Information search method, system and device based on multiple chameleon hash function

Abstract

The application discloses a method, system and device for information searching based on a multiple chameleon hash function, and belongs to the technical field of blockchains. The technical problem to be solved is how to make a trapdoor be independently held by multiple participants and improve the security and credibility of the chameleon hash algorithm. The method comprises the following steps: multiple participants as trapdoor co-owners hold system parameters; each participant generates a key pair share and broadcasts a public key share in the key pair share; an aggregated public key is calculated based on the public key shares of all participants; chameleon hash calculation is performed to obtain a chameleon hash value as a target hash value; the multiple participants cooperate to perform collision searching through multiple rounds of concurrent communication to obtain a new message and a pair of new chameleon random numbers corresponding to the new message, and the chameleon hash value of the new message is the same as the target hash value.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of blockchain, in particular to an information searching method, system and device based on multiple chameleon hash functions. BACKGROUND

[0002] A chameleon hash function, also known as a trapdoor hash function, was first proposed by Krawczyk and Rabin. The meaning of "chameleon" is that the owner of the trapdoor information can change the input of the function at will without changing the output of the function. In a chameleon hash function, a person who possesses the trapdoor information can easily calculate a collision of a random input, and a person who does not possess the trapdoor information cannot calculate the collision.

[0003] In a chameleon hash function, we assume that the signer is S, and the receiver of the signature is R. The receiver R generates the public key and the private key required by the system according to a specific key generation algorithm, wherein the public key is denoted as HK, the private key is denoted as PK, and the chameleon hash function is denoted as CHAM-HASH(·,·). The chameleon hash function can be quickly calculated by the public key HK, such as inputting a message m and a random value r, and the chameleon hash value h of the chameleon hash function can be denoted as h = CHAM-HASH(m, r).

[0004] A chameleon hash function is a non-standard collision-resistant hash function, which contains a pair of public key and private key, denoted as hashkey HK and trapdoorkey TK (trapdoor information). Compared with traditional hash functions, the chameleon hash function has the following characteristics:

[0005] (1) If a person knows it, he can calculate the chameleon hash function associated with the hashkey;

[0006] (2) For a person who does not know the trapdoor information, the chameleon hash function is usually collision-resistant;

[0007] (3) A person who possesses the trapdoor information can easily calculate a collision different from the original message for any given input.

[0008] Generally, a chameleon hash scheme consists of the following four algorithms:

[0009] (1) System parameter generation algorithm, input a secure parameter k, output system parameter SP;

[0010] (2) Key generation algorithm, which is responsible for generating the public key and the private key required by the chameleon hash function, the method is as follows, input system parameter SP, output a public key / private key pair (SK, PK) for each user;

[0011] (3) Hash value generation, if the public key PK of the input user, an arbitrary message m and a random value r, wherein r belongs to Zq*, the output is a hash value h, wherein h = Hash (m, r);

[0012] (4) An effective collision calculation algorithm, input the private key SK of the user, a message m and a random value r, and another message m', output an integer r', wherein r' belongs to Zq*, Hash (m', r') = Hash (m, r) is calculated, through this algorithm, we can quickly find a collision m' different from the signed message m.

[0013] The message hash calculation can be carried out through the chameleon hash function algorithm, but the existing chameleon hash algorithm does not have the linear (homomorphic) property, cannot be applied to distributed protocols, and how to make the trapdoor be independently mastered by multiple participants and improve the security and credibility of the chameleon hash algorithm is a technical problem to be solved. SUMMARY

[0014] The technical task of the present application is to solve the technical problem of how to make the trapdoor be independently mastered by multiple participants and improve the security and credibility of the chameleon hash algorithm by providing an information search method, system and device based on multiple chameleon hash functions.

[0015] In a first aspect, the information search method based on multiple chameleon hash functions comprises the following steps:

[0016] System parameters are set, and the multiple participants as trapdoor co-holders all master the system parameters, the system parameters include p, q, H and g, p is a secure prime number with bit length k, q is a prime number, p = 2q + 1, g is a q-order element, and H is an anti-collision hash function;

[0017] Each participant generates its key pair share based on the system parameters through the key generation method in the chameleon hash function, and broadcasts the public key share in the key pair share;

[0018] The aggregated public key is calculated based on the public key shares of all participants;

[0019] Chameleon hash calculation is carried out based on the aggregated public key, the message and the pair of chameleon random numbers corresponding to the message, and the obtained chameleon hash value is taken as the target hash value;

[0020] The multiple participants cooperate to find collisions through multiple rounds of concurrent communication, obtain a new message and a pair of new chameleon random numbers corresponding to the new message, and the chameleon hash value of the new message is the same as the target hash value.

[0021] Preferably, the multiple participants collaborate and perform collision detection through multiple rounds of concurrent communication, including the following steps:

[0022] Each participant selects a random number, and a first collision search is performed based on the random number. For participant P... i The formula for calculating the first collision search is:

[0023]

[0024] e i =H(m′,r i ′)

[0025] m′ represents the new message found through the collision search, and r′ represents a new chameleon random number corresponding to the new message. i Represents participant P in r′ i The proportion of the new chameleon random number;

[0026] k′ i Indicates participant P i A random number, k′ is selected. i ∈[1,q-1];

[0027] e i As a verification value, each participant broadcasts its verification value and, after receiving verification values ​​from all other participants, broadcasts its random number.

