Hash processing method, device, equipment and storage medium for digital signature

Abstract

The present application provides a hash processing method, device, equipment and storage medium for digital signature. It relates to the field of information security technology. The method includes: using a hash function to compress an input string into a fixed-length short string; inputting the fixed-length short string into a pseudo-random generator to obtain a pseudo-random sequence; expanding a single Hamming weight set to obtain a multi-Haming weight set; according to the pseudo-randomness of the pseudo-random sequence, uniformly sampling on the multi-Haming weight set, outputting a target challenge vector; or, according to the pseudo-randomness of the pseudo-random sequence, non-uniformly sampling on the multi-Haming weight set, outputting a target challenge vector; generating a digital signature according to the target challenge vector. By obtaining and utilizing the pseudo-randomness of the pseudo-random sequence, uniform sampling or non-uniform sampling is performed on the set of multi-Haming weights, the average number of cycles of the signature algorithm is reduced without reducing the quantum security strength of the signature algorithm, thereby improving the efficiency of the signature algorithm.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a hash processing method, device, equipment and storage medium for digital signatures. Background Art

[0002] With the continuous development of quantum computing technology, it is necessary to design cryptographic technologies that can resist quantum attacks. Among them, cryptographic technologies based on lattice theory (lattice-based cryptographic technologies for short) are receiving more and more attention. In particular, the standard lattice is a lattice with the most general algebraic structure. Cryptographic technologies based on the standard lattice are often more secure than other types of lattice-based cryptographic technologies, and therefore have received widespread attention. Digital signatures are an important component of cryptographic technology and an important means to ensure network information security. It is of great significance to study the security and algorithm efficiency of digital signature technology.

[0003] Currently, digital signature technology based on lattice theory can be designed through a variety of paradigms. At present, all digital signature technologies based on standard lattices and using the Fiat-Shamir transformation design paradigm use a hash module in all signature algorithms to implement hash processing from {0, 1} ★ to a pre-specified finite set The output of the hash module is called Challenge, which is usually represented by c. When the input of the hash module is regarded as a random variable, χ is used to represent the distribution of the random variable c on the set B. Generally speaking, the implementation of the hash module includes two stages: first, a hash function (such as SHA3-256, SHA3-384) is used to compress the input string into a short string of fixed length (called a seed); then, the seed is used as the input of the pseudorandom generator (PRG), and a uniform distribution is generated on the set B. Sampling and output.

[0004] In terms of quantum security, in order to achieve the ideal quantum security strength, the random distribution The entropy of cannot be too small; however, if If the entropy increases, the average number of cycles of the signature algorithm may increase during the hash processing of the hash module, making the efficiency of the signature algorithm lower.

[0005] Therefore, there is an urgent need for a digital signature processing method that can improve the efficiency of the signature algorithm while ensuring that the quantum security strength of the signature algorithm remains unchanged. Summary of the invention

[0006] The present application provides a hash processing method, apparatus, device and storage medium for digital signatures, so as to improve the efficiency of the signature algorithm without reducing the quantum security strength of the signature algorithm.

[0007] In a first aspect, the present application provides a hash processing method applied to a digital signature, comprising:

[0008] Use hash function to compress the input string into a short string of fixed length;

[0009] Inputting the fixed-length short string into a pseudo-random generator to obtain a pseudo-random sequence;

[0010] Expand the single-Hamming weight set to obtain a multi-Hamming weight set;

[0011] According to the pseudo-randomness of the pseudo-random sequence, uniform sampling is performed on the multi-Haming weight set, and a challenge vector is output; or, according to the pseudo-randomness of the pseudo-random sequence, non-uniform sampling is performed on the multi-Haming weight set, and a challenge vector is output;

[0012] A digital signature is generated according to the challenge vector.

[0013] In a second aspect, the present application provides a hash processing device applied to a digital signature, comprising:

[0014] A compression module, used to compress an input string into a fixed-length short string using a hash function;

[0015] An input module, used for inputting the fixed-length short string into a pseudo-random generator to obtain a pseudo-random sequence;

[0016] An expansion module, used to expand the single-Hamming weight set to obtain a multi-Hamming weight set;

[0017] a uniform sampling module, configured to perform uniform sampling on the multi-Hamming weight set according to the pseudo-randomness of the pseudo-random sequence, and output a challenge vector; or

[0018] A non-uniform sampling module, configured to perform non-uniform sampling on the multi-Hamming weight set according to the pseudo-randomness of the pseudo-random sequence, and output a challenge vector;

[0019] A generation module is used to generate a digital signature according to the challenge vector.

[0020] The hash processing method, apparatus, device and storage medium for digital signature provided by the present application obtain a pseudo-random sequence by compressing an input string and inputting it into a pseudo-random generator, further utilizing the pseudo-randomness of the pseudo-random sequence to perform uniform sampling or non-uniform sampling on a set of multiple Hamming weights, and selecting an appropriate set B of multiple Hamming weights within a larger range, and selecting an efficiently achievable distribution χ on the set B of multiple Hamming weights within a larger range, so as to reduce the average number of cycles of the signature algorithm without reducing the quantum security strength of the signature algorithm, thereby improving the efficiency of the signature algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0022] Figure 1 The process of the hash processing method applied to the digital signature provided in the embodiment of the present application Figure 1 ;

[0023] Figure 2 The process of the hash processing method applied to the digital signature provided in the embodiment of the present application Figure 2 ;

[0024] Figure 3 A schematic diagram of the structure of a hash processing device for digital signature provided in an embodiment of the present application;

[0025] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0026] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0027] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0028] Terminology explanation:

[0029] Entropy: For any (discrete) random variable X, its entropy is defined as follows:

[0030] H(X)=-∑ x Pr(x)log2 Pr(x),

[0031] Where Pr(x) represents the probability mass function of X.

[0032] q: Let q represent an odd prime number (q ≥ 3).

[0033] ring definition For the modulo q residue class ring, let the representative element be

[0034] for Definition The absolute value of:

[0035]

[0036] Vector c: Let For a definition in k-dimensional column vector on the k ) T represents a row vector (c1, ..., c k ) is the transpose of .

