Certificateless traceable ring signature method with batch verification

Abstract

The present invention relates to the field of mobile Internet security and cryptography, and specifically to a certificateless traceable ring signature method with batch verification. In a ring signature, the signer signs a message as a ring member to achieve the effect of hiding his or her own identity. In order to address the deficiencies in the traceability and efficiency research of existing ring signature methods under a certificateless cryptographic system, the present invention provides a certificateless traceable ring signature method with batch verification, which allows the signer to sign a message as a ring member without exposing his or her identity under a certificateless public key cryptographic system, and provides a method for tracing the true identity of the signer for a trusted entity, while supporting batch verification of ring signatures, and successfully realizing the traceability and batch processing of ring signatures under a certificateless system.

Description

Technical Field

[0001] The present invention relates to the fields of mobile Internet and cryptography, and in particular to a certificate-free traceable ring signature method with batch verification. Background Art

[0002] In order to solve the problems of complex certificate management and low efficiency in the public key cryptography system based on PKI, Shamir proposed an identity-based public key cryptography system in 1984. In this system, the public key of the signer is generated by the signer's unique identity certificate, and the private key is generated by the key generation center, which solves the problems existing in the public key cryptography system based on PKI. However, this brings about the problem of system key escrow and there are major security vulnerabilities. In order to solve this problem, in 2003, Al-Riyami et al. proposed a certificateless public key cryptography system. In the certificateless cryptography system, the signer's private key is jointly generated by the key generation center and the signer. This system overcomes the key escrow problem existing in the identity-based public key cryptography system.

[0003] The concept of ring signature was first formally proposed by Rivest, Shamir and Tauman in 2001. Ring signature provides great flexibility: no group manager, no special settings and dynamic group selection. However, due to the anonymity of ring signature, the system is vulnerable to attacks by malicious or irresponsible signers. Therefore, in 2007, Eiichiro Fujisaki and Koutarou Suzuki proposed a traceable ring signature scheme with labels. It can limit "excessive" anonymity. There is a label in this ring signature, which consists of a list of ring members and a string. If a ring member submits another signed opinion, the identity of the ring member will be immediately exposed. If a ring member submits the same information, such as voting "yes" twice on the same question, every entity in the system can see that the two are linked. Traceable ring signatures are more secure than traditional ring signatures and can be applied to many applications. However, the process of traceable ring signatures with labels is complicated, the signature is large, and there is a problem of low efficiency. In addition, when tracking ring members, they must rely on them to issue two signatures, and there is a problem that a single signature in the system cannot be tracked. Summary of the invention

[0004] In order to overcome the defects of the above ring signature method, the present invention provides a certificate-free traceable ring signature method with batch verification.

[0005] The technical method adopted by the present invention is: by skillfully designing the structure and algorithm of the conversion key in the ring signature, and combining the certificateless public key cryptography system with the ring signature, the signer can anonymously sign the message m as a ring member under the certificateless cryptography system, and when the system is attacked, some entities in the system are allowed to track the real signer of the message m, and the signatures can be authenticated in batches, which effectively solves the problems of insecurity and inefficiency in practical applications of the existing ring signature method due to the defects of the cryptography system and attributes.

[0006] Compared with the prior art, the beneficial effect of the present invention is that it skillfully combines the certificateless public key cryptography system with the traceable ring signature method with batch verification. The security defects caused by the anonymity of the ring signature effectively solve the problems of insecurity and inefficiency of the existing ring signature method in practical applications.

[0007] The certificateless traceable ring signature method with batch verification in the present invention involves three entities: a key generation center, a signer, and a tracker. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 Certificateless traceable ring signature process with batch verification DETAILED DESCRIPTION

[0009] The embodiments of the present invention include the following seven algorithms.

[0010] (1) System parameter generation Setup:

[0011] (a) Choose two cyclic groups of order p and A bilinear pairing e: g is The generator of

[0012] (b) randomly select a number SSK from the set of integers modulo p as the master key of the key generation center, and calculate SPK=SSK·g as the master public key of the key generation center;

[0013] (c) Randomly select two hash functions and

[0014] (d) Release system parameters The key generation center secretly stores the master key SSK;

[0015] (2) Partial-Secret-Key-Generation:

[0016] (a) Calculation Will be issued to KGC;

[0017] (b) For all users in the system, KGC calculates the user’s partial private key

[0018] (c) KGC sends the user’s partial private key psk i Send to user u i ;

[0019] (3)Key-Generation:

[0020] (a) Randomly select a secret value Then calculate the user u i Private key

[0021] (b) User u i calculate

[0022] (c) User u i Publish public key pk i =(pka i ,pkb i ), keep the private key sk secret i ;

[0023] (4) Signature generation:

[0024] (a) Signer u s Select n-1 users in the system to form a ring with yourself, and the ring user set is denoted as U N = {u1...u s ...u n}, the corresponding ring public key set is denoted as pk N ={pk1...pk s ...pk n};

[0025] (b)u s For each user u in the ring i Choose a random value r i (i=1,...,n);

