A method and system for generating and verifying SM9 group signatures supporting membership revocation

Abstract

This invention discloses a method and system for generating and verifying SM9 group signatures that supports membership revocation. The method includes operations such as setting public parameters, user registration, group signature generation, signature verification, user revocation, evidence update, and list retrieval. Based on the signature structure of the SM9 digital signature algorithm, the invention eliminates the certificate management issues in traditional public key cryptography systems. It supports the revocation of group signature membership, and changes in group members do not affect the verification of previous group signatures. The length of the group signature is independent of the number of group members. This solution fills a gap in the field of group signatures based on the SM9 commercial cryptography system and can be used in application scenarios such as anonymous credentials, identity hosting, voting, and electronic cash.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology and relates to an SM9 group signature generation and verification method and system, and specifically relates to an SM9 group signature generation and verification method and system that supports membership revocation. Background Art

[0002] First proposed by Chaum and Van Heyst, group signatures allow group members to sign messages on behalf of the group without revealing their actual signatory identity or allowing the signature value to be linked to other signatures verifiable with the same public key. The participants in a group signature scheme are a set of group members and a group administrator. The group administrator's role is to register new users by issuing membership certificates containing registration details and, in the event of a dispute over a signed message, to revoke the anonymity of the signed message by "opening" the signature. Group signatures are one of the most important cryptographic primitives for providing privacy and have been used in applications such as anonymous credentials, identity custody, voting, and electronic cash.

[0003] Traditional digital signature technology requires a third-party certificate authority (CA) to issue a public key certificate to prove the trusted binding relationship between the public key and the identity. However, this leads to complex certificate management issues when the number of users is large. To address this issue, Shamir proposed an identity-based public key cryptography system, in which the user identity serves as the public key, and the user's private key is generated by a private key generator (PKG) based on the user identity. Park et al. first proposed an identity-based group signature scheme, but this scheme has serious problems. If the group changes, all previous group signatures signed by other members will become invalid, and the length of the group signature depends on the number of group members.

[0004] The SM9 identification cryptography algorithm is a cryptography standard (GM / T 0044-2016SM9) issued by the State Cryptography Administration on March 28, 2016. It primarily comprises three components: a digital signature algorithm, a public-key encryption algorithm, and a key exchange protocol. The SM9 standard meets the needs of applications such as electronic authentication service systems and fills a gap in domestic identification cryptography systems. However, a group signature scheme based on the SM9 identification cryptography algorithm has yet to be proposed. Consequently, application systems requiring adaptation to national cryptography algorithms lack the foundational components of this functional signature cryptography algorithm. Summary of the Invention

[0005] In order to solve the above technical problems, the present invention proposes an SM9 group signature generation and verification method and system that supports membership revocation.

[0006] The technical solution adopted by the method of the present invention is: an SM9 group signature generation and verification method supporting membership revocation, comprising the following steps:

[0007] Step 1: Set the common parameters Params = (λ, P1, P2, P pub ,G1,G2,G3,V0,Arc,Reg); where λ is the security parameter, N-order cyclic subgroup and its generator P1, N-order cyclic subgroup and its generator P2, Random selection As the group owner key, calculate the group owner public key P pub =[d]P2; the public list Arc consists of three parts: user identification hash value, user registration status, and current accumulator value, denoted as (H(ID i ),b,V i+1 ), b is 1 to add registered user H(ID i ), b is 0 to log out user H(ID i ); Random selection The accumulator value is initialized to V0 = [u] P1; the public list Reg stores the registered user ID hash value H (ID i ) and its [H(ID i )]P2; cryptographic hash function is the set of integers consisting of 1, 2, ..., q-1, where q is a large prime number; there are j entries in the public list Arc;

[0008] Step 2: User registration;

[0009] Users communicate with group administrators through a registration protocol. There are multiple users, each with a unique ID, and a trusted group administrator. Communication between users and group administrators is private and authenticated. After successful registration, users become authorized members of the group. The output of the member is a member certificate and a member secret.

[0010] Step 3: Group signature, output signature σ of m; where m is the message to be signed;

[0011] Among them, the group owner’s public key P pub Hash value x for user i i Perform Elgamal encryption and obtain C=(C1,C2), C1=[r]P2, C2=[x i ]P2+[r]P pub ; r represents the random number selected by the Elgamal encryption algorithm;

[0012] Step 4: Verify the signature;

[0013] The verifier uses the group public key to verify whether the signature value σ is valid; if it is valid, the group master key d is used to decrypt C, that is, [x * ]P H = C2-[d]C1; Search the current public list Reg and find the corresponding user identity H (ID * ).

