Attribute-based online / offline signature method and system based on commercial secret SM9

Abstract

The present invention proposes an attribute-based online / offline signature method and system based on commercial secret SM9, the system includes an attribute authorization end, a signature end and a verification end; the attribute authorization end generates a master private key and public parameters according to the security parameters during signing; and further generates a signature based on the master private key, public parameters, signature end attribute set and access structure. A , generating a public-private key pair of the signing end; the signing end generates an offline signature based on the public parameters generated by the attribute authorization end and the signing end private key; and also generates an online signature based on the public parameters, the signing end attribute set, the offline signature, the signing end private key and the message; the verification end verifies the message based on the public parameters generated by the attribute authorization end, the signing end public key, M And the online signature generated by the signing end is used to verify the validity of the signature; the present invention can reduce the signature calculation cost of the lightweight device in the online stage and comply with the commercial SM9 identification signature standard.

Description

Technical Field

[0001] The present invention relates to the field of Internet security technology, and in particular to an attribute-based online / offline signature method and system based on commercial secret SM9. Background Art

[0002] The development and popularization of Internet of Things technology has made the modern living environment more friendly and convenient, and has had an important impact on people's lifestyles. The Internet of Things connects electronic devices to the Internet, enabling Internet-connected objects to use embedded sensors, radio frequency identification, laser scanners and other information sensing devices to collect and exchange data. However, due to the use of wireless network communication, the Internet of Things is more vulnerable to various attacks. Therefore, in order to protect the security of data in the Internet of Things, it is necessary to provide identity authentication before using the data. Attribute-based signature (ABS) is an important method to solve the above problems. It plays an important role in privacy protection, access control and data authentication. However, in the ABS scheme, on the one hand, lightweight devices cannot withstand a large number of exponential operations or pairing operations, and it is necessary to reduce the computational cost of the lightweight device's online signing stage. On the other hand, in order to realize the national cyberspace security independent and controllable development strategy, it is necessary to design a cryptographic scheme that meets the national secret standards. Summary of the invention

[0003] The present invention proposes an attribute-based online / offline signature method and system based on the commercial secret SM9, which can reduce the signature calculation cost of lightweight devices in the online stage and comply with the commercial secret SM9 identification signature standard.

[0004] The present invention adopts the following technical solutions.

[0005] An attribute-based online / offline signature system based on commercial secret SM9, the system comprising an attribute authorization end, a signature end and a verification end;

[0006] The attribute authorization end generates a master private key msk and a public parameter params according to the security parameter λ during signing; and also generates a master private key msk, a public parameter params, and a signature end attribute set ω according to the master private key msk, the public parameter params, and the signature end attribute set ω. j And access structure A to generate the signature end public and private key pair

[0007] The signature end generates the public parameters params and the signature end private key based on the attribute authorization end. Generate offline signature σ off ; Also based on the public parameters params, signature end attribute set ω j , offline signature σ off , Signature end private key and message M, generating an online signature σ on ;

[0008] The verification end generates the public parameters params based on the attribute authorization end, the signature end public key For the message M and the online signature σ generated by the signing end on To verify the validity of the signature.

[0009] The attribute-based online / offline signature method based on the commercial secret SM9 is based on the attribute-based online / offline signature system based on the commercial secret SM9 described above, and the signature method includes the following steps:

[0010] Step S1: input security parameter λ to the attribute authorization end, and the attribute authorization end outputs the master private key msk and public parameter params;

[0011] Step S2: Input the master private key msk, public parameter params, and signature end attribute set ω to the attribute authorization end j And access structure A, attribute authorization end output signature end public and private key pair

[0012] Step S3: Input the public parameters params and the private key of the signing end to the signing end The signature end outputs the offline signature σ off ;

[0013] Step S4: Input public parameters params and signature end attribute set ω to the signature end j , offline signature σ off , Signature end private key And message M, the signing end outputs the online signature σ for message M on ;

[0014] Step S5: Input the public parameters params and the public key of the signing end to the verification end Message M and online signature σ on ; If the signature of message M is valid, the verifier outputs accept; otherwise, the verifier outputs reject.