[0028] After each participant receives random numbers from all other participants, it verifies the first collision search of all other participants. For participant P... i The verification calculation formula is as follows:

[0029]

[0030] e j =H(m′,r j ′)

[0031] Where 1≤j≤n, and j≠i; n represents a total of n participants;

[0032] After successful verification, each participant performs a second collision search based on random numbers from all participants. For participant P... i The formula for calculating the second collision search is:

[0033]

[0034] e′=H(m′,r′)

[0035] s i '=ki ' e'a i x i mod q

[0036] wherein a i represents a public key aggregation coefficient of a participant P i , x i represents a private key share of the participant P i , s' represents another new chameleon random number corresponding to new information, and s' represents a share of the participant P i in the another new chameleon random number; i

[0037] After each participant broadcasts its share in the another new chameleon random number to other participants, the another new chameleon random number is calculated based on the shares of all participants in the another new chameleon random number, and a calculation formula of the another new chameleon random number is as follows:

[0038]

[0039] As a preference, for the participant P i , a random number x i is selected in [1, q-1] as its private key share, and a public key share y i is generated,

[0040] and a calculation formula of the aggregation public key is as follows:

[0041]

[0042] wherein a i = H agg ( <l>y i ), denotes a public key aggregation coefficient of a participant P i i <l>{y1,……,y n}, represents an ordered public key set of all participants, and n represents the number of all participants.

[0043] As preferred, a chameleon hash calculation is performed based on the aggregated public key, the message, and a pair of chameleon random numbers corresponding to the message, and a corresponding calculation formula of the chameleon hash calculation is:

[0044] e=H(m,r)

[0045] C=Hash(m,r,s)=r(y e g s mod p)mod q

[0046] wherein C represents a target chameleon hash value, and (r,s)∈Z p ×Z q represents a pair of chameleon random numbers corresponding to the message m.

[0047] More preferably, the method further comprises the following steps:

[0048] A chameleon hash calculation is performed again based on the aggregated public key, the message, and a pair of chameleon random numbers corresponding to the message, and a chameleon hash value obtained by the chameleon hash calculation is used as a comparison hash value, and a corresponding calculation formula of the chameleon hash calculation is:

[0049] e=H(m,r)

[0050] C′=Hash(m,r,s)=r(y e g s mod p)mod q

[0051] The target hash value is compared with the comparison hash value, and if the equation C=C′ is established, the hash value verification passes.

[0052] More preferably, the method further comprises the following steps:

[0053] Based on a correctness verification equation, it is verified that a plurality of participants as trapdoor co-holders can find a pair of new random numbers and a new message corresponding to the pair of new random numbers, and the hash value of the new message has the same hash value as the input message m; and the correctness verification equation is represented as:

[0054] C=r′(y e′ g s′ mod p)mod q.

[0055] As preferred, the correctness verification equation verification step comprises:

[0056] ​Substituting into the correctness verification equation, we obtain the first equation, which is expressed as:

[0057]

[0058] Will Substituting into the first equation, we obtain the second equation, which is expressed as:

[0059]

[0060] (y) e′ g s′ mod p)mod q is split into the input combinations of each participant, and Substituting the values, we obtain the third equation, which is expressed as:

[0061]

[0062] Will Substituting into the third equation, we obtain the fourth equation, which is expressed as:

[0063]

[0064] Will Substituting into the fourth equation, we obtain the fifth equation, which is expressed as:

[0065]

[0066] Given g a+b =g a ·g b The equivalent of the fifth equation is obtained, which is expressed as:

[0067]

[0068] By combining the commutative and associative laws, the equivalent of the fifth equation can be expressed as the sixth equation, which is:

[0069]

[0070] s i ′=k i ′-e′a i x i Substituting mod q into the sixth equation, we obtain the seventh equation, which is expressed as:

[0071]

[0072] Substituting the seventh equation expression into the second equation, the following is obtained:

[0073]

[0074] In a second aspect, the information searching system based on the multi-chameleon hash function of the present application searches for a new message and a new pair of random numbers through the information searching method based on the multi-chameleon hash function of any one of the first aspect, the chameleon hash value of the new message being the same as the chameleon hash value of the input message, and the system comprising:

[0075] A security setting module is configured to set system parameters, and the system parameters are known to all the participants as trapdoor co-owners, and the system parameters include p, q, H, and g, p is a secure prime number with a bit length of k, q is a prime number, p = 2q + 1, g is a q-order element, and H is an anti-collision hash function;

[0076] A key generation module is configured to generate an aggregated public key through the following steps: each participant generates a key pair share based on the system parameters and through a key generation method in the chameleon hash function, and broadcasts the public key share in the key pair share; and the aggregated public key is calculated based on the public key shares of all the participants;

[0077] A hash calculation module is configured to perform chameleon hash calculation based on the aggregated public key, a message, and a pair of chameleon random numbers corresponding to the message, and the obtained chameleon hash value is used as a target hash value;

[0078] A hash verification module is configured to perform chameleon hash calculation again based on the aggregated public key, a message, and a pair of chameleon random numbers corresponding to the message, and the obtained chameleon hash value is used as a comparison hash value, and the calculation formula corresponding to the chameleon hash calculation is as follows:

[0079] e = H(m, r)

