in other words, the measurement content may include the current information on the second node that needs to be verified to prove that the second node is a trusted execution environment.

[0079] For example, the type of measurement event corresponding to the measurement content can be: measurement of the basic input output system (BIOS), measurement of the bootloader, measurement of the operating system (OS), measurement of the application, dynamic integrity measurement (DIM) or other types, which can be determined according to the actual application scenario.

[0080] Furthermore, measuring the BIOS on the second node can be understood as performing a trusted verification of the BIOS on the second node. More specifically, it can be a trusted verification performed by a trusted execution environment on the BIOS of the second node. For example, when measuring the BIOS, the measurement content may include the code of the BIOS currently used on the second node and various preset types of status values.

[0081] Correspondingly, measuring the Bootloader on the second node can be understood as performing a trusted verification of the Bootloader within the second node. More specifically, it can be to prove that the Bootloader on the second node is verified by a trusted execution environment. Measuring the OS on the second node can also be understood as performing a trusted verification of the OS within the second node. More specifically, it can be to prove that the OS on the second node is verified by a trusted execution environment. Measuring the applications on the second node can be understood as performing a trusted verification of the applications within the second node. More specifically, it can be to prove that the applications on the second node are verified by a trusted execution environment.

[0082] For example, dynamic integrity measurement may include measuring the data in the memory of the second node during its runtime to determine whether the critical data in the memory has been tampered with, thereby achieving trusted verification of the second node's runtime environment. For instance, the data in the memory of the second node may include code; that is, when performing dynamic integrity measurement on the second node, the measurement content may include the code in the memory data of the second node, etc.

[0083] It should be noted that the examples of measurement content mentioned above are only for the purpose of understanding this solution. The specific information included in the measurement content can be determined based on the actual application scenario.

[0084] Optionally, "aggregating n first signatures to obtain a first aggregated signature" can be understood as merging n first signatures into a single first aggregated signature. The aggregation method may include using a preset algorithm to aggregate the n first signatures to obtain the first aggregated signature. For example, the preset algorithm may be multiplication, addition, averaging, or other algorithms. More specifically, the n first signatures can be multiplied to obtain the first aggregated signature. Alternatively, the n first signatures can be added to obtain the first aggregated signature, or the n first signatures can be added and averaged to obtain the first aggregated signature, etc. The specific preset algorithm used can be determined based on the actual application scenario. This embodiment of the application clarifies the specific method for aggregating n first signatures to obtain the first aggregated signature, improving the implementability of this solution.

[0085] To further understand this scheme, the following code is disclosed when aggregating n first signatures:

[0086] compute s←∏s_i,i=1,…,n

[0087] Where s represents the first aggregated signature, s_i represents the i-th first signature among n first signatures, and s←∏s_i represents the first aggregated signature obtained by multiplying the n first signatures. It should be understood that the example here is only for the convenience of understanding this scheme and is not intended to limit this scheme.

[0088] In one implementation, step 101 may include: the first node receiving a first aggregated signature from the aggregating node; in other words, the first node receiving the first aggregated signature sent by the aggregating node. The first aggregated signature is obtained by the aggregating node aggregating n first signatures. The aggregating node and the n second nodes belong to the same node cluster, and the n first signatures are obtained by the aggregating node from the n second nodes through the cluster's communication network.

[0089] In this embodiment, the aggregation node obtains n first signatures from n second nodes, and aggregates these n first signatures to obtain a first aggregated signature. Since the aggregation node and the n second nodes belong to the same node cluster, and the aggregation node communicates with the n second nodes using the cluster's communication network, the communication speed between the aggregation node and the n second nodes is faster. The aggregation node sends the first aggregated signature to the first node, which verifies the first aggregated signature. That is, the first node only needs to receive the first aggregated signature from the aggregation node, which saves communication time compared to the first node obtaining n first signatures from the n second nodes. In addition, since the aggregation node aggregates the n first signatures, the first node no longer needs to aggregate the n first signatures to obtain the first aggregated signature, but directly receives the first aggregated signature from the aggregation node. This is equivalent to splitting the work of aggregating the n first signatures from the first node to the aggregation node, further reducing the workload of the first node and helping to avoid the first node being too busy.

[0090] For example, the communication network within the cluster can be a wired network; in other words, the aggregating node and the n second nodes can communicate via a wired network. The first aggregated signature can be obtained by the first node from the aggregating node via a communication network outside the cluster; for example, the communication network outside the cluster can be the Internet; in other words, the first node and the aggregating node can communicate via the Internet.

[0091] The aggregating node can receive the first signature from each of the n second nodes through the cluster's communication network (resulting in n first signatures), and aggregate these n first signatures to obtain the first aggregated signature. The aggregating node then sends the first aggregated signature to the first node through the external communication network, and correspondingly, the first node can receive the first aggregated signature from the aggregating node.

[0092] To understand this solution more intuitively, please refer to [link / reference]. Figure 2 , Figure 2 This is another flowchart illustrating the signature verification method provided in an embodiment of this application. Figure 2 Taking the first node obtaining the first aggregated signature through the aggregation node as an example, such as... Figure 2 As shown, the n second nodes and the aggregation node are nodes within the same node cluster. Each of the n second nodes generates a first signature using its private key. The aggregation node receives the first signatures from each of the n second nodes through the cluster's communication network, thus obtaining n first signatures. The aggregation node aggregates these n first signatures to obtain a first aggregated signature, which is then sent to the first node. The first node verifies the first aggregated signature. It should be understood that... Figure 2 The examples in this document are for illustrative purposes only and are not intended to limit the scope of this solution.

[0093] Optionally, the first node can also receive the measurement content from each of the n second nodes; for example, the aggregation node can receive the first signature and measurement content sent by each of the n second nodes through the cluster's communication network (obtaining n first signatures and n measurement contents), and aggregate the n first signatures to obtain a first aggregated signature. The aggregation node sends the first aggregated signature and the n measurement contents to the first node through the communication network outside the cluster. Combining the above... Figure 1 The description continues to... Figure 1 To introduce, correspondingly, Figure 1 Step 101 may include: the first node may receive the first aggregated signature and n metric contents from the aggregation node.

[0094] Alternatively, after obtaining n first signatures and n metrics, the aggregating node can not only aggregate the n first signatures to obtain the first aggregated signature, but also aggregate the n metrics to obtain the aggregated metric. The aggregating node then sends the first aggregated signature and the aggregated metric to the first node via the external communication network. Correspondingly, Figure 1 Step 101 may include: the first node may receive the first aggregated signature and the aggregated metric content from the aggregation node.

[0095] For a specific implementation of aggregating n metrics to obtain aggregated metrics, for example, each second node's metrics can include S types of information, where S is an integer greater than or equal to 1. The aggregated metrics can include S types of aggregated information. The target type is any one of the S types. Each of the n second nodes includes target type information in its metrics. The aggregation node or first node can obtain n pieces of target type information from the n second nodes' metrics and aggregate these n pieces of target type information to obtain aggregated information of the target type. The aggregation node or first node performs the aforementioned operation on each of the S types of information to obtain the aggregated information of the S types included in the aggregated metrics. For example, the aggregation method can be multiplication, or it can be addition, etc. The specific aggregation method can be flexibly determined based on the actual application scenario.

[0096] For example, before the aggregation node receives the first signature and measurement content sent by each of the n second nodes, the first node may also initiate a first verification request. This first verification request may include a random number and may indicate which measurement content should be verified. The first node sends the first verification request to the aggregation node, which then forwards it to each of the n second nodes. After receiving the first verification request, each second node can determine the random number and measurement content based on the request, thus determining the first information. It then signs the first information using its private key to obtain a first signature, and each second node sends the first signature, measurement content, and random number to the aggregation node.

[0097] Furthermore, in one scenario, the first node can receive a second verification request sent by the client device. This second verification request is used to request trusted verification. In response to the second verification request sent by the client device, the first node can initiate a first verification request. That is, the entire trusted verification process can be triggered by the client device. For example, the client device can send a second verification request to the first node before using the cloud service, or it can send a second verification request to the first node before using the cloud service, or it can send a second verification request to the first node periodically during the use of the cloud service.