[0015] The step S1 comprises the following steps:

[0016] Step S11: The attribute authorization terminal inputs the security parameter λ and generates a bilinear pairing tuple BP=(G1, G2, G T , e, p), where e: G1×G2→G T , p is a large prime number, |p|=λ;

[0017] The attribute authorization end randomly selects the generator P1 of G1 and the generator P2 of G2;

[0018] The attribute authorization terminal selects the system attribute domain U = {att1, att2, ..., att u},in 1≤i≤u, u=|U|,

[0019] Attribute Authorization End Definition Algorithm Convert the attribute set ω into a binary identifier ID ω ,in The definition is as follows: Input attribute set ω, system attribute domain U; ​​let ID ω [i] indicates ID ω The i-th position of i ∈ω, let ID ω [i] = 1; otherwise, let ID ω [i] = 0; where 1 ≤ i ≤ u, u = |U|. Finally, the algorithm outputs ID ω ;

[0020] Step S12: Random selection of attribute authorization end Calculate P pub =αP2, g = e(P1, P pub );

[0021] Step S13: The attribute authorization terminal selects two hash functions And randomly select a 1-bit private key to generate a function identifier hid∈{0,1};

[0022] Step S14: The attribute authorization terminal outputs the master private key msk=α and public parameters params=(BP, P1, P2, P pub , g, U, hid, H1, H2) Formula 1.

[0023] The step S2 specifically includes the following steps:

[0024] Step S21: The attribute authorization terminal inputs access policy A = {A1, A2, ..., A n},in 1≤i≤n, n=|A|, algorithm Signature side attribute set Master private key msk and public parameters params;

[0025] Step S22: Attribute authorization end uses algorithm Set access policy A = {A1, A2, ..., A n} and the signature end attribute set ω j Convert to a binary identifier set and binary identification

[0026] Step S23: Random selection of attribute authorization end Calculate the signature end private key in

[0027]

[0028] sk2=r s Formula 3;

[0029] Calculate the signature end public key

[0030] Step S24: The attribute authorization end outputs the signature end public and private key pair

[0031] The step S3 specifically comprises the following steps:

[0032] Step S31: The signing end inputs public parameters params and the signing end private key

[0033] Step S32: Signature end randomly selected Calculate w = g r , l=sk2·(rk)mod p, S=l·sk1;

[0034] Step S33: The signing end outputs the offline signature σ off =(r, k, w, S).

[0035] The step S4 specifically comprises the following steps:

[0036] Step S41: The signing end inputs public parameters params and signs offline off , the signature side private key Signature end attribute setω j and message M;

[0037] Step S42: Signature end uses algorithm Set the signature attribute set ω j Convert to a binary identifier

[0038] Step S43: The signature end calculates: h = H2(M||w, p), τ = (rh)(rk) -1 mod p,

[0039] Step S44: The signing end outputs the online signature σ on =(h,τ,y,S).

[0040] The step S5 specifically comprises the following steps:

[0041] Step S51: The verification end inputs the message signature pair (M, σon ), the signature end public key And public parameters params;

[0042] Step S52: The verification end determines the equation Is it true? If not, terminate the execution; otherwise, continue to execute the following steps;

[0043] Step S53: The verification end calculates t=g h , P=yP2+P pub , β=e(τ·S,P), w′=β·t and h2=H2(M||w′,p);

[0044] Step S54: The verification end determines whether the equation: h2 = h holds. If so, it outputs accept, otherwise it outputs reject.

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] 1. The present invention is designed based on the commercial SM9 identification signature algorithm, which is in line with the national cyberspace security independent and controllable development strategy.

[0047] 2. The present invention uses online and offline signature technology to enable the signing end to divide the signature into an online stage and an offline stage. Before an unknown message, the computational cost of the online stage is reduced by allocating expensive computations to the offline stage and only reserving some lightweight computations for the online stage.