[0080] C' = Hash(m, r, s) = r(y e g s mod p) mod q

[0081] The target hash value is compared with the comparison hash value, and if the equation C = C' is established, the hash value verification passes;

[0082] A collision searching module is configured to search for a new message and a pair of new chameleon random numbers corresponding to the new message through multi-round concurrent communication, and the chameleon hash value of the new message is the same as the target hash value;

[0083] A correctness verification module verifies that a plurality of participants who are trapdoor co-holders can find a pair of new random numbers and can find a new message corresponding to a hash value identical to that of the input message m through cooperation, based on a correctness verification equation, and the correctness verification equation is expressed as:

[0084] C = r'(y e′ g s′ mod p) mod q;

[0085] In the collision finding module, the plurality of participants find collisions through a plurality of rounds of concurrent communication, including the following steps:

[0086] Each participant selects a random number, and performs a first collision finding based on the random number, and for participant P i i, the first collision finding calculation formula is:

[0087]

[0088] e i ’ = H(m', r' i )

[0089] m' represents a new message of the collision finding, r' represents a new chameleon random number corresponding to the new message, and r' i i i represents a share of the participant P i i in the new chameleon random number;

[0090] k' i i represents a random number selected by the participant P i i, and k' i ∈ [1, q-1];

[0091] The e i ’ is taken as a verification value, each participant broadcasts its verification value, and after receiving the verification values of all other participants, broadcasts its random number;

[0092] After each participant receives the random numbers of all other participants, the first collision finding of all other participants is verified, and for participant P i i, the verification calculation formula is:

[0093]

[0094] e j ’ = H(m', r j ′)

[0095] Wherein, 1≤j≤n, and j≠i; n represents a total of n participants;

[0096] After successful verification, each participant performs a second collision search based on random numbers from all participants. For participant P... i The formula for calculating the second collision search is:

[0097]

[0098] e′=H(m′,r′)

[0099] s i '=k i '-e′a i x i mod q

[0100] Among them, a i Indicates participant P i The public key aggregation coefficient, x i Indicates participant P i The private key share, s′ represents another new chameleon random number corresponding to the new information, s′ i P represents the participant in s′. i The share of the other new color-changing random number;

[0101] After each participant broadcasts its share of the other new color-changing random number to the other participants, the other new color-changing random number is calculated based on the shares of all participants in the other new color-changing random number. The formula for calculating the other new color-changing random number is as follows:

[0102]

[0103] Thirdly, the apparatus of the present invention includes: at least one memory and at least one processor;

[0104] The at least one memory is used to store a machine-readable program;

[0105] The at least one processor is configured to invoke the machine-readable program to execute any of the methods described in the first aspect.

[0106] Fourthly, the medium of the present invention is a computer-readable medium storing computer instructions that, when executed by a processor, cause the processor to perform any of the methods described in the first aspect.

[0107] The information retrieval method, system, and apparatus based on the multiple chameleon hash function of the present invention have the following advantages:

[0108] 1. The chameleon hash function algorithm is changed into a distributed protocol, the hash public key is aggregated by the public keys of multiple participants, the private key share is independently generated by each participant, no secret distributor is needed, a trusted distributor role and private key share distribution process are needed, it is completely decentralized, the security hidden danger is eliminated, the attack resistance is improved, the trapdoor is prevented from being controlled and maliciously used by one party;

[0109] 2. The hash collision is calculated by only three rounds of concurrent communication, so that the hash calculation algorithm is simple, easy to master and fast;

[0110] 3. When the method performs hash calculation and collision search, the Ateniese key-exposure-free chameleon hash function algorithm variant with linear (homomorphic) characteristics is used, which has higher security. BRIEF DESCRIPTION OF DRAWINGS

[0111] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0112] The present application will be further described below in combination with the drawings.

[0113] Figure 1 The flowchart of the information search method based on the multiple chameleon hash functions of embodiment 1 is shown.

[0114] Figure 2 The flowchart of the improved information search method based on the multiple chameleon hash functions of embodiment 1 is shown. DETAILED DESCRIPTION

[0115] The present application will be further described below in combination with the drawings and specific embodiments, so that those skilled in the art can better understand the present application and implement it. However, the embodiments are not limiting to the present application, and the technical features in the embodiments and the embodiments can be combined with each other without conflict.

[0116] It should be understood that in the description of the embodiments of the present application, the words "first", "second", etc. are only used for the purpose of distinguishing the description, and cannot be understood as indicating or implying relative importance, nor can it be understood as indicating or implying order. In the embodiments of the present application, "multiple" means two or more.

[0117] The embodiments of the present application provide an information search method, system and device based on multiple chameleon hash functions, which are used to solve the technical problem of how to make the trapdoor be independently mastered by multiple participants and improve the security and credibility of the chameleon hash algorithm.

[0118] Embodiment 1:

[0119] The information searching method based on the multiple chameleon hash function of the application comprises the following steps:

[0120] S100, setting system parameters, a plurality of participants as trapdoor co-holders master system parameters, the system parameters include p, q, H, g, p is a secure prime number with bit length k, q is a prime number, p=2q+1, g is a q-order element, H is an anti-collision hash function;

[0121] S200, each participant generates its key pair share based on the system parameters through the key generation method in the chameleon hash function, and broadcasts the public key share in the key pair share;

[0122] The aggregated public key is calculated based on the public key shares of all participants;

[0123] S300, based on the aggregated public key, the message and a pair of chameleon random numbers corresponding to the message, chameleon hash calculation is performed to obtain a chameleon hash value as a target hash value;

[0124] S400, a plurality of participants cooperate to find collisions through multiple rounds of concurrent communication to obtain a new message and a pair of new chameleon random numbers corresponding to the new message, and the chameleon hash value of the new message is the same as the target hash value.