[0037] Matrix A: Let A represent a matrix where each component is in The matrix in .

[0038] Hamming Weight: The element c=(c1,...,c k ) T (in ) is defined as

[0039] Infinity norm: Same as above, The element c=(c1,...,c k ) T The infinity norm of is defined as ||c|| ∞ =max i |c i |.

[0040] Hash Module: A component of the signature algorithm of a digital signature scheme based on the Fiat-Shamir transformation. ★ to a pre-specified finite set Its output is called Challenge, which is usually represented by vector c. When c is regarded as a random variable (determined by the input of the hash module), χ is usually used to represent the distribution on the set B that the random variable c obeys.

[0041] Pseudorandom Generator (PRG): An efficient, deterministic algorithm G that maps a short string s (called a seed) of fixed length n to a "pseudorandom" string of a given longer length l = l(n). Specifically, G satisfies the following two points:

[0042] 1. (Scalability) l(n)>n

[0043] 2. (Pseudo-randomness) For any polynomial-time probabilistic algorithm D, we have

[0044] |Pr[D(G(s))=1]-Pr[D(r)=1]|≤negl(n)

[0045] Here, negl(n) is a function whose value is smaller than the reciprocal of any polynomial function with respect to n. In other words, it is difficult for D to distinguish the output string from a true random string of the same length.

[0046] Even distribution make represents a uniform distribution on a given set B.

[0047] gather make represents the set of all {0, ±1} vectors of length k and with exactly τ non-zero elements, including elements.

[0048] κ: used to characterize the quantum security strength of a security scheme; for example, when κ=128, it means that the security scheme reaches the security strength of 128-qubits.

[0049] Digital signature is an important component of cryptographic technology and an important means to ensure network information security. It is of great significance to study the security and algorithm efficiency of digital signature technology. At present, digital signature technology based on lattice theory can be designed through a variety of paradigms. At present, all digital signature technologies based on standard lattices and using the Fiat-Shamir transformation design paradigm use a hash module in all signature algorithms to achieve hash processing from {0, 1} ★ to a pre-specified finite set The output of the hash module is called Challenge, which is usually represented by c. When the input of the hash module is regarded as a random variable, x is used to represent the distribution of the random variable c on the set. Generally speaking, the implementation of the hash module includes two stages: first, a hash function (such as SHA3-256, SHA3-384) is used to compress the input string into a short string of fixed length (called a seed); then, the seed is used as the input of the pseudorandom generator (PRG), and a uniform distribution is generated on the set B. Sampling and output.

[0050] Taking the standard lattice version of Dilithium as an example, in terms of quantum security strength, in order to achieve the pre-specified quantum security strength level, it is necessary to ensure random distribution. The entropy of cannot be too small. However, if If the entropy increases, the average number of cycles of the signature algorithm in the hash processing of the hash module may increase, making the efficiency of the signature algorithm lower. In terms of efficiency, the average number of cycles of the signature algorithm commonly used by Dilithium is To measure the efficiency of its signature algorithm, β is defined as the upper bound of the Ec infinity norm in the worst case; where E represents A random element in which each component independently obeys uniform distribution on the network, c is the output of the hash module, and it can be considered that it obeys In general, β can be defined to represent the upper bound of the infinite norm of Ec (ignoring 2 -κ In the probability sense), that is

[0051]

[0052] It is not difficult to see And it is positively correlated with the τ value, so reducing the τ value is beneficial to improving the efficiency of the solution.

[0053] In response to the above technical problems, this application proposes the following technical concept: when improving the hash module, by expanding the selection range of set B and the distribution χ thereon, it is possible to improve the efficiency of the signature algorithm without reducing the quantum security strength of the scheme.

[0054] This application is applicable to all digital signature schemes based on standard lattice and obtained by using Fiat-Shamir transformation (such as: Lyu12, BG14, TESLA, Dilithium standard lattice version). A hash module is used in the signature algorithm of such schemes. In the implementation of the hash module, it is necessary to select an appropriate set B and an appropriate distribution χ on B to achieve a balance between the security and efficiency of the scheme. In terms of specific selection, they are similar to the standard lattice version of Dilithium: on the one hand, the set is selected in, It is caused by The coefficient vector belongs to {0, ±1} K , and the set of all elements with Hamming weight τ; on the other hand, χ is chosen to be a uniform distribution on B

[0055] From a practical point of view, when designing a post-quantum digital signature scheme, it is generally necessary to balance the quantum security strength and efficiency of the scheme; among which, the efficiency of the signature algorithm is one of the important indicators of the scheme efficiency. Below, taking the standard lattice version of Dilithium as an example, from the perspective of quantum security strength and signature algorithm efficiency, the impact of the implementation of the hash module on the scheme is analyzed, and a class of improvement methods for the hash module is derived.

[0056] In terms of quantum security, in order to achieve the pre-specified quantum security strength κ, the random distribution

[0057] The entropy of cannot be too small. Therefore, increasing the τ value is beneficial to improving the quantum security strength of the scheme.

[0058] In terms of signature algorithm efficiency, the average number of cycles is often used. To measure the efficiency of its signature algorithm. Among them, the size of the β value directly affects the average number of cycles of the signature algorithm: the larger the β is, the larger the average number of cycles of the signature algorithm is, and the lower the efficiency of the signature algorithm is. In the standard lattice version of Dilithium, β is defined as the upper bound of the infinite norm of Ec in the worst case, that is, β = τη, where, yes The m×k dimensional random matrix on which each component independently obeys uniform distribution on the network; c is the output of the hash module, which can be considered to obey Therefore, reducing the value of τ is beneficial to improving the efficiency of the solution.