[0048] 3. The attribute-based signature scheme of the present invention ensures that the user can generate a valid signature only when the signature end attribute set satisfies the access policy. Therefore, the proposed method and system have strong practicality and broad application prospects in data authentication and privacy protection access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments:

[0050] Attached Figure 1 It is a schematic diagram of the system architecture of the present invention. DETAILED DESCRIPTION

[0051] As shown in the figure, the attribute-based online / offline signature system based on the commercial secret SM9 includes an attribute authorization end, a signature end, and a verification end;

[0052] The attribute authorization end generates a master private key msk and a public parameter params according to the security parameter λ during signing; and also generates a master private key msk, a public parameter params, and a signature end attribute set ω according to the master private key msk, the public parameter params, and the signature end attribute set ω. j And access structure A to generate the signature end public and private key pair

[0053] The signature end generates the public parameters params and the signature end private key based on the attribute authorization end. Generate offline signature σ off ; Also based on the public parameters params, signature end attribute set ω j , offline signature σ off , Signature end private key and message M, generating an online signature σ on ;

[0054] The verification end generates the public parameters params based on the attribute authorization end, the signature end public key For the message M and the online signature σ generated by the signing end on To verify the validity of the signature.

[0055] The attribute-based online / offline signature method based on the commercial secret SM9 is based on the attribute-based online / offline signature system based on the commercial secret SM9 described above, and the signature method includes the following steps:

[0056] Step S1: input security parameter λ to the attribute authorization end, and the attribute authorization end outputs the master private key msk and public parameter params;

[0057] Step S2: Input the master private key msk, public parameter params, and signature end attribute set ω to the attribute authorization end j And access structure A, attribute authorization end output signature end public and private key pair

[0058] Step S3: Input the public parameters params and the private key of the signing end to the signing end The signature end outputs the offline signature σ off ;

[0059] Step S4: Input public parameters params and signature end attribute set ω to the signature end j , offline signature σ off , Signature end private key And message M, the signing end outputs the online signature σ for message M on ;

[0060] Step S5: Input the public parameters params and the public key of the signing end to the verification end Message M and online signature σ on ; If the signature of message M is valid, the verifier outputs accept; otherwise, the verifier outputs reject.

[0061] The step S1 comprises the following steps:

[0062] Step S11: The attribute authorization terminal inputs the security parameter λ and generates a bilinear pairing tuple BP=(G1, G2, G T , e, p), where e: G1×G2→G T , p is a large prime number, |p|=λ;

[0063] The attribute authorization end randomly selects the generator P1 of G1 and the generator P2 of G2;

[0064] The attribute authorization terminal selects the system attribute domain U = {att1, att2, ..., att u},in 1≤i≤u, u=|U|,

[0065] Attribute Authorization End Definition Algorithm Convert the attribute set ω into a binary ID ω ,in The definition is as follows: Input attribute set ω, system attribute domain U; ​​let ID ω [i] indicates ID ω The i-th position of i ∈ω, let ID ω [i] = 1; otherwise, let ID ω [i] = 0; where 1 ≤ i ≤ u, u = |U|. Finally, the algorithm outputs ID ω ;

[0066] Step S12: Random selection of attribute authorization end Calculate P pub =αP2, g = e(P1, P pub );

[0067] Step S13: The attribute authorization terminal selects two hash functions And randomly select a 1-bit private key to generate a function identifier hid∈{0,1};

[0068] Step S14: The attribute authorization terminal outputs the master private key msk=α and public parameters params=(BP, P1, P2, P pub , g, U, hid, H1, H2) Formula 1.