[0125] Step S100 performs security settings, and specifies a secure prime number p with bit length k. This means that p=2q+1, where q is also a prime number, and the quadratic residue subgroup Q p of the prime number p has a generator g, that is, g has order q. H is an anti-collision hash function that maps an arbitrary length bit string to a fixed length string H:{0,1} * →{0,1} τ , and τ is a security parameter selected in advance. In the following, the trapdoor manager is a person or organization that only masters the chameleon hash function trapdoor (i.e., the private key).

[0126] Assuming that n participants co-hold trapdoor information, the above participants should have the same security settings, that is, the above p, q, H, g should be public among the n participants.

[0127] Step S200 generates a key, each participant P i (1≤i≤n) selects a random number x i in [1, q-1] as its private key share, calculates as the public key share, and broadcasts y i All participants receive the public key shares of others and calculate the aggregated public key, the calculation formula of the aggregated public key is:

[0128]

[0129] Wherein, a i = H agg ( <l>y i ), denotes the public key aggregation coefficient of the participant P i i <l>={y1,……,y n Let} represent the ordered set of public keys of all participants, and n represent the number of participants. Thus, a i It will only rely on the public key shares of the participants, and all participants and external users can calculate and verify the validity of the aggregated public key.

[0130] Step S300 performs hash value calculation, which uses a variant of the Ateniese keyless exposed chameleon hash function algorithm, making... The input is message m, and a random pair of values ​​(r,s)∈Z is randomly and consistently selected. p ×Z q Then, perform chameleon hash calculation. The corresponding calculation formula for chameleon hash calculation is:

[0131] e = H(m,r)

[0132] C = Hash(m,r,s) = r(y) e g s mod p)mod q

[0133] The total output of this chameleon hash calculation step is (C, m, r, s), which consists of a hash value, a message, and two random numbers, respectively.

[0134] Step S400 performs a distributed collision search. Let C represent the output of the chameleon hash on the input triple (m,r,s). n participants calculate the collision (m′,r′,s′) using a customized secure multi-party computation protocol, such that Hash(m,r,s) = Hash(m′,r′,s′), i.e., C = C′. Generally, m′ is a deterministic input, and r′,s′ need to be calculated. The chameleon hash function is also called a trapdoor hash function; only those who know the trapdoor can calculate the collision (here, r′,s′ meeting the requirements). In this embodiment, the trapdoor information is jointly possessed by the n participants, and only through collaborative efforts can a collision be found.

[0135] With participant P i For example, the calculation logic for other participants is similar. Assume that all parties receive the same input hash value C and new message m′ to calculate the collision.

[0136] (1) Select a random number k i For the first collision search, '∈[1,q-1], the formula for calculating the first collision search is:

[0137]

[0138] e i =H(m′,r i ′)

[0139] r' represents a new chameleon random number corresponding to the new information, r i ' represents the share of the new chameleon random number r' of the participant P i broadcasts its share of the new chameleon random number;

[0140] takes e i ' as the verification value, and the participant P i broadcasts its verification value;

[0141] (2) After receiving the verification values of all other participants, the participant P i broadcasts its random number k i , which is to prevent malicious participants from calculating their own random numbers according to the random numbers of other participants through polynomial calculation; after receiving the random numbers of all other participants, the participant P i verifies the first collision search of all other participants, and for the participant P j the verification calculation formula is:

[0142]

[0143] e j ' = H(m', r j ')

[0144] wherein 1≤j≤n, and j≠i; n represents the total number of n participants;

[0145] If any e j ' is not equal to H(m', r i '), the protocol is terminated;

[0146] (3) The participant P i uses the received and local n random numbers to perform a second collision search, and the second collision search calculation formula is:

[0147]

[0148] e' = H(m', r')

[0149] s i ' = k i ' - e' a i x i mod q

[0150] wherein a i represents the public key aggregation coefficient of the participant P i , x i represents the private key share of the participant P i represents another new chameleon random number corresponding to the new information, s' i represents the share of the new chameleon random number s' of the participant Pa share of another new chameleon random number;

[0151] After each participant broadcasts its share of another new chameleon random number to other participants, another new chameleon random number is calculated based on the shares of another new chameleon random number of all participants, and the calculation formula of another new chameleon random number is:

[0152]

[0153] In this way, each party calculates r' and s', and C = Hash(m', r', s') is satisfied.

[0154] In this embodiment, the trapdoor is dispersed to multiple participants to prevent the trapdoor from being controlled and maliciously used by one party. When calculating the hash collision, multiple participants cooperate through a customized secure multi-party computing mechanism and communicate in parallel for a fixed number of rounds (three rounds), regardless of the number of participants. The aggregated public key is supported, making the hash calculation algorithm simple, easy to master, and fast. The trusted distributor role and private key share distribution process are required, which is fully decentralized, eliminating security risks and improving attack resistance.