[0059] From the above analysis, we can see that in order to achieve a balance between security and efficiency, in the implementation of the hash module, we need to select an appropriate set B and an appropriate distribution χ on B. Among all the known implementations of the hash module of the digital signature scheme based on the standard lattice and using the Fiat-Shamir transformation, we take B as The set of elements with the same Hamming weight in B, where χ is a uniform distribution on B. Based on this, the present application proposes a hash processing method for digital signatures. Under the premise of ensuring that the quantum security strength of the signature algorithm remains unchanged, if the selection range of the set B and the selection range of the distribution χ on B are appropriately expanded, it will be beneficial to improve the efficiency of the signature algorithm.

[0060] Specifically, by selecting an appropriate set B within a larger range, and selecting an efficiently achievable distribution χ on B within a larger range (i.e., not necessarily a uniform distribution ), for example, in the set of multi-Hamming weights uniform sampling on the set of multiple Hamming weights In addition, as a supplement to the above two sampling methods, we can also Generalized efficient uniform sampling on .

[0061] Next, the advantages of the present application are quantitatively explained through examples.

[0062] For example, taking the recommended parameters k=256, τ=49, η=4 for the standard lattice version of Dilithium to reach 128-quantum security strength level (in this case β=τη=196), the following two groups of choices can be used to replace the original B and χ choices:

[0063] (1) Take Let χ be a uniform distribution on B (in this case, β = 193);

[0064] (2) Take Take χ = χ' (in this case, β = 193), where the distribution χ' satisfies:

[0065]

[0066] For the two choices of B and χ, from the perspective of quantum security, they can both increase entropy ((1) increases by 0.16; (2) increases by 0.11), thereby ensuring that the quantum security strength is not reduced; from the perspective of efficiency, they both obviously reduce the β value, thereby improving the efficiency of the signature algorithm.

[0067] It can be understood that the hash processing method for digital signature proposed in this application is applicable to all lattice-based digital signature schemes based on standard lattices and obtained using Fiat-Shamir transformation, such as: standard lattice versions of Lyu12, BG14, TESLA, and Dilithium.

[0068] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0069] An embodiment of the present application provides a hash processing method applied to a digital signature. The executor of the method of this embodiment may be a server. Figure 1 The process of the hash processing method applied to the digital signature provided in the embodiment of the present application Figure 1 .like Figure 1 As shown, the method includes:

[0070] S101. Use a hash function to compress the input string into a short string of fixed length.

[0071] In this embodiment, the hash function is also called a hash function, which is a function that changes an input string of any length into an output string of fixed length. The length of the output string is called the number of bits of the hash function.

[0072] The hash function compresses the message or data into a summary, making the data size smaller and fixing the format of the data, such as the storage of our custom passwords.

[0073] Exemplarily, the hash function may be SHA3-256 or SHA3-384.

[0074] S102, inputting a short string of fixed length into a pseudo-random generator to obtain a pseudo-random sequence.

[0075] In this embodiment, the pseudo-random generator refers to software that can generate random numbers, and can generate a pseudo-random number sequence based on a fixed-length short string (called a "seed") input externally, using a pseudo-random algorithm, for example, a method of calculating a pseudo-random number based on an internal state and a method of changing the internal state are combined, i.e., a pseudo-random algorithm. Specifically, when the pseudo-random generator receives a "seed", the pseudo-random generator will calculate based on the value (internal state) in the memory, and output the calculation result as a pseudo-random number. Furthermore, when the pseudo-random generator receives the next "seed", the pseudo-random generator will change its internal state.

[0076] Optionally, the pseudo-random generator may include a compression function, that is, using a hash function to compress the input string to obtain a "seed", which is not specifically limited in the embodiments of the present application.

[0077] The generated pseudo-random sequence has (pseudo) randomness and is the only source of randomness in the uniform sampling and non-uniform sampling stages on the multi-Hamming weight set in steps S104 and S105.

[0078] S103, expanding the single-Haming weight set to obtain a multi-Haming weight set.

[0079] In one embodiment of the present application, a single Hamming weight set is represented as: represents the set of {0, ±1} vectors of length k and with exactly τ non-zero elements; in this set there are elements.

[0080] Depend on The components belong to {0, ±1} and the k-dimensional column vector with Hamming weight τ, that is,

[0081]

[0082] Vector c=(c1,...,c k ) T The Hamming weight and infinity norm of are defined as with ||c|| ∞ =max i |c i |.

[0083] The multi-Hamming weight set is represented as: B is the Hamming weight set The union of In the formula, k>τ>t≥1.

[0084] S104. According to the pseudo-randomness of the pseudo-random sequence, uniform sampling is performed on the multi-Hamming weight set, and a challenge vector is output.

[0085] In one embodiment of the present application, according to the pseudo-randomness of the pseudo-random sequence, uniform sampling is performed on a multi-Hamming weight set to output a target challenge vector (referred to as Algorithm A1), including:

[0086] Take the probability distribution on the set {τ-t, ..., τ} The probability distribution Assign a value to the preset Hamming weight i so that the value of the preset Hamming weight i satisfies the following formula:

[0087]

[0088] Where k, τ and t are predefined values, τ-t is the minimum Hamming weight, τ is the maximum Hamming weight, and k>τ>t≥1 is satisfied; represents the probability of the preset Hamming weight i, where τ-t≤i≤τ,

[0089] Initialize a k-dimensional vector (c1,...,c k-i , c k-i+1 , ..., c k ) T =(0, ..., 0, 1, ..., 1) T , for c m =c k-i+1 , ..., c k Execute the following loop operations in sequence:

[0090] According to the pseudo-randomness of the pseudo-random sequence, c is uniformly randomly assigned m Assign positive and negative signs and uniformly randomly select the corresponding set {c1,...,c m} Take c j , c j With c m exchange;

[0091] The final output target challenge vector c = (c1, ..., c k ) T ,in, That is, c belongs to a multi-Hamming weight set.

[0092] The beneficial effects of the embodiments of the present application are analyzed by examples as follows: Given parameters (k, τ, t), where k>τ>t≥1. yes Uniform distribution on yes The entropy E(χ1) of χ1 is not less than Entropy

[0093] Proof: According to the definition of entropy, we know that:

[0094]

[0095] So by

[0096]

[0097] The conclusions are: If yes Uniform distribution on yes The entropy E(χ1) of χ1 is not less than Entropy

[0098] It should be noted that, from the above embodiment, since the entropy E(χ1) of χ1 is not less than the random distribution in the Dilithium standard lattice version hash module Entropy Therefore, the quantum security strength of the method provided by this application is not reduced.