[0098] In another scenario, the first node can also proactively initiate the first verification request, meaning the entire trusted verification process can be triggered by the first node. For example, when n second nodes start up for the first time, the first node can proactively initiate the first verification request; or, during the operation of n second nodes, the first node can proactively initiate the first verification request, and so on. The specific circumstances that will trigger trusted verification of the second nodes can be determined in conjunction with the actual application scenario, and are not exhaustively listed in this application embodiment.

[0099] In another implementation, step 101 includes: the first node receives the first signature sent by each of the n second nodes (i.e., a total of n first signatures), and aggregates the n first signatures to obtain the first aggregated signature.

[0100] Optionally, step 101 may include: the first node receiving the first signature and measurement content sent by each of the n second nodes (i.e., a total of n first signatures and n measurement contents), and aggregating the n first signatures to obtain a first aggregated signature; optionally, the first node may also aggregate the n measurement contents to obtain aggregated measurement contents.

[0101] For example, the first node can initiate a first verification request, which may include a random number and indicate which metrics should be verified. The first node sends the first verification request to each of the n second nodes. After receiving the first verification request, each second node can determine the random number and metrics based on the first verification request, thereby determining the first information. The first information is then signed using the private key of each second node to obtain a first signature. Each second node sends the first signature, metrics, and random number to the first node. Correspondingly, the first node receives the first signature and metrics from each of the n second nodes (i.e., a total of n first signatures and n metrics). The scenario that triggers the first node to initiate the first verification request can be found in the above description, and will not be repeated here.

[0102] Step 102: The first node verifies the first aggregated signature based on the public key of each of the n second nodes.

[0103] For example, Figure 1 Step 102 may include: the first node may verify the first aggregated signature using the BLS signature algorithm based on the public key of each of the n second nodes (i.e., n public keys). Alternatively, step 102 may include: the first node may verify the first aggregated signature using the RSA signature algorithm based on the public key of each of the n second nodes (i.e., n public keys). Alternatively, the first node may also use other signature algorithms to verify the first aggregated signature, etc., which are not exhaustively described in this embodiment.

[0104] To further understand this scheme, the following code is disclosed for verifying the first aggregated signature based on the public key of each of the n second nodes:

[0105] Compute h_i←H(pk_i,M_i)for 1≤i≤N,and accept if e(S,g)=∏e(h_i,pk_i)holds

[0106] Where pk_i represents the public key of the i-th second node among N second nodes, M_i includes the first information of the i-th second node, which includes the metric content and random number of the i-th second node, H(pk_i,M_i) represents the hash operation on pk_i and M_i, S represents the signature after the first aggregation, g represents the base point, and e(S,g) represents the function e() executed on S and g. For example, if the BLS signature algorithm is used, the function e() can be a bilinear pairing function; if the RSA signature algorithm is used... The function e() can be a computation function for an integer group. e(h_i,pk_i) represents executing the function e() on h_i and pk_i, and ∏e(h_i,pk_i) represents multiplying N e(h_i,pk_i). If e(S,g) is equal to ∏e(h_i,pk_i), it means that the signature verification after the first aggregation is successful. If e(S,g) is not equal to ∏e(h_i,pk_i), it means that the signature verification after the first aggregation fails. It should be understood that the example here is only for the convenience of understanding this scheme and is not intended to limit this scheme.

[0107] To understand this solution more intuitively, please refer to [link / reference]. Figure 3 , Figure 3 This is a schematic diagram illustrating signature verification provided in an embodiment of this application, such as... Figure 3 As shown, after obtaining n first signatures, the aggregation node will aggregate the n first signatures into a first aggregated signature. Figure 3 The code shown illustrates the aggregation of n first signatures, multiplying them to obtain the first aggregated signature. After the aggregation node sends the first aggregated signature to the first node, the first node verifies it. For example, if the verification of the first aggregated signature is successful, it means all n first signatures have been successfully verified; if the verification of the first aggregated signature fails, it means all n first signatures have failed to be verified, thus achieving batch verification of n first signatures. Figure 3 The code for verifying the first aggregated signature is also disclosed, that is, the code for batch verification of n first signatures. The specific meaning of this code can be found in the above description, and will not be repeated here. Figure 3 The examples in this document are for illustrative purposes only and are not intended to limit the scope of this solution.

[0108] Optionally, if the first signature of each second node is obtained by signing the measurement content of each second node using the private key of each second node, the method may further include: if the signature verification after the first aggregation is successful and the measurement content verification of n second nodes is successful, the first node determines that the n second nodes have been successfully verified. If the signature verification after the first aggregation fails or the measurement content verification of n second nodes fails, the first node determines that the n second nodes have failed to verify.

[0109] Optionally, the first node can also obtain a verification report, which indicates whether the trusted verification of the n second nodes was successful or failed. Specifically, if the signature verification after the first aggregation is successful and the metric content verification of the n second nodes is successful, the verification report indicates that the n second nodes have been successfully verified; if the signature verification after the first aggregation fails or the metric content verification of the n second nodes fails, the verification report indicates that the n second nodes have failed.

[0110] In this process, the first node can either first verify the aggregated signature (i.e., the signatures of the n second nodes), and if the first aggregated signature verification is successful, then verify the measurement content of the n second nodes to obtain a verification report; if the first aggregated signature verification fails, the verification report can be determined as a result of trusted verification of the n second nodes, indicating verification failure. Alternatively, the first node can first verify the measurement content of the n second nodes, and if the measurement content of the n second nodes verification is successful, then verify the aggregated signature (i.e., the signatures of the n second nodes) to obtain a verification report; if the measurement content of the n second nodes verification fails, the verification report can be determined as a result of trusted verification of the n second nodes, indicating verification failure.

[0111] Regarding the specific implementation of the first node verifying the measurement content of n second nodes, for example, in one implementation, the first node can perform a trusted verification on the aggregated measurement content. If the aggregated measurement content is successfully verified, it means that the measurement content of the n second nodes has been successfully verified; if the aggregated measurement content fails to be verified, it means that the measurement content of the n second nodes has failed to be verified.

[0112] For example, the first node can deploy first verification content. The first node can determine whether the aggregated metric content has been successfully verified by comparing the first verification content with the aggregated metric content. The first verification content and the aggregated metric content contain the same type of information. Specifically, each second node's metric content includes S types of information, the aggregated metric content can include S types of aggregated information, and the first verification content includes S types of first verification information that correspond one-to-one with the S types of aggregated information. Each type of first verification information can be understood as the expected value range of each type of aggregated information. The expected value range of each type of aggregated information can include only one expected value, multiple discrete expected values, or a continuous value range. When all S types of aggregated information are within the value range of the first verification information of that type, the aggregated metric content is successfully verified; when any one type of aggregated information is outside the value range of the first verification information of that type, the aggregated metric content verification fails.

[0113] In another implementation, the first node can sequentially perform trusted verification on the measurement content of each of the n second nodes. If the measurement content of all n second nodes is successfully verified, it means that the measurement content of the n second nodes has been successfully verified; if the measurement content of any one of the n second nodes fails to be verified, it means that the measurement content of the n second nodes has failed to be verified.

[0114] For example, the first node can deploy second verification content. The first node can determine whether the aggregated metric content has been successfully verified by comparing the second verification content with the aggregated metric content. Each second node's metric content includes S types of information, and the second verification content includes S types of second verification information corresponding one-to-one with the S types of information. Each type of second verification information can be understood as the expected value range of each type of information in the metric content of each second node. When all types of information in the metric content of a second node fall within the value range of the second verification information for that type, the metric content of that second node is successfully verified; when any type of information in the metric content of a second node falls outside the value range of the second verification information for that type, the metric content of that second node is verified as failed.

[0115] In this embodiment, it is clarified that the first signature is obtained by signing the measurement content of the second node using the private key of the second node. The measurement content of each second node includes the data required for trusted verification of each second node. That is, the method provided by this application can be applied to the scenario of trusted verification of the second node, which improves the degree of integration between this solution and specific application scenarios. In addition, if the signature after the first aggregation is successfully verified and the measurement content of n second nodes is successfully verified, it is determined that the n second nodes are successfully verified. This clarifies the integration idea between the batch verification method of the signatures of n second nodes provided by this application and the specific application scenario of trusted verification of n second nodes, further improving the degree of integration between this solution and specific application scenarios.

[0116] Furthermore, the type of measurement event corresponding to the measurement content can be BIOS measurement, bootloader measurement, operating system (OS) measurement, or application measurement, which provides multiple application scenarios for the method provided in this application and improves the implementation flexibility of this solution.