[0155] As an improvement of this embodiment, after step S300 performs chameleon hash value calculation, a person who wants to verify the hash algorithm can obtain (C, m, r, s) and perform hash value verification. The verification process is: based on the aggregated public key, the message, and the pair of chameleon random numbers corresponding to the message, the chameleon hash is calculated again to obtain the chameleon hash value as the comparison hash value. The calculation formula corresponding to the chameleon hash calculation is:

[0156] e = H(m, r)

[0157] C' = Hash(m, r, s) = r(y e g s mod p) mod q

[0158] The target hash value is compared with the comparison hash value. If the equation C = C' is established, the hash value verification passes.

[0159] As a further improvement of the embodiment, the method further includes correctness verification. Based on the correctness verification equation, the multiple participants who hold the trapdoor together can find a pair of new random numbers and a new message corresponding to the pair of new random numbers, and the hash value of the new message is the same as the hash value of the input message m. The correctness verification equation is represented as:

[0160] C = r'(y e′ g s′ mod p) mod q

[0161] The correctness verification equation verification step includes:

[0162] (1) Substitute into the correctness verification equation to obtain a first equation, which is expressed as:

[0163]

[0164] (2) Substitute into the first equation to obtain a second equation, which is expressed as:

[0165]

[0166] (3) Split (y e ′g s ′mod p)mod q into the input combination of each participant, and substitute to obtain a third equation, which is expressed as:

[0167]

[0168] (4) Substitute into the third equation to obtain a fourth equation, which is expressed as:

[0169]

[0170] (5) Substitute into the fourth equation to obtain a fifth equation, which is expressed as:

[0171]

[0172] (6) Given g a+b = g a · g b , an equivalent form of the fifth equation is obtained, which is expressed as:

[0173]

[0174] (7) By combining the commutative law and the associative law, the equivalent form of the fifth equation is expressed as a sixth equation, which is expressed as:

[0175]

[0176] (8) Substitute s i ′ = k i ′ - e′a i x i mod q into the sixth equation to obtain a seventh equation, which is expressed as:

[0177]

[0178] (9) Substitute the seventh equation into the second equation to obtain the following:

[0179]

[0180] The present embodiment changes the chameleon hash function algorithm into a distributed protocol, the hash public key is aggregated by the public keys of multiple participants, the private key share is independently generated by each participant, a secret distributor is not needed, and the hash collision is calculated only by three rounds of concurrent communication. The algorithm principle is simple and easy to implement, the communication rounds are independent of the number of participants, the public key aggregation is supported, the hash collision can be calculated only when all participants agree, and high trusted security is obtained.

[0181] Embodiment 2:

[0182] The present application is based on a multiple chameleon hash function information search system, which comprises a security setting module, a key generation module, a hash calculation module, a hash verification module, a collision search module and a correctness verification module.

[0183] The security setting module is used for setting system parameters, and multiple participants as trapdoor co-holders all master the system parameters, wherein the system parameters comprise p, q, H and g, p is a secure prime number with a bit length of k, q is a prime number, p = 2q + 1, g is a q-order element, and H is an anti-collision hash function.

[0184] Security setting, specifically specifying a secure prime number p with a bit length of k. This means that p = 2q + 1, wherein q is also a prime number, and a quadratic residue subgroup Q p of a prime number p, that is, g has an order q. H is an anti-collision hash function that maps an arbitrary length bit string to a fixed length string H: {0,1} * → {0,1} τ , and τ is a security parameter selected in advance. In the following, the trapdoor manager is only a person or organization that masters the chameleon hash function trapdoor (that is, the private key).

[0185] It is assumed that n participants co-hold trapdoor information, and the above participants should have the same security setting, that is, the above p, q, H and g should be public among the n participants.

[0186] The key generation module is used for generating an aggregated public key by the following steps: each participant generates its key pair share based on the system parameters and by a key generation method in the chameleon hash function, and broadcasts the public key share in the key pair share; and the aggregated public key is calculated based on the public key shares of all participants.

[0187] In the key generation, each participant P i (1≤i≤n) select a random number x in [1, q-1] i As his private key share, calculate Broadcast y as public key share i After all participants receive each other's public key share, calculate the aggregate public key, the calculation formula of the aggregate public key is:

[0188]

[0189] Where a i = H agg ( <l>y i ), denotes a public key aggregation coefficient of the participant P i i <l>{y1,……,y n} represents the ordered public key set of all participants, and n represents the number of all participants. Thus a i All participants and external users can calculate and verify the validity of the aggregated public key only depending on the public key share of the participants.

[0190] The hash calculation module is configured to perform a chameleon hash calculation based on the aggregated public key, the message, and a pair of chameleon random numbers corresponding to the message, and obtain a chameleon hash value as a target hash value.

[0191] In the embodiment, the chameleon hash value calculation formula is a variant of the Ateniese key-exposure-free chameleon hash function algorithm, and let The input is a message m, and a random value pair (r, s) is randomly and uniformly selected from Z p ×Z q , and a chameleon hash calculation is performed. The calculation formula corresponding to the chameleon hash calculation is:

[0192] e=H(m,r)

[0193] C=Hash(m,r,s)=r(y e g s mod p)mod q

[0194] The total output of the chameleon hash calculation step is (C, m, r, s), which are a hash value, a message, and two random numbers, respectively.