[0014] The technical solution adopted by the system of the present invention is: an SM9 group signature generation and verification system that supports membership revocation, including the following modules:

[0015] Module 1, set initialization common parameters Params = (λ, P1, P2, P pub ,G1,G2,G3,V0,Arc,Reg); where λ is the security parameter, N-order cyclic subgroup and its generator P1, N-order cyclic subgroup and its generator P2, Random selection As the group owner key, calculate the group owner public key P pub =[d]P2; the public list Arc consists of three parts: user identification hash value, user registration status, and current accumulator value, denoted as (H(ID i ),b,V i+1 ), b is 1 to add registered user H(ID i ), b is 0 to log out user H(ID i ); Random selection The accumulator value is initialized to V0 = [u] P1; the public list Reg stores the registered user ID hash value H (ID i ) and its [H(ID i )]P2; cryptographic hash function H(·): is the set of integers consisting of 1, 2, ..., q-1, where q is a large prime number; there are j entries in the public list Arc;

[0016] Module 2, for user registration;

[0017] Users communicate with group administrators through a registration protocol. There are multiple users, each with a unique ID, and a trusted group administrator. Communication between users and group administrators is private and authenticated. After successful registration, users become authorized members of the group. The output of the member is a member certificate and a member secret.

[0018] Module 3, used for group signature, outputs the signature σ of m, where m is the message to be signed;

[0019] Among them, the group owner’s public key Ppub Hash value x for user i i Perform Elgamal encryption and obtain C=(C1,C2), C1=[r]P2, C2=[x i ]P2+[r]P pub ; r represents the random number selected by the Elgamal encryption algorithm;

[0020] Module 4, for verifying signatures;

[0021] The verifier uses the group public key to verify whether the signature value σ is valid; if it is valid, the group master key d is used to decrypt C, that is, [x * ]P2=C2-[d]C1;Search the current public list Reg and find the corresponding user identity H(ID * ).

[0022] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0023] 1. Traditional digital signature technology requires a third-party certificate authority (CA) to issue a public key certificate to prove the trusted binding relationship between the public key and the identity. However, this leads to complex certificate management issues when the user base is large. To solve this problem, the solution of the present invention is based on an identity cryptography system.

[0024] 2. Existing literature has proposed identity-based group signature schemes, but these schemes have serious problems. If the group changes, all previous group signatures signed by other members will become invalid, and the length of the group signature depends on the number of group members. The scheme of the present invention supports the revocation of group signature membership. Changes in group members do not affect the verification of previous group signatures, and the length of the group signature is independent of the number of group members.

[0025] 3. There is no group signature scheme based on the national secret SM9 signature algorithm. The scheme of the present invention fills the gap in the group signature field based on the SM9 commercial cryptographic system. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 Flowchart of a method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to facilitate ordinary technicians in this field to understand and implement the present invention, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention and are not used to limit the present invention.

[0028] The group signature scheme of the present invention involves a group of group members and a trusted group administrator, each of whom has a unique identity ID. There are two public lists Arc and Reg. The public list Reg records the history of public information that needs to be updated. Each time a group member is added or deleted, the group administrator needs to add new information to Reg. The group administrator uses the Revoke algorithm to delete a specified member from the group by updating Arc. In addition to the unchanging member key, each group member also retains a member proof. Based on the information in Arc, each group member can update the member proof. Any party can run the CheckList algorithm after each change to the public list to check whether the group administrator has correctly updated Arc. The present invention assumes that Arc is always updated correctly.

[0029] To ensure universality, the parameters selected in this patent are consistent with the standard parameters of the SM9 digital signature algorithm. The specific symbols are described as follows:

[0030] q: a large prime number.

[0031] The set of integers consisting of 1, 2, ..., q-1.

[0032] An additive cyclic group of order N.

[0033] Multiplicative cyclic group of order N.

[0034] P1, P2: groups and The generator of .

[0035] G1, G2, G3: groups elements.

[0036] g u : Multiplication group The element g in is raised to the power u.

[0037] λ: safety parameter.