[0099] In terms of efficiency, for example, taking the recommended parameters k=256, τ=49, η=4 of the standard lattice version of Dilithium as an example, β=196 is obtained at this time; in the present application, when t=1, β=193 is obtained, so the implementation efficiency of the signature algorithm of the present application is better than that of the standard lattice version of Dilithium.

[0100] Given parameters (k, τ, t), where k>τ>t≥1, the output target challenge vector c of the above algorithm A1 is (c1, ..., c k ) T Subordinate to multi-Hamming weight set The uniform distribution on is shown as follows:

[0101] Take c∈B arbitrarily, and record h=||c||1. Then the probability of algorithm A1 outputting c is

[0102]

[0103] So we can conclude that the output of the above signature algorithm A1 obeys Uniform distribution on

[0104] In one embodiment of the present application, according to the pseudo-randomness of the pseudo-random sequence, uniform sampling is performed on a multi-Hamming weight set to output a target challenge vector (referred to as Algorithm A2), including:

[0105] In each set of {0, ±1} column vectors of length t and Hamming weight h In each case, we select a vector x h =(x1, x2, ..., x t ) T As a representative element;

[0106] According to the pseudo-randomness of the pseudo-random sequence, a (k+t)-dimensional {0, ±1} vector c=(c1,...,c k+t ) T ;

[0107] The vector c=(c1,...,c k+t ) T According to t-tuple The corresponding position is split into a t-dimensional vector x′ and a k-dimensional vector c′, where x′=(x′1, x′2, ..., x′ t ) T and c′=(c1′, ..., c k ′) T , specifically, from (c1, ..., c k+t ) T Take the t elements whose indices are in I and arrange them into vector x′ in the original order, and the remaining k elements whose indices are not in I are arranged into vector c′ in the original order;

[0108] According to the Hamming weight h of the t-dimensional vector x′, we can judge whether the t-dimensional vector x′ is related to the representative element x h whether they are equal;

[0109] If they are not equal, start from the beginning and, based on the pseudo-randomness of the pseudo-random sequence, uniformly randomly select a (k+t)-dimensional {0, ±1} vector c=(c1, ..., c k+t ) T ;

[0110] If they are equal, then the target challenge vector c=c′=(c1′, ..., c k ′) T .

[0111] The beneficial effects of the embodiments of the present application are analyzed by examples as follows:

[0112] Quantum security strength: Taking the recommended parameters k=256, τ=49, η=4 of the standard lattice version of Dilithium as an example, in the corresponding hash module, the random distribution The entropy of In this application, t=1, the entropy of the random distribution χ2 is E(χ2)=225.46. Therefore, the use of the method of this application will not reduce the quantum security strength of the signature scheme. The larger the entropy, the more stable the system, that is, the more secure the scheme.

[0113] Efficiency: Taking the Dilithium standard lattice version recommended parameters k=256, τ=49, η=4 as an example, β=196 at this time; in this application, when t=1, β=193, so the efficiency achieved by the method of this application is better than that of the Dilithium standard lattice version.

[0114] Given parameters (k, τ, t), where k>τ>t≥1, Algorithm A2 outputs a target challenge vector c=(c1, ..., c k ) T Subordinate to multi-Hamming weight set The uniform distribution on is shown as follows:

[0115] because:

[0116]

[0117] again

[0118]

[0119] So for any c∈B, the probability of outputting c is:

[0120]

[0121] So we can conclude that the output of the above signature algorithm A2 obeys Uniform distribution on

[0122] S105. Perform non-uniform sampling on a multi-Hamming weight set according to a pseudo-random sequence and output a challenge vector.

[0123] In one embodiment of the present application, according to the pseudo-randomness of the pseudo-random sequence, non-uniform sampling is performed on a multi-Hamming weight set to output a target challenge vector (referred to as Algorithm B), including:

[0124] Initialize a k+t-dimensional vector (c1,...,c k+t-τ , c k+t-τ+1 , ..., c k+t ) T ;

[0125] For i=k+t-τ+1, ..., k+t, the following operations are performed in sequence:

[0126] According to the pseudo-randomness of the pseudo-random sequence, a value is uniformly distributed on the set {1, ..., i} and assigned to j;

[0127] Again, according to the pseudo-randomness of the pseudo-random sequence, c is uniformly randomly assigned i Assign positive and negative signs;

[0128] Swap c i The value of c j The value of

[0129] The final output target challenge vector c = (c1, ..., c k ) T ,in, That is, c belongs to a multi-Hamming weight set;

[0130] Among them, the target challenge vector c satisfies:

[0131] For τ-t≤i≤τ, if but

[0132] Where k, τ and t are predefined values, τ-t is the minimum Hamming weight, τ is the maximum Hamming weight, and k>τ>t≥1 is satisfied; represents the probability of obtaining the target challenge vector c, i is the Hamming weight of c, and satisfies 0≤τ-i≤t,

[0133] The beneficial effects of the embodiments of the present application are analyzed by examples as follows:

[0134] Given parameters (k, τ, t), where k>τ>t≥1, algorithm B outputs the target challenge vector c=(c1, ..., c k ) T obey The distribution χ2 on satisfies: for τ-t≤i≤τ, if but

[0135] The proof is as follows:

[0136] Any The probability of outputting c is:

[0137]

[0138] So we can conclude that the output of the above signature algorithm B obeys Uniform distribution on

[0139] S106. Generate a digital signature according to the challenge vector.

[0140] In one embodiment of the present application, according to the target challenge vector, a digital signature is generated from the target challenge vector using public and private keys.

[0141] The hash processing method for digital signature proposed in this application is applicable to all lattice-based digital signature schemes based on standard lattices and obtained using Fiat-Shamir transformation, such as standard lattice versions of Lyu12, BG14, TESLA, and Dilithium.