[0195] The hash verification module is configured to perform a chameleon hash calculation again based on the aggregated public key, the message, and a pair of chameleon random numbers corresponding to the message, and obtain a chameleon hash value as a comparison hash value. The calculation formula corresponding to the chameleon hash calculation is:

[0196] e=H(m,r)

[0197] C′=Hash(m,r,s)=r(y e g s mod p)mod q

[0198] The target hash value is compared with the comparison hash value. If the equation C=C′ is established, the hash value verification passes.

[0199] The plurality of participants in the collision finding module cooperate to find collisions through multiple rounds of concurrent communication, and obtain a new message and a pair of new chameleon random numbers corresponding to the new message. The chameleon hash value of the new message is the same as the target hash value.

[0200] In the collision lookup module, the multiple participants collaborate and perform collision lookup through multi-round concurrent communication, including the following steps:

[0201] Each participant selects a random number, and a first collision search is performed based on the random number. For participant P... i The formula for calculating the first collision search is:

[0202]

[0203] e i =H(m′,r i ')m' represents the new message found through collision lookup, and r' represents a new chameleon random number corresponding to the new message. i Represents participant P in r′ i The proportion of the new chameleon random number;

[0204] k′ i Indicates participant P i A random number, k′ is selected. i ∈[1,q-1];

[0205] e i As a verification value, each participant broadcasts its verification value and, after receiving verification values ​​from all other participants, broadcasts its random number.

[0206] After each participant receives random numbers from all other participants, it verifies the first collision search of all other participants. For participant P... i The verification calculation formula is as follows:

[0207]

[0208] e j =H(m′,r j ′)

[0209] Where 1≤j≤n, and j≠i; n represents a total of n participants;

[0210] After successful verification, each participant performs a second collision search based on random numbers from all participants. For participant P... i The formula for calculating the second collision search is:

[0211]

[0212] e′=H(m′,r′)

[0213] s i '=k i '-e′a i x i mod q

[0214] wherein a i denotes the public key aggregation coefficient of the participant P i , x i denotes the private key share of the participant P i , s' denotes another new chameleon random number corresponding to the new message, s' i denotes the share of the participant P i in the another new chameleon random number;

[0215] After each participant broadcasts its share in the another new chameleon random number to other participants, the another new chameleon random number is calculated based on the shares of all participants in the another new chameleon random number, and the calculation formula of the another new chameleon random number is:

[0216]

[0217] The correctness verification module verifies that the multiple participants as trapdoor co-holders can find a pair of new random numbers and can find a new message corresponding to the pair of new random numbers based on the correctness verification equation, and the hash value of the new message has the same hash value as the input message m; the correctness verification equation is represented as:

[0218] C = r' (y e′ g s′ mod p) mod q.

[0219] The correctness verification equation verification step includes:

[0220] (1) substituting into the correctness verification equation to obtain a first equation, and the first equation is represented as:

[0221]

[0222] (2) substituting into the first equation to obtain a second equation, and the second equation is represented as:

[0223]

[0224] (3) splitting (y e′ g s′ mod p) mod q to the input combination of each participant, and substituting into the second equation to obtain a third equation, and the third equation is represented as:

[0225]

[0226] (4) substituting Substitute the third equation into the fourth equation, and the fourth equation is obtained, which is expressed as:

[0227]

[0228] (5) Substitute the fourth equation into the fifth equation, and the fifth equation is obtained, which is expressed as:

[0229]

[0230] (6) Given g a+b = g a · g b , the equivalent form of the fifth equation is obtained, which is expressed as:

[0231]

[0232] (7) By combining the commutative law and the associative law, the equivalent form of the fifth equation is expressed as the sixth equation, which is expressed as:

[0233]

[0234] (8) Substitute s i ′ = k i ′ - e′a i x i mod q into the sixth equation, and the seventh equation is obtained, which is expressed as:

[0235]

[0236] (9) Substitute the expression of the seventh equation into the second equation, and the following is obtained:

[0237]

[0238] Example 3:

[0239] The device of the application comprises at least one memory and at least one processor; the at least one memory is used to store a machine readable program; and the at least one processor is used to call the machine readable program and execute the method disclosed in Example 1.

[0240] Example 4:

[0241] ​The medium of the present application is a computer-readable medium on which a computer program is stored, and the computer program, when executed by a processor, causes the processor to perform the method of any of the embodiments of the present application. Specifically, a system or apparatus equipped with a storage medium on which a software program code for realizing the functions of any of the above-described embodiments is stored, and a computer (or CPU or MPU) of the system or apparatus can be provided, and the computer (or CPU or MPU) is caused to read out and execute the program code stored in the storage medium.

[0242] In this case, the program code read out from the storage medium can itself implement the functions of any of the above-described embodiments, and therefore the program code and the storage medium which stores the program code constitute a part of the present application.

[0243] Embodiments of the storage medium for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0244] Further, it should be understood that not only the program code read out by the computer, but also the operating system or the like operating on the computer based on the instructions of the program code can perform part or all of the actual operations to realize the functions of any of the above-described embodiments.

[0245] Further, it should be understood that the program code read out from the storage medium can be written into a memory provided in an expansion board inserted into the computer or a memory provided in an expansion unit connected to the computer, and then part or all of the actual operations can be performed by a CPU or the like mounted on the expansion board or the expansion unit based on the instructions of the program code to realize the functions of any of the above-described embodiments.