[0117] Optionally, if the trusted verification process is triggered by the client device, the first node can also send the verification report to the client device after obtaining it. For a more intuitive understanding of this solution, please refer to [link to relevant documentation]. Figure 4 , Figure 4 This is another flowchart illustrating the signature verification method provided in an embodiment of this application. Figure 4 Taking the first node obtaining the first aggregated signature through the aggregation node as an example, such as... Figure 4 As shown, the n second nodes and the aggregation node are nodes within the same node cluster. After receiving the second verification request from the client device, the first node can generate a first verification request, which includes a random number and indicates the metric content to be verified. The first node sends the first verification request to the aggregation node, which forwards it to each of the n second nodes. Each second node determines the metric content based on the first verification request and signs it using its private key to obtain a first signature. Each second node can then send the first signature, the metric content, and the random number to the aggregation node. The aggregation node aggregates the n first signatures to obtain a first aggregated signature and sends a verification response to the first node. The verification response includes the first aggregated signature, the metric content of the n second nodes, and the random number. The first node can deploy the public keys of each of the n second nodes. The first node can verify the first aggregated signature and the metric content of the n second nodes based on the public keys of each of the n second nodes, obtaining a verification report. The first node sends the verification report to the client device. It should be understood that... Figure 4 The examples in this document are for illustrative purposes only and are not intended to limit the scope of this solution.

[0118] In this embodiment, after n first signatures are obtained by each of the n second nodes using their respective private keys, the n first signatures from the n second nodes can be aggregated to obtain a first aggregated signature. Then, the first node verifies the first aggregated signature based on the public key of each of the n second nodes. If the verification of the first aggregated signature is successful, it means that all n first signatures have been verified successfully. If the verification of the first aggregated signature fails, it means that all n first signatures have failed to be verified. The first node can complete the verification of the signatures of the n second nodes at one time, providing an efficient verification scheme.

[0119] Optionally, based on the above description, please refer to Figure 5 , Figure 5 This is another flowchart illustrating the signature verification method provided in this application embodiment. The signature verification method provided in this application embodiment may include steps 501 to 513.

[0120] Step 501: The aggregation node obtains n first signatures that correspond one-to-one with the n second nodes. The aggregation node and the n second nodes belong to the same node cluster, where n is an integer greater than 1. The n first signatures are obtained by the aggregation node from the n second nodes through the communication network within the cluster. The first signature of each second node is obtained by signing the measurement content of each second node using the private key of each second node. The measurement content includes the data required for trusted verification of the second node.

[0121] Step 502: The aggregation node aggregates the n first signatures to obtain the first aggregated signature.

[0122] Step 503: The aggregation node sends the first aggregated signature to the first node.

[0123] Step 504: The first node verifies the first aggregated signature based on the public key of each of the n second nodes.

[0124] Step 505: If the signature verification after the first aggregation is successful and the metric content verification of the n second nodes is successful, the first node determines that the n second nodes have been successfully verified.

[0125] For example, in step 503, the aggregation node can also send the measurement content of each of the n second nodes to the first node, or the aggregation node can also send the aggregated measurement content to the first node, so that the first node can verify the measurement content of the n second nodes. The meanings of the terms in steps 501 to 505 and the specific implementation methods of steps 501 to 505 can be found in the above description. Figure 1 The descriptions in the corresponding embodiments will not be repeated here.

[0126] It should be noted that steps 501 to 505 are one implementation method. In another implementation method, instead of setting up an aggregation node between the first node and the n second nodes, the first node can directly communicate with the n second nodes. The first node can receive the first signature and measurement content sent by each of the n second nodes. The first node aggregates the n first signatures to obtain a first aggregated signature, and then verifies the first aggregated signature and the measurement content of the n second nodes to obtain a verification report. For the specific implementation method of the aforementioned steps, please refer to [link to relevant documentation]. Figure 1 The descriptions in the corresponding embodiments will not be repeated here.

[0127] Step 506: The first node generates the first key factor and obtains the first value based on the first key factor and the first base point.

[0128] Step 506 is optional. If n second nodes successfully verify the data, the first node can generate a first key factor, and then obtain a first value based on the first key factor and a first base point. For example, the first key factor can be a first random number generated by the first node, and the first value is obtained by multiplying the first key factor by the first base point. Here, the base point is a concept in cryptography, and can also be referred to as a generator. For example, in this application, the base point can be a base point on an elliptic curve; in other words, the base point in this application can be understood as the base point used in elliptic curve cryptography (ECC).

[0129] Optionally, the first node can also obtain a second signature by signing based on its private key; for example, the first node can obtain a second signature by signing the fourth information using a signature algorithm based on its private key. Examples of signature algorithms can be found above. Figure 1 The description in the corresponding embodiment will not be repeated here. The fourth information may include the first value; optionally, the fourth information may also include the identity information of the first node, for example, the identity information of the first node may be the identity identifier of the first node.

[0130] To further understand this solution, the code used in step 506 is disclosed below:

[0131] Generate a random number x;

[0132] X = xg;

[0133] S_X = Sign(SK, X||ID_S);

[0134] Wherein, random number x represents the first key factor, X represents the first value, X = xg means multiplying random number x with the first base point g to obtain the first value X, S_X represents the second signature, SK represents the private key of the first node, ID_S represents the identity identifier of the first node, and Sign(SK,X||ID_S) means signing the fourth information based on the private key of the first node using a signature algorithm to obtain the second signature. The fourth information includes the first value and the identity information of the first node. It should be understood that this example is only for the convenience of understanding this scheme.

[0135] Step 507: The first node sends the first value to the target node, which is any one of the n second nodes.

[0136] Step 507 is optional. Optionally, step 507 may include: after obtaining the first value, the first node may send the first value to each of the n second nodes (including the target node), and correspondingly, each of the n second nodes may receive the first value sent by the first node.

[0137] Optionally, step 507 may include: the first node sending a second signature and a first value to the target node, wherein the second signature is used by the target node to verify the second signature using the first node's public key; optionally, if the fourth information also includes the identity information of the first node, the first node may also send the identity information of the first node to the target node.

[0138] Optionally, step 507 may include: each of the n second nodes (including the target node) sends a second signature and a first value (optionally, also including the identity information of the first node), and correspondingly, each of the n second nodes can receive the second signature and the first value sent by the first node (optionally, also including the identity information of the first node).

[0139] Step 508: The target node generates a second key factor and obtains a second value based on the second key factor and the second base point.

[0140] Step 508 is optional. After receiving the first value, the target can generate a second key factor and obtain a second value based on the second key factor and the second base point. The first base point and the second base point can be the same or different. For example, the second key factor can be a second random number generated by the target node, and the second key factor can be multiplied by the second base point to obtain the second value.

[0141] For example, multiplying the first key factor and the second value of the target node yields the first calculation result corresponding to the target node, and multiplying the first value and the second key factor generated by the target node yields the second calculation result corresponding to the target node. The first calculation result and the second calculation result corresponding to any one of the n second nodes are the same.

[0142] Optionally, if the target node also receives a second signature, it can further verify the second signature using the first node's public key. Step 508 includes: if the second signature verification is successful, the target node generates a second key factor and obtains a second value based on the second key factor and the second base point. If the second signature verification fails, subsequent steps can be terminated.

[0143] Step 509: The target node obtains a first key based on the first value and the second key factor. The first key is used by the target node to sign the document to obtain the signature transmitted to the first node.

[0144] Step 509 is optional. For example, the target node can obtain a second calculation result corresponding to the target node based on the first value and the second key factor, use a key derivation function to obtain key information based on the second calculation result corresponding to the target node, and obtain the first key of the target node based on the key information. The first key is used by the target node to sign the document transmitted to the first node; in other words, the first key of the target node is the key used by the target node when generating the signature transmitted to the first node.

[0145] For example, key derivation functions include: HMAC-based extract-and-expand key derivation function (HKDF), cipher-based message authentication code (CMAC) generation algorithm, Galois message authentication code (GMAC) generation algorithm, or other types of key derivation functions, etc., which are not exhaustively listed in this application embodiment. The key information may include M bits of bytes. The target node can use the key information as its first key, or it can use the first m bits of the M bits as its first key, etc., depending on the actual application scenario. M and m are both integers greater than or equal to 1, and the value of M is greater than m.