[0038] [k]P: The point k times the point P on the elliptic curve, where k is a positive integer.

[0039] e: from arrive Bilinear pairing mapping.

[0040] H(·): The cryptographic function derived from the cryptographic hash function, which is Indicates a binary string of length *. d: The group owner key held secretly by the group administrator.

[0041] P pub : The group owner's public key published by the group administrator, calculated as Ppub =[d]P2.

[0042] ID i : The identity of user i.

[0043] Private key of user i.

[0044] x i : The identification hash value of user i, calculated as x i =H(ID i ).

[0045] m: The message to be signed.

[0046] π,π′: Non-interactive zero-knowledge proof.

[0047] σ: The signature value of the message.

[0048] mod q: Modulo q operation. For example, 31 mod 5 ≡ 1.

[0049] x||y: The concatenation of x and y, where x and y can be bit strings or byte strings.

[0050] Arc: Public list Arc, which consists of three parts: user ID hash value, user registration status, and current accumulator value, such as (H(ID i ),b=1,V i+1 ), where b is 1, indicating adding a registered user H(ID i ), b is 0 to log out user H(ID i ). V represents the current accumulator value.

[0051] V j : Group cumulative value, there are j entries in the public list Arc.

[0052] Reg: Public list Reg, storing the registered user ID hash value H (ID i ) and its [H(ID i )]P2, such as (H(ID i ),[H(ID i )]P2).

[0053] Params: public parameters, Params = (λ, P1, P2, P pub ,G1,G2,G3,V0,Arc,Reg).

[0054] u,r1,…,r3,k1,…,k8: group Random elements in .

[0055] W i : Evidence of group membership.

[0056] W i,j is the user ID i At the current accumulator V j The evidence in.

[0057] gusk i : Group private key of user i

[0058] Enc(x i ,r): Elgamal encryption algorithm, where x i is the encrypted plaintext message, and r is the random number selected by the encryption algorithm.

[0059] C = (C1, C2): The ciphertext obtained by the Elgamal encryption algorithm is divided into two parts, C1 and C2.

[0060] SOK: short for signature of knowledge.

[0061] ? =: Determine whether both sides of an equation are equal.

[0062] Please see Figure 1 The present invention provides an SM9 group signature generation and verification method that supports membership revocation, comprising the following steps:

[0063] Step 1: Set the common parameters Params = (λ, P2, P2, P pub ,G1,G2,G3,V0,Arc,Reg);

[0064] a) Run by the group administrator, input the security parameter λ, the parameter selection is the same as the national secret standard SM9 digital signature algorithm, and use the 256-bit BN curve to implement the bilinear pairing operation. Select the N-order cyclic subgroup and its generator P1, N-order cyclic subgroup and its generator P2, bilinear pairing e: Cryptographic hash function H(·):

[0065] b) Select

[0066] c) Random selection As the group owner's key, and calculate the group owner's public key P pub =[d]P2.

[0067] d) Create a new public list Arc, which consists of three parts: user ID hash value, user registration status, and current accumulator value, such as (H(ID i ),b=1,V i+1), where b is 1, indicating adding a registered user H(ID i ), b is 0 to log out user H(ID i ), initialize Arc to empty, create a dynamic accumulator instance, randomly select The accumulator value is initialized to V0 = [u]P1.

[0068] e) Create an empty public list Reg to store the hash value H (ID i ) and its [H(ID i )]P2, such as (H(ID i ),[H(ID i )]P2).

[0069] f) The common parameters are Params = (λ, P1, P2, P pub ,G1,G2,G3,V0,Arc,Reg), as the default input of the following algorithm.

[0070] Step 2: User registration;

[0071] Users communicate with group administrators through a registration protocol. There are multiple users, each with a unique ID, and a trusted group administrator. Communication between users and group administrators is private and authenticated. After successful registration, users become authorized members of the group. The output of the member is a member certificate and a member secret.

[0072] The specific implementation includes the following sub-steps:

[0073] a) User i sends his identity ID i ∈{0,1} * To the group administrator, request to join the group.

[0074] b) The group administrator calculates the user's private key And send it to user i.

[0075] c) User Verification Is it established to determine the private key the legitimacy of.