[0142] In summary, the hash processing method for digital signature provided in this embodiment obtains a pseudo-random sequence by compressing the input string and inputting it into a pseudo-random generator, further utilizes the pseudo-randomness of the pseudo-random sequence, performs uniform sampling or non-uniform sampling on a set of multiple Hamming weights, and selects an appropriate set B of multiple Hamming weights within a larger range, and selects an efficiently achievable distribution χ on the set B of multiple Hamming weights within a larger range, so as to achieve the purpose of reducing the average number of cycles of the signature algorithm without reducing the quantum security strength of the signature algorithm, thereby improving the efficiency of the signature algorithm.

[0143] Figure 2 The process of the hash processing method applied to the digital signature provided in the embodiment of the present application Figure 2 .like Figure 2 As shown, the hash processing method applied to digital signature includes the following steps:

[0144] S201. Use a hash function to compress the input string into a short string of fixed length.

[0145] This step is the same as step S101 and will not be described again here.

[0146] S202: Input a short string of fixed length into a pseudo-random generator to obtain a pseudo-random sequence.

[0147] This step is the same as step S102 and will not be described again here.

[0148] S203. According to the pseudo-randomness of the pseudo-random sequence, uniform sampling is performed on the single Hamming weight set, and a target challenge vector is output.

[0149] In one embodiment of the present application, according to the pseudo-randomness of the pseudo-random sequence, uniform sampling is performed on a single Hamming weight set to output a target challenge vector (referred to as Algorithm C), which specifically includes:

[0150] Pick a replacement

[0151] Take an s-dimensional initial vector c = (c1, ...c s-μ ..., c s ), where the first s-μ dimensional component of the initial vector c is 0, the last μ dimensional component is 1, s>μ≥1;

[0152] Sequentially take i=σ(1), ..., σ(μ), and execute the μ-cycle on the initial vector c. The execution order of the μ-cycle is arbitrary according to different methods of permuting σ, and specifically includes:

[0153] For i = σ(1), ..., σ(μ), in the set {1, ..., i+s-μ}, according to the pseudo-randomness of the pseudo-random sequence, a value is taken from a uniform distribution and assigned to j;

[0154] c i+s-μ The value of c j Swap the values ​​of ;

[0155] Then, m=1, ..., s are taken in turn, and s rounds of loops are performed on the transformed vector c, specifically including:

[0156] According to the pseudo-randomness of the pseudo-random sequence, the non-zero element c is uniformly randomly set iThe positive and negative signs of

[0157] The final output target challenge vector c = (c1, ..., c s ) T ,in, That is, c belongs to the set of single Hamming weight.

[0158] The beneficial effects of the embodiments of the present application are analyzed by examples as follows:

[0159] Given parameters (s, μ), where s>μ≥1, the above algorithm C outputs the target challenge vector c=(c1, ..., c s ) T obey Uniform distribution on

[0160] Proof: Order represents the set of all {0, 1} vectors of length s and with exactly μ non-zero elements, including elements.

[0161] For a given permutation on {1, ..., μ} The corresponding μ-step sampling algorithm is called algorithm-σ. If the outputs of algorithm-σ and algorithm-σ′ obey the same distribution, we can simply write algorithm-σ≈algorithm-σ′. First, we prove that for the simplified algorithm C2 (the only difference from algorithm C is that there is no second uniform random sign assignment cycle), it obeys Uniform distribution on The algorithm involved in the proof of the lemma below also refers to the simplified algorithm C2.

[0162] Let us first prove a lemma.

[0163] Backward Commutation Lemma: For any permutation σ on {1, ..., μ}, if there exists k∈[1, μ-1] such that σ(k)=μ (i.e. ).

[0164] make Then, the outputs of algorithm-σ and algorithm-σ′ obey the same distribution.

[0165] Because the specific operations of the two algorithms are exactly the same in the first (k-1) step and the last (μ-k-1) step loop, the following mainly analyzes the related situations of the two algorithms after the kth step and the (k+1th step. Specifically, we want to prove that for any vector After the first (k+1) steps, the two algorithms can obtain this vector The probabilities of obtaining different vectors may be equal (note: the probabilities of obtaining different vectors may be different).

[0166] Consider two sets of transposed products (corresponding to the composition of the kth and (k+1)th steps in the σ and σ′ algorithms, respectively):

[0167] P σ ={(im)(js)|1≤i≤m<s, 1≤j≤s} and

[0168] P σ′ ={(js)(im)|1≤i≤m<s, 1≤j≤s}.

[0169] Here, μ corresponds to s = (s-μ) + μ, and σ(k+1) corresponds to m = (s-μ) + σ(k+1). When the two swaps (im) and (js) are disjoint, i.e., i, j, m, s are not equal to each other, (im)(js) = (js)(im). We only need to consider the case where the two swaps intersect: in P σ In P, there are two types of intersections: (rm)(rs)(1≤r≤m<s) and (rm)(ms)(1≤r<m<s); σ′ There are two intersecting cases: (rs)(rm)(1≤r≤m<s) and (ms)(rm)(1≤r<m<s). Note that (rm)(rs)=(ms)(rm), (rm)(ms)=(rs)(rm), and exclude the special case when r=m, (rm)(rs)=(rs)(rm), we can get P σ =P σ′ Then, for any possible vector After the same first (k-1) steps, and then the kth step and the (k+1th step respectively, the two algorithms obtain The probabilities of When the value is different, the probability of obtaining it may also be different). And because the next (μ-k-1) steps are also the same, the above lemma is proved.

[0170] Using the backward commutation lemma above, we can find that for and (Here the last digit of σ1 is fixed, that is, in the loop, (s-μ)+μ=s will not appear until the last step), algorithm-σ≈algorithm-σ1. Consider again (here the last two bits are fixed), ..., σ μ =id, and repeatedly using the lemma, we can get:

[0171] Algorithm-σ≈algorithm-σ1≈algorithm-σ2≈…≈algorithm-σ μ (=algorithm-id).