[0069] The step S2 specifically includes the following steps:

[0070] Step S21: The attribute authorization terminal inputs access policy A = {A1, A2, ..., A n},in 1≤i≤n, n=|A|, algorithm Signature side attribute set Master private key msk and public parameters params;

[0071] Step S22: Attribute authorization end uses algorithm Set access policy A = {A1, A2, ..., A n} and the signature end attribute set ω j Convert to a binary identifier set and binary identification

[0072] Step S23: Random selection of attribute authorization end Calculate the signature end private key in

[0073]

[0074] sk2=r s Formula 3;

[0075] Calculate the signature end public key

[0076] Step S24: The attribute authorization end outputs the signature end public and private key pair

[0077] The step S3 specifically comprises the following steps:

[0078] Step S31: The signing end inputs public parameters params and the signing end private key

[0079] Step S32: Signature end randomly selected Calculate w = g r , l=sk2·(rk)mod p, S=l·sk1;

[0080] Step S33: The signing end outputs the offline signature σ off =(r, k, w, S).

[0081] The step S4 specifically comprises the following steps:

[0082] Step S41: The signing end inputs public parameters params and signs offline off , the signature side private key Signature end attribute setω j and message M;

[0083] Step S42: Signature end uses algorithm Set the signature attribute set ω j Convert to a binary identifier

[0084] Step S43: The signature end calculates: h = H2(M||w, p), τ = (rh)(rk) -1 modp,

[0085] Step S44: The signing end outputs the online signature σ on =(h,τ,y,S).

[0086] The step S5 specifically comprises the following steps:

[0087] Step S51: The verification end inputs the message signature pair (M, σ on ), the signature end public key And public parameters params;

[0088] Step S52: The verification end determines the equation Is it true? If not, terminate the execution; otherwise, continue to execute the following steps;

[0089] Step S53: The verification end calculates t=g h , P=yP2+P pub , β=e(τ·S,P), w′=β·t and h2=H2(M||w′,p);

[0090] Step S54: The verification end determines whether the equation: h2 = h holds. If so, it outputs accept, otherwise it outputs reject.

[0091] Example:

[0092] The signing process in this example is as follows

[0093] 1. The signature device sets the attribute ω j Sent to the attribute authority, which calculates the public and private key pair of the signature device using the following algorithm

[0094] (1) Using Algorithms Set access policy A = {A1, A2, ..., A n} and the signature device attribute set ω j Convert to a binary identifier set and binary identification

[0095] (2) Random selection Calculate the signature end private key in, sk2=r s ; Calculate the signature end public key

[0096] (3) Output the signature end public and private key pair

[0097] 2. The signing device obtains the public and private key pair After that, the offline signature σ is generated by the following algorithm off :

[0098] (1) Random selection Calculate w = g r , l=sk2·(rk)mod p, S=l·sk1;

[0099] (2). Output offline signature σ off =(r, k, w, S).

[0100] 3. The signature device generates an offline signature off After that, the online signature σ is generated by the following algorithm on :

[0101] (1) Using Algorithms Set the signature device attribute to j Convert to a binary identifier

[0102] (2) Calculation: h = H2(M||w, p), τ = (rh)(rk) -1 mod p,

[0103] (3). Output online signature σ on =(h,τ,y,S).

[0104] 4. The verification device obtains the message signature pair (M, σ on ) and verify the validity of the signature using the following algorithm:

[0105] (1) Determine the equation Is it established? If not, the execution is terminated; otherwise, the execution continues;

[0106] (2) Calculate t = g h , P=yP2+P pub , β=e(τ·S,P), w′=β·t and h2=H2(M||w′,p);

[0107] (3) Determine whether the equation: h2 = h holds. If so, output accept; otherwise, output reject.

[0108] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0109] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0110] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0111] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0112] The above is only a preferred embodiment of the present invention, and does not limit the present invention in other forms. Any technician familiar with the profession may use the above disclosed technical content to change or modify it into an equivalent embodiment with equivalent changes. However, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the technical solution of the present invention still belongs to the protection scope of the technical solution of the present invention.