[0146] Optionally, the target node obtains a first key and a third key based on a first value and a second key factor. The third key is the key used by the target node to encrypt information transmitted to the first node.

[0147] For example, the target node can obtain a second calculation result corresponding to the target node based on a first value and a second key factor. Based on the second calculation result, a key derivation function is used to obtain key information. Based on the key information, the target node obtains a first key and a third key. The key information may include M bits of bytes. The target node can split the key information to obtain its first key and third key. For example, the target node may use the first m bits of the M bits as its first key and the last Mm bits as its third key.

[0148] Optionally, the target node can also use its private key to sign and obtain a third signature. For example, the target node can use a signature algorithm based on its private key to sign the fifth information and obtain its third signature. The fifth information may include the second value, and optionally, it may also include the target node's identity information.

[0149] Optionally, the target node may also use the first key to sign the second information to obtain the target node's fourth signature. For example, the second information may be publicly available information in the target node.

[0150] Optionally, the target node may also use a third key to encrypt the sixth information to obtain encrypted information. For example, the sixth information may be information in the target node that needs to be kept confidential.

[0151] To further understand this solution, the code used in steps 508 and 509 is disclosed below:

[0152] Generate a random number y_i;

[0153] Y_i = y_i g;

[0154] S_i = Sign(sk_i, Yi_i||ID_i);

[0155] MK_i = y_i X;

[0156] K_Enc||K_MAC=HKDF(MK_i,Y_i||X||ID_S||ID_i);

[0157] C = AEAD(K_Enc,m1);

[0158] MAC1 = HMAC(K_MAC, m2);

[0159] Wherein, random number y_i represents the second key factor generated by the i-th second node (i.e., the target node) among N second nodes, Y_i represents the second value of the target node, Y_i = y_i g represents multiplying the random number y_i with the base point g to obtain the second value of the target node, S_i represents the third signature of the target node, sk_i represents the private key of the target node, ID_i represents the identity identifier of the target node, and Sign(sk_i,Y_i||ID_i) represents signing the fifth information based on the private key of the target node using a signature algorithm to obtain the second signature. The fifth information includes the second value of the target node and the identity information of the target node.

[0160] MK_i represents the second calculation result corresponding to the target node. MK_i = y_i. X represents multiplying the second key factor of the target node with the first value to obtain the second calculation result corresponding to the target node. HKDF(MK_i,Y_i||X||ID_S||ID_i) represents obtaining the key information based on MK_i, Y_i, X, ID_S and ID_i using the key derivation function HKDF, and splitting the key information to obtain K_Enc and K_MAC, where K_Enc represents the first key of the target node and K_MAC represents the third key of the target node.

[0161] m1 represents the second information of the target node, and C represents the fourth signature of the target node. C = AEAD(K_Enc, m1) means that the second information of the target node is signed using the first key of the target node (i.e., K_Enc) to obtain the fourth signature of the target node. Authenticated Encryption with Associated Data (AEAD) is a signature algorithm. M2 represents the sixth information of the target node, and MAC1 represents the encrypted information of the target node. MAC1 = HMAC(K_MAC, m2) means that the sixth information of the target node is encrypted using the third key of the target node (i.e., K_MAC) to obtain the encrypted information of the target node. HMAC is an encryption algorithm. It should be understood that this example is only for the convenience of understanding this scheme.

[0162] For example, each of the n second nodes is a successfully registered node. This application embodiment also provides an initial registration process for each of the n second nodes. Each of the n second nodes may include a public key and a private key. Each second node can use its private key to sign its public key and identity information to obtain a sixth signature. Each second node sends the sixth signature, its public key, and its identity information to a Certificate Authority (CA). Correspondingly, the CA receives the sixth signature, public key, and identity information of each second node. The CA is the authoritative body responsible for issuing and managing digital certificates. As a trusted third party in e-commerce transactions, it assumes the responsibility for verifying the legitimacy of public keys in the public key system. The CA verifies the sixth signature of each second node based on its public key and identity information. If the sixth signature verification is successful, the second node is successfully registered, and the CA generates a certificate for the second node and sends the certificate to the second node. If the sixth signature verification fails, the second node registration fails. The public key of a successfully registered second node is legitimate, meaning that the public key of a successfully registered second node can be trusted.

[0163] To further understand this scheme, the following code is disclosed, showing how the i-th second node out of n second nodes generates the sixth signature and the certificate for the i-th second node out of n second nodes:

[0164] S_i=Sign(SK_i,ID_i||PK_i);

[0165] Where S_i represents the sixth signature obtained by the i-th second node out of n second nodes, SK_i represents the private key of the i-th second node out of n second nodes, ID_i represents the identity information of the i-th second node out of n second nodes, PK_i represents the public key of the i-th second node out of n second nodes, and Sign(SK_i,ID_i||PK_i) means using the private key of the i-th node to sign the private key and identity information of the i-th node to obtain the sixth signature.

[0166] Cert_i=Sign(SK1,ID_i||PK_i);

[0167] Where Cert_i represents the certificate of the i-th second node, SK1 represents the private key of the CA, ID_i represents the identity information of the i-th second node, PK_i represents the public key of the i-th second node, and Sign(SK1,ID_i||PK_i) represents signing ID_i and PK_i using the private key of the CA. It should be understood that this example is only for the convenience of understanding this scheme.

[0168] To understand this solution more intuitively, please refer to [link / reference]. Figure 6 , Figure 6 This is a schematic diagram illustrating a registration process for n second nodes provided in an embodiment of this application. Each second node can use its private key to sign its public key and identity information to obtain a sixth signature, for example... Figure 6 The diagram shows S1 = Sign(SK_1, ID_1||PK_1) and Sn = Sign(SK_n, ID_n||PK_n), where S1 represents the sixth signature obtained by second node 1 out of n second nodes, SK_1 represents the private key of second node 1 out of n second nodes, ID_1 represents the identity information of second node 1 out of n second nodes, PK_1 represents the public key of second node 1 out of n second nodes, and Sign(SK_1, ID_1||PK_1) represents the signature obtained by second node 1 using its private key. The private key and identity information of node 1 are used to sign the sixth signature of node 1. Sn represents the sixth signature obtained by node n out of n second nodes, SK_n represents the private key of node n out of n second nodes, ID_n represents the identity information of node n out of n second nodes, PK_n represents the public key of node n out of n second nodes, and Sign(SK_n, ID_n||PK_n) represents signing the private key and identity information of node n using the private key of node n to obtain the sixth signature of node n. Each second node sends the sixth signature, the public key of the second node, and the identity information of the second node to the CA, for example... Figure 6The diagram shows that second node 1 sends S1, ID_1, and PK_1 to the CA, and second node n sends Sn, ID_n, and PK_n to the CA. The CA verifies the sixth signature of each second node based on its public key and identity information. If verification is successful, a certificate is generated for that second node, and the CA then sends the certificate to that second node. For example... Figure 6 In this context, Cert_1 = Sign(SK1, ID_1||PK_1) is the certificate of the second node 1. Figure 6 In this context, Cert_n = Sign(SK1, ID_n||PK_n) represents the certificate of the second node n. This should be understood. Figure 6 The examples in this document are for illustrative purposes only and are not intended to limit the scope of this solution.

[0169] Step 510: The first node receives the second value from the target node and obtains the second key based on the first key factor and the second value. The second key is used by the first node to verify the signature from the target node. The key materials of the first key and the second key are the same.

[0170] Step 510 is optional. For example, the target node can send a second value to the first node, and the first node can receive the second value sent by the target node. The first node can then obtain the first calculation result corresponding to the target node based on the first key factor and the second value of the target node. Since the first calculation result and the second calculation result corresponding to the target node are the same, the first node can obtain key information using a key derivation function based on the first calculation result corresponding to the target node. The first node can obtain a second key corresponding to the target node based on the key information. This second key is used by the first node to verify the signature from the target node.

[0171] The first key and the second key have the same key material; in other words, the first key and the second key are the same key, or the key content of the first key and the second key is the same.

[0172] Since the first key is used by the target node to sign the document to the first node, and the second key is used by the first node to verify the signature from the target node, and the key materials of the first key and the second key are the same, this method can be understood as using symmetric keys in the process of signing and verifying the signature.