[0246] Note that not all of the steps and modules in the above-described flowcharts and system block diagrams are essential, and some steps or modules can be omitted according to the actual needs. The execution order of the steps is not fixed, and can be adjusted as needed. The system structure described in each of the above-described embodiments can be a physical structure or a logical structure, that is, some modules can be implemented by the same physical entity, or some modules can be implemented by a plurality of physical entities, or can be implemented by some components in a plurality of independent devices.

[0247] In the above embodiments, the hardware units can be implemented by mechanical means or by electrical means, or by a combination of both. For example, a hardware unit can include a permanent, dedicated, and / or permanent electrical circuitry or logic (e.g., a dedicated processor, a FPGA, or an ASIC) to perform the corresponding operation. A hardware unit can also include a programmable logic or circuitry (e.g., a general purpose processor or other programmable processor) that can be temporarily configured by software to perform the corresponding operation. The manner in which the hardware units are implemented (e.g., mechanically or by a permanent, dedicated, and / or temporary electrical circuitry) can be determined by cost and time considerations.

[0248] The present application has been described in detail by the above drawings and preferred embodiments, however, the present application is not limited to the disclosed embodiments, and those skilled in the art can know that the code review means in different embodiments can be combined to obtain more embodiments of the present application, and these embodiments are also within the protection scope of the present application.< / l> ​< / l> < / l> ​< / l> < / l> ​< / l> ​

Claims

1. An information retrieval method based on a multiple chameleon hash function, characterized in that... Includes the following steps: The system parameters are set, and multiple participants, as joint holders of the trapdoor, all possess the system parameters. The system parameters include p, q, H, and g, where p is a secure prime number with a bit length of k, q is a prime number, p = 2q + 1, g is the q-th order, and H is a collision-resistant hash function. Each participant generates its key pair share based on system parameters using the key generation method in the Chameleon hash function, and broadcasts the public key share in its key pair share. Calculate the aggregate public key based on the public key shares of all participants; Chameleon hash calculation is performed based on the aggregated public key, the message, and a pair of chameleon random numbers corresponding to the message, and the resulting chameleon hash value is used as the target hash value. The multiple participants collaborate and perform collision lookup through multiple rounds of concurrent communication to obtain a new message and a pair of new chameleon random numbers corresponding to the new message. The chameleon hash value of the new message is the same as the target hash value. Chameleon hash calculation is performed based on the aggregated public key, the message, and a pair of chameleon random numbers corresponding to the message. The calculation formula for the chameleon hash calculation is as follows: e = H(m,r) C=Hash(m,r,s)=r(y e g s mod p)mod q Where C represents the target chameleon hash value, (r,s)∈Z p ×Z q This represents a pair of chameleon random numbers corresponding to message m.

2. The information retrieval method based on the multiple chameleon hash function according to claim 1, characterized in that... The collaboration among multiple participants, through multi-round concurrent communication, involves collision detection, including the following steps: Each participant selects a random number, and a first collision search is performed based on the random number. For participant P... i The formula for calculating the first collision search is: e i ’=H(m′,r′ i ) m′ represents the new message found through the collision search, and r′ represents a new chameleon random number corresponding to the new message. i Represents participant P in r′ i The proportion of the new chameleon random number; k′ i Indicates participant P i A random number, k′ is selected. i ∈[1,q-1]; e i As a verification value, each participant broadcasts its verification value and, after receiving verification values ​​from all other participants, broadcasts its random number. After each participant receives random numbers from all other participants, it verifies the first collision search of all other participants. For participant P... i The verification calculation formula is as follows: e j ’=H(m′,r j ′) Where 1≤j≤n, and j≠i; n represents a total of n participants; After successful verification, each participant performs a second collision search based on random numbers from all participants. For participant P... i The formula for calculating the second collision search is: e′=H(m′,r′) s i ’=k i ’-e′a i x i mod q Among them, a i Indicates participant P i The public key aggregation coefficient, x i Indicates participant P i The private key share, s′ represents another new chameleon random number corresponding to the new information, s′ i P represents the participant in s′. i The share of the other new color-changing random number; After each participant broadcasts its share of the other new color-changing random number to the other participants, the other new color-changing random number is calculated based on the shares of all participants in the other new color-changing random number. The formula for calculating the other new color-changing random number is as follows:

3. The information retrieval method based on the multiple chameleon hash function according to claim 1 or 2, characterized in that... For participant P i Select a random number x from [1, q-1]. i As its private key share, and generate its public key share y i , The formula for calculating the aggregated public key is as follows: Among them, a i =H agg ( <l>,y i ), indicating that participant P i The public key aggregation coefficient, a i <l>={y1,……,y n Let} represent the ordered set of public keys of all participants, and n represent the number of all participants.< / l> < / l> 4. The information lookup method based on the multiple chameleon hash function according to claim 1 or 2, characterized in that... It also includes the following steps: Based on the aggregated public key, the message, and the corresponding pair of chameleon random numbers, the chameleon hash is recalculated, and the resulting chameleon hash value is used as the comparison hash value. The calculation formula for the chameleon hash calculation is as follows: e = H(m,r) C′=Hash(m,r,s)=r(y e g s mod p)mod q The target hash value is compared with the comparison hash value. If the equation C = C' holds true, the hash value verification is successful.