[0076] d) Assume that the currently known group cumulative value is V j (There are j entries in the public list Arc), the group administrator calculates a new group cumulative value V j+1 =[(H(ID i )+d)]V j And add the tuple (H(ID i ),1,V j+1 ) to the public list Arc. Group administrator calculates [H(ID i)]P2, and add the tuple (H(ID i ),[H(ID i )]P2) to the public list Reg.

[0077] e) User i adds V on the public list Reg j As evidence of my own i .

[0078] f) Other users run the evidence update algorithm Update to update the evidence.

[0079] Step 3: Group signature, output signature σ of m; where m is the message to be signed;

[0080] The specific implementation includes the following sub-steps:

[0081] a) Calculate the identification hash value x of user i i =H(ID i );

[0082] b) Set the group private key of user i in, is the private key of user i, W i Evidence for user i;

[0083] c) Use the group owner's public key P pub x i Perform Elgamal encryption to obtain C = (C1, C2), where C1 = [r]P2, C2 = [x i ]P2+[r]P pub ; Where r represents the random number selected by the Elgamal encryption algorithm;

[0084] The knowledge signature consists of three parts: ① User i’s evidence W i Prove x i Indeed, in the current accumulator value V, ② the private key of user i Legal, ③ ciphertext C is composed of the group owner's public key P pub x i Obtained by Elgamal encryption;

[0085] Non-interactive zero-knowledge proof Where m is the message to be signed; SOK represents the knowledge signature; Enc(x i ,r) is the Elgamal encryption algorithm, where x i is the encrypted plaintext message, r is the random number selected by the encryption algorithm;

[0086] Pick a random value Calculate A1 = [r1] G1 + [r2] G2 + [r3] G3; A2 = W i +[r1]G2; α1=[r1]x i ;α2=[r2]x i ; α3=[r3]x i ;π is equivalent toπ′,

[0087]

[0088] Pick a random value Calculate T1=[k1]G1+[k2]G2+[k3]G3; T2=[k4]G1+[k5]G2+[k6]G3-[k7]A1; T5=[k8]P2; T6=[k7]P2+[k8]P pub ;ch=H(Params||A1,…,A3||T1,…,T6||m); s1=k1+ch·r1; s2=k2+ch·r2; s3=k3+ch·r3; s4=k4+ch·α1; s5=k5+ch·α2; s6=k6+ch·α3; s7=k7+ch·x i ;s8=k8+ch·r;

[0089] d) Output m’s signature σ = (ch, s1,…, s8, A1,…, A3, T1,…, T6, C).

[0090] Step 4: Verify the signature;

[0091] The verifier uses the group public key to verify whether the signature value σ is valid;

[0092] verify:

[0093] T1? =[s1]G1+[s2]G2+[s3]G3-[ch]A1;

[0094] T2? =[s4]G1+[s5]G2+[s6]G3-[s7]A1;

[0095]

[0096]

[0097] T5? = [s8] P2 - [ch] C1;

[0098] T6? =[s7]P2+[s8]P pub -[ch]C2.

[0099] If it is established, use the group owner key d to decrypt C, that is, [x * ]P2=C2-[d]C1;Search the current public list Reg and find the corresponding user identity H(ID * ).

[0100] This embodiment also includes a user cancellation operation;

[0101] In this embodiment, the user cancellation operation is run by the group administrator. When the user ID needs to be deregistered from the group i When the group administrator retrieves the user's H(ID i ) and the current group accumulated value V j And calculate the new group cumulative value V j+1 =[(H(ID i )+d) -1 ]V j ; Group administrator sends tuple (H(ID i ),0,V j+1 ) to the public list Arc; the group administrator calculates [H(ID i )]P2, the tuple (H(ID i ),[H(ID i )]P2) Delete in the public list Reg.

[0102] This embodiment also includes evidence update operations;

[0103] In this embodiment, the evidence update operation is run by the user to retrieve the public list Arc. The current list has n rows, and the user ID i The membership evidence is (j,W i,j ),

[0104] Starting from k=j+1, update the evidence as follows until k≤n;

[0105] Retrieve the kth row tuple of the public list Arc (H (ID k ),b,V k ); if b=1, then W i,k =V k-1 +H(ID k )-H(ID i ))W i,k-1 Otherwise W i,k =(H(ID k )-H(ID i )) -1 (W i,k-1 -V k ); return (n,W i,n ).