[0026] (c)u s Calculate R i =r i ·g,T i =r i ·pkb i ,h i =H2(m,pk i ||R i ||T i),(i=1,...,n,i≠s);

[0027] (d)u s calculate h s =H2(m||pk s ||R s ||T s ), F = r s SPK+(h s +r s )·sk s ;

[0028] (e) Change {R1,...R s ,...R n} is denoted as R N , {T1,...T s ,...T n} is denoted as T N ;

[0029] (f)u s Generate signature σ=(m,pk N ,R N ,T N ,F);

[0030] (5) Single signature verification:

[0031] (a) Calculate h i =H2(m,pk i ||R i ||T i )(i=1,...,n);

[0032] (b) Verify the equation Is it true? If the equation

[0033] If true, the signature is valid and output 1; otherwise, the signature is invalid and output 0;

[0034] (6) Batch-Verify:

[0035] (a) Enter σ K ={σ1,...,σ k}, where σ i =(m i ,pk Ni ,R Ni ,T Ni ,F i )(i=1,...,k);

[0036] (b) Calculate h ij =H2(mi ,pk ij ||R ij ||T ij )(i=1,...,k,j=1,...,n i );

[0037] (c) Verify the equation

[0038] (d) If the equation holds, the signature is valid and output 1; otherwise, there is an invalid signature and output 0;

[0039] (7) Track: (a) Audit node to user u in the ring i (i=1,...,n)Send tracking please

[0040] Sum T i ;

[0041] (b) User returns T′ i =d i ·T i

[0042] (c) The audit node verifies the equation e(T i ,pkb i ) = e(T′ i ,pka i ) is established;

[0043] (d) If the equality does not hold, the message is actually signed by the sender, and the public key pk of the sender is returned. s .

[0044] Verification of the effectiveness of the present invention

[0045] The single signature authentication Verify validity proof of the present invention:

[0046]

[0047] Batch-Verify validity proof of the present invention:

[0048]

[0049] The Track validity of the present invention is proved as follows:

[0050] e(T i ,pkb i )=e(T i ,(d i +x i ) -1 ·D i )=e(d i ·Ti ,(d i +x i ) -1 ·g)=e(T i ',pka i )

Claims

1. A certificate-free traceable ring signature method with batch verification, characterized by: (1) System parameter generation Setup: (a) The key generation center KGC selects two cyclic groups of prime order p and A bilinear pairing e: g is The generator of (b) KGC randomly selects a number SSK from the integer set modulo p as its own master key, and calculates SPK = SSK g as the master public key of the key generation center; (c) KGC randomly selects two hash functions H1: and H2: (d) KGC release system parameters The key generation center secretly stores the master key SSK; (2) Partial-Secret-Key-Generation: (a) User u i For your own ID i ,calculate D i Send to KGC; (b) For all users in the system, KGC calculates the user’s partial private key (c) KGC sends the user’s partial private key psk i Send to user u i ; (3)Key-Generation: (a) User u i Randomly select a secret value Then calculate your own private key (b) User u i calculate (c) User u i Publish public key pk i =(pka i ,pkb i ), keep the private key sk secret i ; (4) Signature generation: (a) Signer u s Select n-1 users in the system to form a ring with yourself, and the ring user set is denoted as U N = {u1...u s ...u n }, the corresponding ring public key set is denoted as pk N ={pk1...pk s ...pk n }, the message to be signed is denoted as m; (b)u s For each user u in the ring i Choose a random value r i (i=1,...,n); (c)u s Calculate R i = r i ·g,T i = r i ·pkb i ,h i = H2(m,pk i ||R i ||T i ),(i = 1,..., n, i ≠ s); (d)u s calculate h s =H2(m,pk s ||R s ||T s ),F=r s ·SPK+(h s +r s )·sk s ; (e)u s {R1,...R s ,...R n } is denoted as R N , {T1,...T s ,...T n } is denoted as T N ; (f)u s Generate signature σ=(m,pk N ,R N ,T N ,F); (5) Single signature verification: (a) The signature verifier V calculates h i =H2(m,pk i ||R i ||T i )(i=1,...,n); (b) V verification equation Is it true? If the equation is true, the signature is valid and output 1; otherwise, the signature is invalid and output 0; (6) Batch-Verify: (a) The signature verifier V inputs σ K ={σ1,...,σ k }, where σ i =(m i ,pk Ni ,R Ni ,T Ni ,F i )(i=1,...,k); (b) V calculation h ij =H2(m i ,pk ij ||R ij ||T ij )(i=1,...,k,j=1,...,n i ); (c) V verification equation (d) If the equation holds, V determines that the signature is valid and outputs 1; otherwise, V determines that there is an invalid signature and outputs 0; (7) Track: (a) Audit node to user u in the ring i (i=1,...,n) sends tracking request and T i ; (b) User returns T′ i =d i ·T i ; (c) The audit node verifies the equation e(T i ,pkb i ) = e(T′ i ,pka i ) is established; (d) If the equality does not hold, the audit node determines u s The real signer of the message returns the public key pk of the signer s .

Images