[0173] It should be noted that the specific implementation of "the first node obtains key information by using a key derivation function based on the first calculation result, and obtains the second key based on the key information" can be found in the description of the specific implementation of "the target node obtains key information by using a key derivation function based on the second calculation result, and obtains the first key based on the key information" above. The difference is that the second calculation result in the above description is replaced with the first calculation result, and the first key in the above description is replaced with the second key. This will not be described in detail here.

[0174] Optionally, the first node can obtain a second key and a fourth key corresponding to the target node based on the key information. The fourth key is the key used by the first node to decrypt information from the target node, and the key materials of the third key and the fourth key are the same.

[0175] Since the third key is the key used by the target node to encrypt the information transmitted to the first node, and the fourth key is the key used by the first node to decrypt the information from the target node, and the key materials of the third key and the fourth key are the same, this method can be understood as using symmetric keys in the encryption and decryption process.

[0176] It should be noted that the specific implementation of "the first node obtains the second and fourth keys based on the key information" can be found in the description of the specific implementation of "the target node obtains the first and third keys based on the key information" above. The difference is that the first key in the above description is replaced with the second key, and the third key in the above description is replaced with the fourth key. This will not be described in detail here.

[0177] The first node can perform the above steps on each of the n second nodes to obtain the second key corresponding to each of the n second nodes; optionally, it can also obtain the fourth key corresponding to each of the n second nodes.

[0178] In this embodiment, not only are symmetric keys (i.e., the first key and the second key) generated in the signing process, but also symmetric keys (i.e., the second key and the fourth key) generated in the encryption and decryption process. Thus, the same second key is used when the target node encrypts the information transmitted to the first node and when the first node decrypts the information from the target node, which helps to improve the efficiency of the encryption and decryption process.

[0179] Optionally, the first node receiving the second value sent by the target node may include: the first node receiving the second value and a third signature sent by the target node, wherein the third signature of the target node is obtained by signing the fifth information using the target node's private key. The first node verifies the target node's third signature based on the target node's public key. Then, the first node obtains the second key corresponding to the target node based on the first key factor and the target node's second value, including: if the target node's third signature verification is successful, the first node obtains the second key corresponding to the target node based on the first key factor and the target node's second value.

[0180] Regarding the specific implementation of the verification operation performed by the first node, in one scenario, the first node can perform aggregate verification on the n third signatures that correspond one-to-one with the n second nodes. For example, the first node verifies the third signature of the target node based on the target node's public key, which may include: the first node aggregating the n third signatures that correspond one-to-one with the n second nodes to obtain a second aggregated signature; and verifying the second aggregated signature based on the public key of each of the n second nodes.

[0181] For example, if the second aggregated signature verification is successful, it means that all n third signatures (including the third signature of the target node) have been successfully verified; if the second aggregated signature verification fails, it means that all n third signatures (including the third signature of the target node) have failed to be verified.

[0182] For example, the specific implementation of "aggregating n third signatures to obtain a second aggregated signature" can be found in the above description of "aggregating n first signatures to obtain a first aggregated signature". The difference lies in that... Figure 1 In the corresponding embodiment, the "first signature" is replaced with the "third signature" in step 508. Figure 1 In the corresponding embodiment, the "first aggregated signature" is replaced with the "second aggregated signature" in step 508, which will not be repeated here.

[0183] For example, the specific implementation of "verifying the second aggregated signature based on the public key of each of the n second nodes" can be found in the above description of "verifying the first aggregated signature based on the public key of each of the n second nodes," the difference being that... Figure 1 In the corresponding embodiment, the "first aggregated signature" is replaced by the "second aggregated signature" in step 508, which will not be repeated here. Further, the first node can verify the second aggregated signature based on the public key and fifth information of each of the n second nodes. The specific implementation of the aforementioned steps can be found in the above... Figure 1 The difference is that, according to the description in the corresponding embodiment, Figure 1 In the corresponding embodiment, "first information" is replaced with "fifth information" in step 508. Figure 1 In the corresponding embodiment, the "first aggregated signature" is replaced with the "second aggregated signature" in step 508, which will not be repeated here.

[0184] In this embodiment, since the third signature of each of the n second nodes also needs to be verified during the process of generating the first key of each second node, the n third signatures can be aggregated to obtain a second aggregated signature, and then the second aggregated signature is verified. If the second aggregated signature is successfully verified, it means that all n third signatures have been successfully verified. If the second aggregated signature fails to be verified, it means that all n third signatures have failed to be verified. That is, batch verification of n third signatures is realized, which is beneficial to improving the efficiency of the process of generating the first key of each of the n second nodes.

[0185] In another scenario, the first node verifies the target node's third signature based on the target node's public key. This can include: the first node directly verifying the target node's third signature using the target node's public key. The first node can also use the aforementioned method to sequentially verify the n third signatures corresponding to each of the n second nodes. In other words, the first node can also choose not to use the above aggregation method, but instead use the public key of each second node to sequentially verify the third signature of each second node, verifying only one signature at a time.

[0186] In this embodiment, since the first node obtains the second key based on the first key factor and the second value of the target node, and the target node also sends a third signature when sending the second value to the first node, the third signature of the target node is obtained by signing using the target node's private key. Only when the third signature of the target node is successfully verified, that is, when it is guaranteed that the sender of the second value is a secure and reliable sender, can the first node obtain the second key based on the first key factor and the second value, which is beneficial to improving the security of the first key generation process. Correspondingly, the target node obtains the first key based on the second key factor and the first value. When the first node sends the first value to the target node, it also sends a second signature. Thus, the target node can obtain the first key based on the second key factor and the first value only when the second signature is successfully verified, that is, when it is guaranteed that the sender of the first value is a secure and reliable sender, which is beneficial to further improving the security of the first key generation process.

[0187] Optionally, the first node can receive not only the second value and the third signature sent by the target node, but also the fourth signature and the second information sent by the target node. The fourth signature of the target node is obtained by signing the second information using the first key of the target node. After the first node obtains the second key based on the second value of the first key factor, it can also verify the fourth signature of the target node based on the first key and the second information of the target node.

[0188] For example, the first node can use a signature algorithm to verify the fourth signature of the target node based on the target node's second key and second information, to determine whether the fourth signature of the target node has been successfully verified. If the fourth signature of the target node is successfully verified, the first node can determine that the key material of the first key obtained by the target node and the second key obtained by the first node are the same; if the fourth signature of the target node fails to be verified, the first node can determine that the target node and the first node have not obtained the same key.

[0189] Optionally, the first node can also use the second key corresponding to the target node to sign the second information of the target node, obtaining the first predicted signature of the target node, and determine whether the first predicted signature of the target node is consistent with the fourth signature of the target node. If the fourth signature of the target node is successfully verified, and the first predicted signature of the target node is consistent with the fourth signature of the target node, then the first node can determine that the key materials of the first key obtained by the target node and the second key obtained by the first node are the same; if the fourth signature of the target node fails to be verified, or the first predicted signature of the target node is inconsistent with the fourth signature of the target node, then the first node can determine that the target node and the first node did not obtain the same key.

[0190] The first node can receive not only the second value and third signature sent by the target node, but also encrypted information sent by the target node, which is encrypted using the target node's third key. After obtaining the target node's fourth key based on the first key factor and the target node's second value, the first node can also use the target node's fourth key to decrypt the target node's encrypted information. If the first node successfully decrypts the target node's encrypted information using the target node's fourth key, the first node can determine that the third key obtained by the target node and the fourth key obtained by the first node are the same key material; if the first node fails to decrypt the target node's encrypted information using the target node's fourth key, the first node can determine that the target node and the first node did not obtain the same key.

[0191] In this embodiment, after obtaining the third key, the target node will use the third key to encrypt the encrypted information and send it to the first node. The first node will then use the target node's fourth key to decrypt the encrypted information. If the first node successfully decrypts the encrypted information using the target node's fourth key, the first node can determine that the third key obtained by the target node and the fourth key obtained by the first node are the same key material, which helps to improve the stability of the subsequent use of the target node's fourth key.

[0192] To further understand this solution, the code used in step 510 is disclosed below:

[0193] MK_i = x Y_i;

[0194] K_Enc||K_MAC=HKDF(MK_i,Y_i||X||ID_S||ID_i);

[0195] Wherein, MK_i represents the first calculation result corresponding to the target node, MK_i = xY_i represents multiplying the first key factor with the second value of the target node to obtain the first calculation result corresponding to the target node, and HKDF(MK_i,Y_i||X||ID_S||ID_i) represents obtaining K_Enc and K_MAC based on MK_i, Y_i, X, ID_S and ID_i using the key derivation function HKDF, where K_Enc represents the second key of the target node and K_MAC represents the fourth key of the target node. It should be understood that the example here is only for the convenience of understanding this scheme.