[0172] It is also known that the output of algorithm-id (i.e. the original positive order swap sampling) obeys If , then the algorithm -σ is also uniformly distributed on .

[0173] Finally, consider the output of algorithm C. And remember the corresponding The element in is c0, then the probability of algorithm C outputting c is:

[0174]

[0175] So we can conclude that the output of the above signature algorithm C obeys Uniform distribution on .

[0176] Algorithm C has a wide range of applications in this application. For example, the algorithm can be called in the standard lattice version of Dilithium, where s=k, μ=τ; the algorithm can be called in algorithm A1, where s=k, μ=i; the algorithm can also be called in algorithm A2 and algorithm B, where s=k+t, μ=τ.

[0177] S204: Generate a digital signature according to the challenge vector.

[0178] This step is the same as step S106 and will not be described again here.

[0179] In summary, the hash processing method for digital signature provided in this embodiment obtains a pseudo-random sequence by compressing the input string and inputting it into a pseudo-random generator, and further utilizes the pseudo-randomness of the pseudo-random sequence to perform more generalized efficient uniform sampling on a set of single Hamming weights without reducing the quantum security strength of the signature algorithm.

[0180] Figure 3 This is a schematic diagram of the structure of a hash processing device for digital signature provided in an embodiment of the present application. Figure 3 As shown, the hash processing device applied to digital signature includes: a compression module 301, an input module 302, an expansion module 303, a uniform sampling module 304, a non-uniform sampling module 305 and a generation module 306;

[0181] The compression module 301 is used to compress the input string into a fixed-length short string using a hash function;

[0182] An input module 302 is used to input a fixed-length short string into a pseudo-random generator to obtain a pseudo-random sequence;

[0183] An expansion module 303 is used to expand the single Hamming weight set to obtain a multi-Hamming weight set;

[0184] The uniform sampling module 304 is used to perform uniform sampling on the multi-Hamming weight set according to the pseudo-randomness of the pseudo-random sequence and output a challenge vector; or,

[0185] A non-uniform sampling module 305, configured to perform non-uniform sampling on a multi-Hamming weight set according to the pseudo-randomness of the pseudo-random sequence, and output a challenge vector;

[0186] The generating module 306 is used to generate a digital signature based on the challenge vector.

[0187] In one embodiment of the present application, the uniform sampling module 304 is specifically used for:

[0188] Take the probability distribution on the set {τ-t, ..., τ} The probability distribution Assign a value to the preset Hamming weight i so that the value of the preset Hamming weight i satisfies the following formula:

[0189]

[0190] Where k, τ and t are predefined values, τ-t is the minimum Hamming weight, τ is the maximum Hamming weight, and k>τ>t≥1 is satisfied; represents the probability of the preset Hamming weight i, where τ-t≤i≤τ,

[0191] Initialize a k-dimensional vector (c1,...,c k-τ+i , c k-τ+i+1 , ..., c k ) T =(0, ..., 0, 1, ..., 1) T , for c m =c k-i+1 , ..., c k Perform the following operations in sequence:

[0192] According to the pseudo-randomness of the pseudo-random sequence, c is uniformly randomly assigned m Assign positive and negative signs uniformly and randomly in the corresponding set {c1,...,c m} Take c j , c j With c m Exchange, output target challenge vector c = (c1, ..., c k ) T ,in, That is, c belongs to a multi-Haming weight set.

[0193] In one embodiment of the present application, the uniform sampling module 304 is further specifically configured to:

[0194] In each set of {0, ±1} column vectors of length t and Hamming weight h In each case, we select a vector x h =(x1, x2, ..., x t ) T As a representative element;

[0195] According to the pseudo-randomness of the pseudo-random sequence, a (k+t)-dimensional {0, ±1} vector c=(c1,...,c k+t ) T ;

[0196] The vector c=(c1,...,c k+t ) T According to t-tuple The corresponding position is split into a t-dimensional vector X′ and a k-dimensional vector c′, where x′=(x′1, x′2, ..., x′ t ) T and c′=(c1′, ..., c k ′) T , that is, from (c1, ..., c k+t ) T Take the t elements whose indices are in I and arrange them into vector c in the original order t , and take the remaining k elements whose indices are not in I and arrange them into vector c′ in the original order;

[0197] According to the Hamming weight h of the t-dimensional vector x′, we can judge whether the t-dimensional vector x′ is related to the representative element x h whether they are equal;

[0198] If they are not equal, start from the beginning and, based on the pseudo-randomness of the pseudo-random sequence, uniformly randomly select a (k+t)-dimensional {0, ±1} vector c=(c1, ..., c k+t ) T , continue with the above operations;

[0199] If they are equal, then the target challenge vector c=c′=(c1′, ..., c k ′) T ,in, That is, c belongs to a multi-Hamming weight set.

[0200] In one embodiment of the present application, the non-uniform sampling module 305 is specifically used for:

[0201] Initialize a k+t-dimensional vector (c1,...,c k+t-τ , c k+t-τ+1, ..., c k+t ) T ;

[0202] For i=k+t-τ+1, ..., k+t, the following operations are performed in sequence:

[0203] According to the pseudo-randomness of the pseudo-random sequence, a value is uniformly distributed on the set {1, ..., i} and assigned to j;

[0204] Again, according to the pseudo-randomness of the pseudo-random sequence, c is uniformly randomly assigned i Assign positive and negative signs;

[0205] Swap c i The value of c j The value of

[0206] Output target challenge vector c = (c1, ..., c k ) T ,in, That is, c belongs to a multi-Hamming weight set;

[0207] Among them, the target challenge vector c satisfies:

[0208] For τ-t≤i≤τ, if but

[0209] Where k, τ and t are predefined values, τ-t is the minimum Hamming weight, τ is the maximum Hamming weight, and k>τ>t≥1 is satisfied; represents the probability of the target challenge vector c, τ-i is the Hamming weight of c, satisfying 0≤τ-i≤t,

[0210] In one implementation of the present application, the hash processing device applied to digital signature further includes: a second uniform sampling module 307;

[0211] The second uniform sampling module 307 is used to perform uniform sampling on a single Hamming weight set according to the pseudo-randomness of the pseudo-random sequence, and output a target challenge vector.