Claims

1. A signature method for an attribute-based online / offline signature system based on commercial secret SM9, characterized in that: The following steps are involved: Step S1: input security parameter λ to the attribute authorization end, and the attribute authorization end outputs the master private key msk and public parameter params; Step S2: Input the master private key msk, public parameter params, and signature end attribute set ω to the attribute authorization end j And access structure A, attribute authorization end output signature end public and private key pair Step S3: Input the public parameters params and the private key of the signing end to the signing end The signature end outputs the offline signature σ off ; Step S4: Input public parameters params and signature end attribute set ω to the signature end j , offline signature σ off , Signature end private key And message M, the signing end outputs the online signature σ for message M on ; Step S5: Input the public parameters params and the public key of the signing end to the verification end Message M and online signature σ on ; If the signature of message M is valid, the verifier outputs accept; otherwise, the verifier outputs reject; The step S1 comprises the following steps: Step S11: The attribute authorization terminal inputs the security parameter λ and generates a bilinear pairing tuple BP=(G1, G2, G T , e, p), where e: G1×G2→G T , p is a large prime number, |p|=λ; The attribute authorization end randomly selects the generator P1 of G1 and the generator P2 of G2; The attribute authorization terminal selects the system attribute domain U = {att1, att2, .., att u },in 1≤i≤u, u=|U|, Attribute Authorization End Definition Algorithm Convert the attribute set ω into a binary ID ω ,in The definition is as follows: Input attribute set ω, system attribute domain U; ​​let ID ω [i] indicates ID ω The i-th position of i ∈ω, let ID ω [i] = 1; otherwise, let ID ω [i] = 0; where 1 ≤ i ≤ u, u = |U|; finally, the algorithm outputs ID ω ; Step S12: Random selection of attribute authorization end Calculate P pub =αP2, g = e(P1, P pub ); Step S13: The attribute authorization terminal selects two hash functions And randomly select a 1-bit private key to generate a function identifier hid∈{0,1}; Step S14: The attribute authorization terminal outputs the master private key msk=α and public parameters params = (BP, P1, P2, P pub , g, U, hid, H1, H2) Formula 1.

2. The signature method of the attribute-based online / offline signature system based on commercial secret SM9 according to claim 1 is characterized in that: The step S2 specifically includes the following steps: Step S21: The attribute authorization terminal inputs the access structure A = {A1, A2, .., A n },in 1≤i≤n, n=|A|, algorithm Signature side attribute set Master private key msk and public parameters params; Step S22: Attribute authorization end uses algorithm The access structure A = {A1, A2, ..., A n } and the signature end attribute set ω j Convert to a binary identifier set and binary identification Step S23: Random selection of attribute authorization end Calculate the signature end private key in sk2=r s Formula 3; Calculate the signature end public key Step S24: The attribute authorization end outputs the signature end public and private key pair 3. The signature method of the attribute-based online / offline signature system based on commercial secret SM9 according to claim 1, characterized in that: The step S3 specifically comprises the following steps: Step S31: The signing end inputs public parameters params and the signing end private key Step S32: Signature end randomly selected Calculate w = g r , l=sk2·(rk)mod p, S=l·sk1; Step S33: The signing end outputs the offline signature σ off =(r, k, w, S).

4. The signature method of the attribute-based online / offline signature system based on commercial secret SM9 according to claim 3 is characterized in that: The step S4 specifically comprises the following steps: Step S41: The signing end inputs public parameters params and signs offline off , the signature side private key Signature end attribute setω j and message M; Step S42: Signature end uses algorithm Set the signature attribute set ω j Convert to a binary identifier Step S43: The signature end calculates: h = H2(M||w, p), τ = (rh)(rk) -1 mod p, Step S44: The signing end outputs the online signature σ on =(h,τ,y,S).

5. The signature method of the attribute-based online / offline signature system based on commercial secret SM9 according to claim 3 is characterized in that: The step S5 specifically comprises the following steps: Step S51: The verification end inputs the message signature pair (M, σ on ), the signature end public key And public parameters params; Step S52: The verification end determines the equation Is it true? If not, terminate the execution; otherwise, continue to execute the following steps; Step S53: The verification end calculates t=g h , P=yP2+P pub , β=e(τ·S,P), w′=β·t and h2=H2(M||w′,p); Step S54: The verification end determines whether the equation: h2=h holds true; if so, outputs accept, otherwise outputs reject.

Images