[0196] In this embodiment, the target node generates a signature transmitted to the first node based on a first key, and the first node verifies the signature transmitted by the target node based on a second key. The first and second keys use the same key material, which greatly improves the efficiency of the first node in verifying the signature of the target node. Optionally, after completing the trusted verification of n second nodes, it can be determined whether the operating environment of the n second nodes is a trusted execution environment. Thus, the first key of the target node can be generated only after ensuring that the operating environments of the n second nodes are all trusted, thereby improving the security of the generation process of the first key of the target node.

[0197] Step 511: The first node signs the document based on the second key and the third information to obtain the fifth signature.

[0198] Step 512: The first node sends the fifth signature and the third information to the target node.

[0199] Step 513: The target node verifies the fifth signature based on the first key and the third information.

[0200] Steps 511 to 513 are optional. After determining that the key materials of the first key obtained by the target node and the second key obtained by the first node are the same, the first node can also use the second key of the target node to sign the third information to obtain the fifth signature; the first node sends the fifth signature and the third information to the target node, and the target node receives the fifth signature and the third information sent by the first node; the target node can verify the fifth signature based on the first key and the third information of the target node to determine whether the fifth signature is successfully verified. If the fifth signature is successfully verified, the target node can determine that the key materials of the first key obtained by the target node and the second key obtained by the first node are the same; if the fifth signature verification fails, the target node can determine that the target node and the first node did not obtain the same key.

[0201] Optionally, the target node can also use its first key to sign the third information, obtaining a second predicted signature, and then determine whether the second predicted signature matches the fifth signature. If the fifth signature is successfully verified and the second predicted signature matches the fifth signature, the target node can determine that the first key obtained by the target node and the second key obtained by the first node have the same key material; if the fifth signature verification fails, or the second predicted signature does not match the fifth signature, the target node can determine that the target node and the first node did not obtain the same key.

[0202] For example, the third information is publicly available information. Optionally, the third information may include the aforementioned encrypted information, so that the target node can determine that the key materials of the first key obtained by the target node and the second key obtained by the first node are the same, and can also determine that the target node and the first node have obtained the same second key. Optionally, the third information may also include other information, such as the identity information of the first node, the first value, the identity information of the target node, or the second value of the target node; for example, the third information may also include the second signature of the first node, the third signature of the target node, the fourth signature of the target node, or other information, which can be determined according to the actual application scenario.

[0203] To further understand this solution, the code used in step 511 is disclosed below:

[0204] V=Hash(ID_S||X||S_X||ID_i||Y_i||S_i||C||MAC1);

[0205] MAC2 = HMAC(K_MAC,V);

[0206] Where ID_S||X||S_X||ID_i||Y_i||S_i||C||MAC1 represents the third information, which is hashed to obtain V. MAC2 represents the fifth signature. HMAC(K_MAC,V) means that the first node uses the second key (K_MAC) of the target node to sign V using the signature algorithm HMAC to obtain MAC2. It should be understood that this example is only for the convenience of understanding this scheme.

[0207] In this embodiment, after the target node obtains the first key and the first node obtains the second key, they will both use the obtained keys to sign and send the signature to the other party, allowing the other party to verify the signature using the obtained key. This ensures that the key materials of the first key obtained by the target node and the second key obtained by the first node are the same, which helps to improve the smoothness and stability of the subsequent process of signing and verifying the signature using symmetric keys.

[0208] exist Figures 1 to 6 Based on the corresponding embodiments, in order to better implement the above-described solutions of this application, related equipment for implementing the above solutions is also provided below. See details. Figure 7 , Figure 7 This is a schematic diagram of a signature verification device provided in an embodiment of this application. The signature verification device 700 is included in a first node. The signature verification device 700 includes: an acquisition module 701, used to acquire a first aggregated signature, which is obtained by aggregating n first signatures, the n first signatures including the first signature of each of the n second nodes, the first signature of each second node being obtained by signing using the private key of each second node, where n is an integer greater than 1; and a verification module 702, used to verify the first aggregated signature based on the public key of each of the n second nodes.

[0209] Optionally, the first signature of each second node is obtained by signing the measurement content of each second node using the private key of each second node. The measurement content includes the data required for trusted verification of the second node. The verification module 702 is further configured to determine that the n second nodes have been successfully verified if the signature after the first aggregation is successfully verified and the measurement content of the n second nodes is successfully verified.

[0210] Optionally, the acquisition module 701 is specifically used to acquire the first aggregated signature from the aggregation node, wherein the first aggregated signature is obtained by the aggregation node aggregating n first signatures, the aggregation node and n second nodes belong to the same node cluster, and the n first signatures are obtained by the aggregation node from the n second nodes through the communication network within the cluster.

[0211] Optionally, the type of the measurement event corresponding to the measurement content includes at least one of the following: measurement of the basic input / output system BIOS, measurement of the bootloader, measurement of the operating system OS, or measurement of the application.

[0212] Optionally, the signature verification device 700 further includes: a generation module 703, used to generate a first key factor and obtain a first value based on the first key factor and a first base point; a sending module 704, used to send the first value to a target node, the target node being any one of n second nodes, the first value and the second key factor generated by the target node being used for the target node to obtain a first key, the first key being used for the target node to sign and obtain a signature transmitted to the first node; a receiving module 705, used to receive a second value sent by the target node, the second value being obtained based on the second key factor and the second base point; and a processing module 706, used to obtain a second key based on the first key factor and the second value, wherein the second key is used for the first node to verify the signature from the target node, and the key materials of the first key and the second key are the same.

[0213] Optionally, the signature verification device 700 further includes: a signature module 707, used to sign using the private key of the first node to obtain a second signature; a sending module 704, specifically used to send the second signature and a first value to the target node, wherein the verification of the second signature is performed by the target node based on the public key of the first node; a receiving module 705, specifically used to receive the second value and a third signature sent by the target node, wherein the third signature is obtained by signing using the private key of the target node; a verification module 702, further used to verify the third signature based on the public key of the target node; and a processing module 706, specifically used to obtain a second key by the first node based on a first key factor and a second value if the third signature verification is successful.

[0214] Optionally, the first value and the second key factor are also used to provide the target node with a third key. The processing module 706 is specifically used to obtain a second key and a fourth key based on the first key factor and the second value. The third key is the key used by the target node to encrypt information transmitted to the first node, and the fourth key is the key used by the first node to decrypt information from the target node. The key materials of the third key and the fourth key are the same.

[0215] Optionally, the first aggregated signature is obtained by aggregating n first signatures using a preset algorithm.

[0216] It should be noted that the information interaction and execution process between the modules / units in the signature verification device 700 are different from those in this application. Figures 1 to 6The various method embodiments are based on the same concept, and the details can be found in the descriptions of the method embodiments shown above in this application, which will not be repeated here.

[0217] This application also provides a signature verification device, please refer to [link to relevant documentation]. Figure 8 , Figure 8 This is another schematic diagram of the signature verification device provided in the embodiments of this application. The signature verification device 800 is included in the aggregation node. The signature verification device 800 includes: an acquisition module 801, used to acquire n first signatures corresponding one-to-one with n second nodes. The aggregation node and the n second nodes belong to the same node cluster. The n first signatures are obtained by the aggregation node from the n second nodes through the communication network within the cluster. The first signature of each second node is obtained by signing using the private key of each second node. n is an integer greater than 1; an aggregation module 802, used to aggregate the n first signatures to obtain a first aggregated signature; and a sending module 803, used to send the first aggregated signature to the first node. The first aggregated signature is used by the first node to verify the first aggregated signature based on the public key of each of the n second nodes.

[0218] It should be noted that the information interaction and execution process between the modules / units in the signature verification device 800 are different from those in this application. Figures 1 to 6 The various method embodiments are based on the same concept, and the details can be found in the descriptions of the method embodiments shown above in this application, which will not be repeated here.