[0212] Optionally, the second uniform sampling module 307 is specifically used to: determine a replacement

[0213] Take an s-dimensional initial vector c = (c1, ...c s-μ ..., c s ), where the first s-μ dimensional component of the initial vector c is 0, the last μ dimensional component is 1, s>μ≥1;

[0214] Sequentially take i=σ(1), ..., σ(μ), and execute the μ-cycle on the initial vector c. The execution order of the μ-cycle is arbitrary according to different methods of permuting σ, and specifically includes:

[0215] For i = σ(1), ..., σ(μ), in the set {1, ..., i+s-μ}, according to the pseudo-randomness of the pseudo-random sequence, a value is taken from a uniform distribution and assigned to j;

[0216] c i+s-μ The value of c j Swap the values ​​of ;

[0217] Then, m=1, ..., s are taken in turn, and s rounds of loops are performed on the transformed vector c, specifically including:

[0218] According to the pseudo-randomness of the pseudo-random sequence, the non-zero element c is uniformly randomly set i The positive and negative signs of

[0219] Output target challenge vector c = (c1, ..., c s ) T ,in, That is, c belongs to the set of single Hamming weight.

[0220] In one implementation of the present application, the generation module 306 is specifically configured to generate a digital signature from the target challenge vector using public and private keys according to the target challenge vector.

[0221] The hash processing device for digital signature provided in the embodiment of the present application can be used to execute the technical solution of the hash processing method for digital signature in the above embodiment. Its implementation principle and technical effect are similar and will not be repeated here.

[0222] It should be noted that it should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software calling through processing elements; they can also be all implemented in the form of hardware; some modules can also be implemented in the form of software calling through processing elements, and some modules can be implemented in the form of hardware. In addition, all or part of these modules can be integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0223] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 4As shown, the electronic device may include: a transceiver 401 , a processor 402 , and a memory 403 .

[0224] The processor 402 executes the computer execution instructions stored in the memory, so that the processor 402 executes the scheme in the above embodiment. The processor 402 can be a general-purpose processor, including a central processing unit CPU, a network processor (network processor, NP), etc.; it can also be a digital signal processor DSP, an application-specific integrated circuit ASIC, a field programmable gate array FPGA or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0225] The memory 403 is connected to the processor 402 via a system bus and completes communication between them. The memory 403 is used to store computer program instructions.

[0226] The transceiver 401 may be used to obtain tasks to be executed and configuration information of the tasks to be executed.

[0227] The system bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The system bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The transceiver is used to realize the communication between the database access device and other computers (such as clients, read-write libraries, and read-only libraries). The memory may include random access memory (RAM) and may also include non-volatile memory.

[0228] An embodiment of the present application also provides a chip for running instructions, which is used to execute the technical solution of the hash processing method applied to digital signatures in the above embodiments.

[0229] An embodiment of the present application also provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed on a computer, the computer executes the technical solution of the hash processing method applied to digital signatures in the above embodiment.

[0230] An embodiment of the present application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium. When at least one processor executes the computer program, it can implement the technical solution of the hash processing method applied to digital signatures in the above embodiments.

[0231] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0232] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A hash processing method applied to digital signature, characterized in that: include: Use hash function to compress the input string into a short string of fixed length; Inputting the fixed-length short string into a pseudo-random generator to obtain a pseudo-random sequence; Expand the single-Hamming weight set to obtain a multi-Hamming weight set; According to the pseudo-randomness of the pseudo-random sequence, uniform sampling is performed on the multi-Haming weight set, and a target challenge vector is output; or, according to the pseudo-randomness of the pseudo-random sequence, non-uniform sampling is performed on the multi-Haming weight set, and a target challenge vector is output; generating a digital signature according to the target challenge vector; The step of performing uniform sampling on the multi-Hamming weight set according to the pseudo-randomness of the pseudo-random sequence and outputting a target challenge vector includes: Take the probability distribution on the set {τ-t,…,τ} The probability distribution Assign a value to the preset Hamming weight i so that the value of the preset Hamming weight i satisfies the following formula: Where k, τ and t are predefined values, τ-t is the minimum Hamming weight, τ is the maximum Hamming weight, and k>τ>t≥1 is satisfied; represents the probability of the preset Hamming weight i, where τ-t≤i≤τ, Initialize a k-dimensional vector (c1,…,c k-i ,c k-i+1 ,…,c k ) T =(0,…,0,1,…1) T , for c m =c k-i+1 ,…,c k Execute the following loop operations in sequence: According to the pseudo-randomness of the pseudo-random sequence, c is uniformly randomly assigned m Assign positive and negative signs and uniformly randomly select the corresponding set {c1,…,c m } Take c j , c j With c m exchange; The final output target challenge vector c = (c1,…,c k ) T ,in, That is, c belongs to a multi-Hamming weight set; or, In each set of {0,±1} column vectors of length t and Hamming weight h In each case, we select a vector x h =(x1,x2,...,x t ) T As a representative element; According to the pseudo-randomness of the pseudo-random sequence, a (k+t)-dimensional {0,±1} vector c=(c1,…,c k+t ) T ; The vector c=(c1,…,c k+t ) T According to t-tuple The corresponding position is split into a t-dimensional vector x′ and a k-dimensional vector c′, where x′=(x′1,x′2,...,x′ t ) T ,c′=(c1′,…,c k ′) T , specifically, from (c1,…,c k+t ) T Take the t elements whose indices are in I and arrange them into vector x′ in the original order, and the remaining k elements whose indices are not in I are arranged into vector c′ in the original order; According to the Hamming weight h of the t-dimensional vector x′, it is determined whether the t-dimensional vector x′ is related to the representative element x h whether they are equal; If they are not equal, start from the beginning and uniformly randomly select a (k+t)-dimensional {0,±1} vector c=(c1,…,c k+t ) T , continue with the above operations; If they are equal, then the target challenge vector c = c′ = (c1′,…,c k ′) T ,in, That is, c belongs to a multi-Hamming weight set.