5. The information retrieval method based on the multiple chameleon hash function according to claim 2, characterized in that... The method further includes the following steps: Based on the correctness verification equation, it is verified that multiple parties co-holders of the trapdoor can collaboratively find a new pair of random numbers and a new message, the hash value of which is the same as the input message m; the correctness verification equation is expressed as: C=r′(y e′ g s′ mod p)mod q。 6. The information retrieval method based on the multiple chameleon hash function according to claim 5, characterized in that... The correctness verification equation verification steps include: Will Substituting into the correctness verification equation, we obtain the first equation, which is expressed as: Will Substituting into the first equation, we obtain the second equation, which is expressed as: (y) e′ g s′ mod p)mod q is split into the input combinations of each participant, and Substituting the values, we obtain the third equation, which is expressed as: Will Substituting into the third equation, we obtain the fourth equation, which is expressed as: Will Substituting into the fourth equation, we obtain the fifth equation, which is expressed as: Given g a+b =g a ·g b The equivalent of the fifth equation is obtained, which is expressed as: By combining the commutative and associative laws, the equivalent of the fifth equation can be expressed as the sixth equation, which is: s i ′=k i ′-e′a i x i Substituting mod q into the sixth equation, we obtain the seventh equation, which is expressed as: Substituting the seventh equation into the second equation, we obtain the following:

7. An information retrieval system based on a multiple chameleon hash function, characterized in that... The system utilizes the information retrieval method based on a multiple chameleon hash function as described in any one of claims 1-6 to retrieve a new message and a new pair of random numbers, wherein the chameleon hash value of the new message is the same as the chameleon hash value of the input message. The system comprises: The security setting module is used to set system parameters. Multiple participants, as joint holders of the trapdoor, all have access to the system parameters. The system parameters include p, q, H, and g, where p is a secure prime number with a bit length of k, q is a prime number, p = 2q + 1, g is the q-th order, and H is a collision-resistant hash function. The key generation module is used to generate an aggregate public key through the following steps: each participant generates its key pair share based on system parameters and the key generation method in the Chameleon hash function, and broadcasts the public key share in its key pair share; the aggregate public key is calculated based on the public key shares of all participants. The hash calculation module is used to perform chameleon hash calculation based on the aggregated public key, the message and a pair of chameleon random numbers corresponding to the message, and the obtained chameleon hash value is used as the target hash value. The hash verification module is used to recalculate the chameleon hash based on the aggregated public key, the message, and a pair of chameleon random numbers corresponding to the message. The resulting chameleon hash value is used as the comparison hash value. The calculation formula for the chameleon hash calculation is as follows: e = H(m,r) C′=Hash(m,r,s)=r(y e g s mod p)mod q The target hash value is compared with the comparison hash value. If the equation C = C' holds true, the hash value verification is successful. The collision lookup module, in which multiple participants collaborate to perform collision lookup through multi-round concurrent communication, to obtain a new message and a pair of new chameleon random numbers corresponding to the new message, wherein the chameleon hash value of the new message is the same as the target hash value; A correctness verification module, based on a correctness verification equation, verifies that multiple parties co-holders of a trapdoor can collaboratively find a pair of new random numbers and a new message, wherein the hash value corresponding to the new message has the same hash value as the input message m; the correctness verification equation is expressed as: C=r′(y e′ g s′ mod p)mod q; In the collision lookup module, the multiple participants collaborate and perform collision lookup through multi-round concurrent communication, including the following steps: Each participant selects a random number, and a first collision search is performed based on the random number. For participant P... i The formula for calculating the first collision search is: e i ’=H(m′,r i ′) m′ represents the new message found through the collision search, and r′ represents a new chameleon random number corresponding to the new message. i Represents participant P in r′ i The proportion of the new chameleon random number; k′ i Indicates participant P i A random number, k′ is selected. i ∈[1,q-1]; e i As a verification value, each participant broadcasts its verification value and, after receiving verification values ​​from all other participants, broadcasts its random number. After each participant receives random numbers from all other participants, it verifies the first collision search of all other participants. For participant P... i The verification calculation formula is as follows: e j ’=H(m′,r j ′) Where 1≤j≤n, and j≠i; n represents a total of n participants; After successful verification, each participant performs a second collision search based on random numbers from all participants. For participant P... i The formula for calculating the second collision search is: e′=H(m′,r′) s i ’=k i ’-e′a i x i mod q Among them, a i Indicates participant P i The public key aggregation coefficient, x i Indicates participant P i The private key share, s′ represents another new chameleon random number corresponding to the new information, s′ i P represents the participant in s′. i The share of the other new color-changing random number; After each participant broadcasts its share of the other new color-changing random number to the other participants, the other new color-changing random number is calculated based on the shares of all participants in the other new color-changing random number. The formula for calculating the other new color-changing random number is as follows:

8. An apparatus, characterized in that, include: At least one memory and at least one processor; The at least one memory is used to store a machine-readable program; The at least one processor is configured to invoke the machine-readable program to execute the method according to any one of claims 1 to 6.

9. A medium, which is a computer-readable medium, characterized in that, The computer-readable medium stores computer instructions that, when executed by a processor, cause the processor to perform the method described in any one of claims 1 to 6.

Images