[0219] This application embodiment also provides a key acquisition device, which is included in a first node. The key acquisition device includes: a generation module, used to generate a first key factor and obtain a first value based on the first key factor and a first base point; a sending module, used to send the first value to a target node, wherein the first value and a second key factor generated by the target node are used for the target node to obtain a first key, and the first key is used for the target node to sign to obtain a signature transmitted to the first node; a receiving module, used to receive a second value sent by the target node, wherein the second value is obtained based on a second key factor and a second base point; and a processing module, used to obtain a second key based on the first key factor and the second value, wherein the second key is used for the first node to verify the signature from the target node, and the key materials of the first key and the second key are the same.

[0220] It should be noted that the information interaction and execution process between the modules / units in the aforementioned key acquisition device are different from those in this application. Figures 1 to 6 The various method embodiments are based on the same concept, and the details can be found in the descriptions of the method embodiments shown above in this application, which will not be repeated here.

[0221] This application embodiment also provides a key acquisition device, which is included in a target node. The key acquisition device includes: a receiving module, used to receive a first value sent by a first node, the first value being obtained based on a first key factor and a first base point generated by the first node; a generating module, used to generate a second key factor, and obtain a second value based on the second key factor and the second base point; a sending module, used to send the second value to the first node, the second value and the first key factor being used for the first node to obtain a second key, the second key being used for the first node to verify a signature from the target node; and a processing module, used to obtain a first key based on the second key factor and the first value, wherein the first key is used for the target node to sign to obtain a signature transmitted to the first node, and the key materials of the first key and the second key are the same.

[0222] It should be noted that the information interaction and execution process between the modules / units in the aforementioned key acquisition device are different from those in this application. Figures 1 to 6 The various method embodiments are based on the same concept, and the details can be found in the descriptions of the method embodiments shown above in this application, which will not be repeated here.

[0223] The following describes a device provided in an embodiment of this application. Please refer to [link / reference]. Figure 9 , Figure 9 This is a schematic diagram of the structure of a device provided in an embodiment of this application. Optionally, device 900 performs... Figures 1 to 6 The functions of the first node, aggregation node, target node, or second node in the corresponding method embodiments.

[0224] Device 900 includes a memory 902 and at least one processor 901. Optionally, processor 901 implements the methods in the above embodiments by reading program instructions stored in memory 902; alternatively, processor 901 may also implement the methods in the above embodiments by reading program instructions stored internally. Optionally, at least one processor 901 is one or more CPUs, or a single-core CPU, or a multi-core CPU. For example, memory 902 includes, but is not limited to, random access memory (RAM), read-only memory (ROM), flash memory, or optical memory. Memory 902 stores program instructions of the operating system.

[0225] Optionally, the device 900 further includes at least one accelerator 903. Exemplarily, at least one accelerator 903 may include at least one of the following: a hardware accelerator such as an embedded neural network processing unit (NPU), a graphics processing unit (GPU), a tensor processing unit (TPU), an application-specific integrated circuit (ASIC), or a field-programmable gate array (FPGA).

[0226] When the processor 901 reads the program instructions stored in the memory 902 to implement the method in the above embodiments, the memory 902 stores program instructions that implement the method provided in the above embodiments of this application. After the program instructions stored in the memory 902 are read by the at least one processor 901, the device 900 executes the corresponding operations in the foregoing embodiments.

[0227] Optionally, device 900 also includes a network interface 904, which can be a wired interface or a wireless interface, and is used for... Figures 1 to 6 The corresponding method implementations execute the sending and receiving of data.

[0228] It should be understood that network interface 904 has the functions of receiving and sending data. The functions of "receiving data" and "sending data" can be integrated into the same transceiver interface, or the functions of "receiving data" and "sending data" can be implemented in different interfaces, which is not limited here. In other words, network interface 904 may include one or more interfaces for implementing the functions of "receiving data" and "sending data".

[0229] After the processor 901 reads the program instructions from the memory 902, other functions that the device 900 can perform are described in the preceding method embodiments.

[0230] Optionally, the device 900 also includes a bus 905, through which the processor 901 and memory 902 are typically interconnected, or in other ways.

[0231] The device 900 provided in this application embodiment is used to execute the methods executed by the first node, aggregation node, target node or second node in the above-described method embodiments, and to achieve the corresponding beneficial effects. Figure 9The specific implementation of the device 900 shown can be referred to the descriptions in the aforementioned method embodiments, and will not be repeated here.

[0232] This application also provides a computer-readable storage medium storing a program that, when run on a computer, causes the computer to perform the aforementioned actions. Figures 1 to 6 The steps performed by the first node, aggregation node, target node, or second node in the method described in the illustrated embodiment.

[0233] This application also provides a computer program product, which includes a program that, when run on a computer, causes the computer to perform the aforementioned actions. Figures 1 to 6 The steps performed by the first node, aggregation node, target node, or second node in the method described in the illustrated embodiment.

[0234] This application embodiment also provides a circuit system, the circuit system including a processing circuit, the processing circuit being configured to perform the aforementioned... Figures 1 to 6 The steps performed by the first node, aggregation node, target node, or second node in the method described in the illustrated embodiment.

[0235] The first node, aggregation node, target node, second node, signature verification device, or key acquisition device provided in this application embodiment can specifically be a chip. The chip includes a processing unit, which may be, for example, a processor. Optionally, the chip also includes a communication unit, which may be, for example, an input / output interface, pins, or circuitry. This processing unit can execute computer execution instructions stored in the storage unit to cause the chip to perform the aforementioned actions. Figures 1 to 6The method described in the illustrated embodiment. Optionally, the storage unit is a storage unit within the chip, such as a register, cache, etc. The storage unit can also be a storage unit located outside the chip within the wireless access device, such as read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions, random access memory (RAM), etc. This storage unit can be non-transitory memory, which can be volatile memory or non-volatile memory, or may include both. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM). The storage unit can also be a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices. It should be noted that the storage units of the systems and methods described herein are intended to include, but are not limited to, these and any other suitable types of memory.

[0236] The processor mentioned above can be a general-purpose central processing unit, microprocessor, GPU, NPU, TPU, ASIC, FPGA, or one or more integrated circuits used to control the execution of programs corresponding to the methods described above.

[0237] It should also be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. In addition, in the device embodiment drawings provided in this application, the connection relationship between modules indicates that they have a communication connection, which can be implemented as one or more communication buses or signal lines.

[0238] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware, or it can be implemented by special-purpose hardware including application-specific integrated circuits, special-purpose CLUs, special-purpose memory, special-purpose components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for this application, software program implementation is more often the preferred implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk, or optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0239] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0240] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

Claims

1. A signature verification method, characterized in that, The method is applied to the first node, and the method includes: Obtain the first aggregated signature, which is obtained by aggregating n first signatures. The n first signatures include the first signature of each of the n second nodes. The first signature of each second node is obtained by signing using the private key of each second node. n is an integer greater than 1. The first aggregated signature is verified based on the public key of each of the n second nodes.

2. The method according to claim 1, characterized in that, The first signature of each second node is obtained by signing the measurement content of each second node using the private key of each second node. The measurement content includes the data required for trusted verification of the second node. The method further includes: If the signature verification after the first aggregation is successful and the metric content verification of the n second nodes is successful, then the verification of the n second nodes is determined to be successful.

3. The method according to claim 1 or 2, characterized in that, Obtaining the first aggregated signature includes: Obtain the first aggregated signature from the aggregation node, wherein the first aggregated signature is obtained by the aggregation node aggregating the n first signatures, the aggregation node and the n second nodes belong to the same node cluster, and the n first signatures are obtained by the aggregation node from the n second nodes through the communication network within the cluster.

4. The method according to any one of claims 1-3, characterized in that, The types of measurement events corresponding to the measurement content include at least one of the following: measurement of the Basic Input / Output System (BIOS), measurement of the Bootloader, measurement of the Operating System (OS), or measurement of an application.

5. The method according to any one of claims 2-4, characterized in that, The method further includes: Generate a first key factor, and obtain a first value based on the first key factor and the first base point; The first value is sent to the target node, which is any one of the n second nodes. The first value and the second key factor generated by the target node are used to enable the target node to obtain the first key. The first key is used to enable the target node to sign and obtain the signature transmitted to the first node. Receive a second value sent by the target node, the second value being obtained based on the second key factor and the second base point; Based on the first key factor and the second value, a second key is obtained, wherein the second key is used by the first node to verify the signature from the target node, and the key material of the first key and the second key is the same.