2. The method according to claim 1, characterized in that The single-Hamming weight set is expanded to obtain a multi-Hamming weight set, including: Expand the single-Hamming weight set to obtain a multi-Hamming weight set; Wherein, the single Hamming weight set is expressed as: represents the set of {0,±1} vectors of length k and exactly τ non-zero elements; The multi-Hamming weight set is represented as: B, is the Hamming weight set The union of In the formula, k>τ>t≥1.

3. The method according to claim 2, characterized in that The step of performing non-uniform sampling on the multi-Hamming weight set according to the pseudo-randomness of the pseudo-random sequence and outputting a target challenge vector includes: Initialize a k+t-dimensional vector (c1,…,c k+t-τ ,c k+t-τ+1 ,...,c k+t ) T ; For i=k+t-τ+1,...,k+t, the following operations are performed in sequence: According to the pseudo-randomness of the pseudo-random sequence, a value is taken from the set {1,…,i} according to a uniform distribution, assigned to j, and a uniform random value is assigned to c i Assign positive and negative signs; Swap c i The value of c j The value of Output target challenge vector c = (c1,…,c k ) T ,in, That is, c belongs to a multi-Hamming weight set; Among them, the target challenge vector c satisfies: For τ-t≤i≤τ, if but Where k, τ and t are predefined values, τ-t is the minimum Hamming weight, τ is the maximum Hamming weight, and k>τ>t≥1 is satisfied; represents the probability of obtaining the target challenge vector c, i is the Hamming weight of c, and satisfies 0≤τ-i≤t, 4. The method according to claim 1, characterized in that: Also includes: According to the pseudo-randomness of the pseudo-random sequence, uniform sampling is performed on the single Hamming weight set to output a target challenge vector.

5. The method according to claim 4, characterized in that The step of uniformly sampling the single Hamming weight set according to the pseudo-randomness of the pseudo-random sequence and outputting a target challenge vector comprises: Pick a replacement Take an s-dimensional initial vector c=(c1,…c s-μ …,c s ), where the first s-μ dimensional component of the initial vector c is 0, the last μ dimensional component is 1, s>μ≥1; Sequentially take i = σ(1), ..., σ(μ) and execute the μ-cycle on the initial vector c. The execution order of the μ-cycle is arbitrary according to different permutations of σ, including: For i=σ(1),…,σ(μ), in the set {1,…,i+s-μ}, according to the pseudo-randomness of the pseudo-random sequence, a value is taken according to a uniform distribution and assigned to j; c i+s-μ The value of c j Swap the values ​​of ; Then take m=1,…,s in turn and perform s rounds of loops on the transformed vector c, specifically including: According to the pseudo-randomness of the pseudo-random sequence, the non-zero element c is uniformly randomly set i The positive and negative signs of The final output target challenge vector c = (c1,…,c s ) T ,in, That is, c belongs to the set of single Hamming weight.

6. The method according to any one of claims 1 to 5, characterized in that: The generating a digital signature according to the target challenge vector comprises: According to the target challenge vector, a digital signature is generated from the target challenge vector using public and private keys.

7. A hash processing device applied to digital signature, characterized in that: include: A compression module, used to compress an input string into a fixed-length short string using a hash function; An input module, used for inputting the fixed-length short string into a pseudo-random generator to obtain a pseudo-random sequence; An expansion module, used to expand the single-Hamming weight set to obtain a multi-Hamming weight set; a uniform sampling module, configured to perform uniform sampling on the multi-Hamming weight set according to the pseudo-randomness of the pseudo-random sequence, and output a challenge vector; or A non-uniform sampling module, configured to perform non-uniform sampling on the multi-Hamming weight set according to the pseudo-randomness of the pseudo-random sequence, and output a challenge vector; A generating module, used to generate a digital signature according to the challenge vector; Wherein, the uniform sampling module is specifically used for: Take the probability distribution on the set {τ-t,…,τ} The probability distribution Assign a value to the preset Hamming weight i so that the value of the preset Hamming weight i satisfies the following formula: Where k, τ and t are predefined values, τ-t is the minimum Hamming weight, τ is the maximum Hamming weight, and k>τ>t≥1 is satisfied; represents the probability of the preset Hamming weight i, where τ-t≤i≤τ, Initialize a k-dimensional vector (c1,…,c k-i ,c k-i+1 ,…,c k ) T =(0,…,0,1,…1) T , for c m =c k-i+1 ,…,c k Execute the following loop operations in sequence: According to the pseudo-randomness of the pseudo-random sequence, c is uniformly randomly assigned m Assign positive and negative signs and uniformly randomly select the corresponding set {c1,…,c m } Take c j , c j With c m exchange; The final output target challenge vector c = (c1,…,c k ) T ,in, That is, c belongs to a multi-Hamming weight set; or, In each set of {0,±1} column vectors of length t and Hamming weight h In each case, we select a vector x h =(x1,x2,...,x t ) T As a representative element; According to the pseudo-randomness of the pseudo-random sequence, a (k+t)-dimensional {0,±1} vector c=(c1,…,c k+t ) T ; The vector c=(c1,…,c k+t ) T According to t-tuple The corresponding position is split into a t-dimensional vector x′ and a k-dimensional vector c′, where x′=(x′1,x′2,...,x′ t ) T ,c′=(c1′,…,c k ′) T , specifically, from (c1,…,c k+t ) T Take the t elements whose indices are in I and arrange them into vector x′ in the original order, and the remaining k elements whose indices are not in I are arranged into vector c′ in the original order; According to the Hamming weight h of the t-dimensional vector x′, it is determined whether the t-dimensional vector x′ is related to the representative element x h whether they are equal; If they are not equal, start from the beginning and uniformly randomly select a (k+t)-dimensional {0,±1} vector c=(c1,…,c k+t ) T , continue with the above operations; If they are equal, then the target challenge vector c = c′ = (c1′,…,c k ′) T ,in, That is, c belongs to a multi-Hamming weight set.

8. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images