6. The method according to claim 5, characterized in that, The method further includes: The second signature is obtained by signing using the private key of the first node; Sending the first value to the target node includes: sending the second signature and the first value to the target node, wherein the verification of the second signature is performed by the target node based on the public key of the first node; Receiving the second value sent by the target node includes receiving the second value and a third signature sent by the target node, wherein the third signature is obtained by signing using the private key of the target node; The method further includes: verifying the third signature based on the public key of the target node; The step of obtaining the second key based on the first key factor and the second value includes: if the third signature verification is successful, obtaining the second key based on the first key factor and the second value.

7. The method according to claim 5, characterized in that, The first value and the second key factor are also used to provide the target node with a third key. The process of obtaining the second key based on the first key factor and the second value includes: Based on the first key factor and the second value, a second key and a fourth key are obtained, wherein the third key is the key used by the target node to encrypt information transmitted to the first node, and the fourth key is the key used by the first node to decrypt information from the target node, and the key materials of the third key and the fourth key are the same.

8. The method according to any one of claims 1-7, characterized in that, The first aggregated signature is obtained by aggregating the n first signatures using a preset algorithm.

9. A signature verification method, characterized in that, The method is applied to an aggregation node, and the method includes: Obtain n first signatures corresponding one-to-one with n second nodes. The aggregation node and the n second nodes belong to the same node cluster. The n first signatures are obtained by the aggregation node from the n second nodes through the communication network within the cluster. The first signature of each second node is obtained by signing using the private key of each second node. n is an integer greater than 1. The n first signatures are aggregated to obtain the first aggregated signature; The first aggregated signature is sent to the first node, and the first aggregated signature is used by the first node to verify the first aggregated signature based on the public key of each of the n second nodes.

10. A method for obtaining a key, characterized in that, The method is applied to the first node, and the method includes: Generate a first key factor, and obtain a first value based on the first key factor and the first base point; The first value is sent to the target node. The first value and the second key factor generated by the target node are used to enable the target node to obtain the first key. The first key is used by the target node to sign and obtain the signature transmitted to the first node. Receive a second value sent by the target node, the second value being obtained based on the second key factor and the second base point; Based on the first key factor and the second value, a second key is obtained, wherein the second key is used by the first node to verify the signature from the target node, and the key material of the first key and the second key is the same.

11. A method for obtaining a key, characterized in that, The method is applied to the target node, and the method includes: Receive a first value sent by the first node, the first value being obtained based on a first key factor and a first base point generated by the first node; Generate a second key factor, and obtain a second value based on the second key factor and the second base point; The second value is sent to the first node, and the second value and the first key factor are used to enable the first node to obtain the second key. The second key is used by the first node to verify the signature from the target node. Based on the second key factor and the first value, a first key is obtained, wherein the first key is used by the target node to sign the signature transmitted to the first node, and the key material of the first key and the second key is the same.

12. A signature verification device, characterized in that, The device is included in the first node, and the device includes: The acquisition module is used to acquire the first aggregated signature, which is obtained by aggregating n first signatures. The n first signatures include the first signature of each of the n second nodes. The first signature of each second node is obtained by signing using the private key of each second node, where n is an integer greater than 1. The verification module is used to verify the first aggregated signature based on the public key of each of the n second nodes.

13. The apparatus according to claim 12, characterized in that, The first signature of each second node is obtained by signing the measurement content of each second node using the private key of each second node. The measurement content includes the data required for trusted verification of the second node. The verification module is further configured to determine that the n second nodes have been successfully verified if the signature after the first aggregation is successfully verified and the measurement content of the n second nodes is successfully verified.

14. The apparatus according to claim 12 or 13, characterized in that, The acquisition module is specifically used to acquire the first aggregated signature from the aggregation node, wherein the first aggregated signature is obtained by the aggregation node aggregating the n first signatures, the aggregation node and the n second nodes belong to the same node cluster, and the n first signatures are obtained by the aggregation node from the n second nodes through the communication network within the cluster.

15. The apparatus according to any one of claims 12-14, characterized in that, The types of measurement events corresponding to the measurement content include at least one of the following: measurement of the Basic Input / Output System (BIOS), measurement of the Bootloader, measurement of the Operating System (OS), or measurement of an application.

16. The apparatus according to any one of claims 13-15, characterized in that, The device further includes: A generation module is used to generate a first key factor and obtain a first value based on the first key factor and a first base point; The sending module is used to send the first value to the target node, which is any one of the n second nodes. The first value and the second key factor generated by the target node are used to enable the target node to obtain the first key. The first key is used to enable the target node to sign and obtain the signature transmitted to the first node. The receiving module is configured to receive a second value sent by the target node, the second value being obtained based on the second key factor and the second base point; The processing module is used to obtain a second key based on the first key factor and the second value, wherein the second key is used by the first node to verify the signature from the target node, and the key material of the first key and the second key is the same.

17. The apparatus according to claim 16, characterized in that, The device further includes: a signature module, used to obtain a second signature by signing using the private key of the first node; The sending module is specifically used to send the second signature and the first value to the target node, wherein the verification of the second signature is performed by the target node based on the public key of the first node; The receiving module is specifically used to receive the second value and the third signature sent by the target node, wherein the third signature is obtained by signing using the private key of the target node; The verification module is also used to verify the third signature based on the public key of the target node; The processing module is specifically used to, in the case that the third signature verification is successful, have the first node obtain the second key based on the first key factor and the second value.

18. The apparatus according to claim 16, characterized in that, The first value and the second key factor are also used to provide the target node with a third key. The processing module is specifically used to obtain the second key and the fourth key based on the first key factor and the second value. The third key is the key used by the target node to encrypt information transmitted to the first node, and the fourth key is the key used by the first node to decrypt information from the target node. The key materials of the third key and the fourth key are the same.

19. The apparatus according to any one of claims 12-18, characterized in that, The first aggregated signature is obtained by aggregating the n first signatures using a preset algorithm.

20. A signature verification device, characterized in that, The device is included in the aggregation node, and the device includes: The acquisition module is used to acquire n first signatures that correspond one-to-one with n second nodes. The aggregation node and the n second nodes belong to the same node cluster. The n first signatures are obtained by the aggregation node from the n second nodes through the communication network within the cluster. The first signature of each second node is obtained by signing using the private key of each second node. n is an integer greater than 1. The aggregation module is used to aggregate the n first signatures to obtain a first aggregated signature; The sending module is used to send the first aggregated signature to the first node, and the first aggregated signature is used by the first node to verify the first aggregated signature based on the public key of each of the n second nodes.

21. A key acquisition device, characterized in that, The device is included in the first node, and the device includes: A generation module is used to generate a first key factor and obtain a first value based on the first key factor and a first base point; The sending module is used to send the first value to the target node. The first value and the second key factor generated by the target node are used to enable the target node to obtain the first key. The first key is used to enable the target node to sign and obtain the signature transmitted to the first node. The receiving module is configured to receive a second value sent by the target node, the second value being obtained based on the second key factor and the second base point; The processing module is used to obtain a second key based on the first key factor and the second value, wherein the second key is used by the first node to verify the signature from the target node, and the key material of the first key and the second key is the same.

22. A key acquisition device, characterized in that, The device is included in the target node, and the device includes: A receiving module is used to receive a first value sent by a first node, the first value being obtained based on a first key factor and a first base point generated by the first node; A generation module is used to generate a second key factor and obtain a second value based on the second key factor and a second base point. The sending module is used to send the second value to the first node, the second value and the first key factor are used to enable the first node to obtain the second key, and the second key is used to enable the first node to verify the signature from the target node. The processing module is used to obtain a first key based on the second key factor and the first value, wherein the first key is used by the target node to sign the signature transmitted to the first node, and the key material of the first key and the second key is the same.

23. A device, characterized in that, The method includes a processor coupled to a memory storing program instructions, which, when executed by the processor, implement the method of any one of claims 1 to 11.

24. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program that, when run on a computer, causes the computer to perform the method as described in any one of claims 1 to 11.

25. A computer program product, characterized in that, The computer program product includes a program that, when run on a computer, causes the computer to perform the method as described in any one of claims 1 to 11.

26. A chip system, characterized in that, The chip system includes a processor and a communication interface, the communication interface being used to communicate with modules outside the chip system, and the processor being used to execute the method as described in any one of claims 1 to 11.

Images