[0106] In this embodiment, the list search operation is performed by either party after each update of the public list, and the latest row of tuples (H(ID k ),b,V k ); if b=1, return e(V k-1 ,H(ID k )P2+P pub )=e(V k ,P2); otherwise return e(V k ,H(ID k )P2+P pub )=e(V k-1 ,P2).

[0107] This invention provides a method and system for generating and verifying SM9 group signatures that supports membership revocation. Based on the signature structure of the SM9 digital signature algorithm, this method eliminates the certificate management issues inherent in traditional public-key cryptography. It supports group signature membership revocation, ensuring that changes in group membership do not affect the verification of previous group signatures, and that the length of group signatures is independent of the number of group members. This solution addresses the gap in group signatures based on the SM9 commercial cryptography system and can be used in applications such as anonymous credentials, identity hosting, voting, and electronic cash.

[0108] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of protection of the patent of the present invention. Under the guidance of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested by the present invention shall be based on the attached claims.

Claims

1. A method for generating and verifying SM9 group signatures that supports membership revocation, characterized in that: The following steps are involved: Step 1: Set the common parameters Params = (λ, P1, P2, P pub , G1, G2, G3, V0, Arc, Reg); where λ is the security parameter, N-order cyclic subgroup and its generator P1, N-order cyclic subgroup and its generators P2, G1, G2, Random selection As the group owner key, calculate the group owner public key P pub =[d]P2; the public list Arc consists of three parts: user identification hash value, user registration status, and current accumulator value, denoted as (H(ID i ), b, V i+1 ), b is 1 to add registered user H(ID i ), b is 0 to log out user H(ID i ); Random selection The accumulator value is initialized to V0 = [u] P1; the public list Reg stores the registered user ID hash value H (ID i ) and its [H(ID i )]P2; cryptographic hash function H(·): is the set of integers consisting of 1, 2, ..., q-1, where q is a large prime number; there are j entries in the public list Arc; Step 2: User registration; Users communicate with group administrators through a registration protocol. There are multiple users, each with a unique ID, and a trusted group administrator. Communication between users and group administrators is private and authenticated. After successful registration, users become authorized members of the group. The output of the member is a member certificate and a member secret. Step 3: Group signature, output signature σ of m; where m is the message to be signed; Among them, the group owner’s public key P pub Hash value x for user i i Perform Elgamal encryption and obtain C = (C1, C2), C1 = [r] P2, C2 = [x i ]P2+[r]P pub ; r represents the random number selected by the Flgamal encryption algorithm; Step 4: Verify the signature; The verifier uses the group public key to verify whether the signature value σ is valid; if it is valid, the group master key d is used to decrypt C, that is, [x * ]P2=C2-[d]C1;Search the current public list Reg and find the corresponding user identity H(ID * ).

2. The SM9 group signature generation and verification method supporting membership revocation according to claim 1, characterized in that: The specific implementation of step 2 includes the following sub-steps: Step 2.1: User i sends his ID i ∈{0, 1} * To the group administrator, request to join the group; Among them, {0, 1} * Represents a binary string of length *; Step 2.2: Group administrator calculates the user's private key And send it to user i; Step 2.3: User Verification Is it established to determine the private key The legality of ; where the bilinear pairing e: ? = means to check whether both sides of an equation are equal; Step 2.4: If the currently known group cumulative value is V j , the group administrator calculates a new group cumulative value V j+1 =[(H(ID i )+d)]V j And add the tuple (H(ID i ), 1, V j+1 ) to the public list Arc; the group administrator calculates [H(ID i )]P2, and add the tuple (H(ID i ), [H(ID i )]P2) to the public list Reg; Step 2.5: User i adds V on the public list Reg j As evidence of my own i ; Step 2.6: Other users run the evidence update algorithm Update to update the evidence.

3. The SM9 group signature generation and verification method supporting membership revocation according to claim 1, characterized in that: The specific implementation of step 3 includes the following sub-steps: Step 3.1: Calculate the identity hash value x of user i i =H(ID i ); Step 3.2: Set the group private key of user i in, is the private key of user i, W i Evidence for user i; Step 3.3: Use the group owner's public key P pub x i Perform Elgamal encryption to obtain C = (C1, C2), where C1 = [r] P2, C2 = [x i ]P2+[r]P pub ; Where r represents the random number selected by the Elgamal encryption algorithm; The knowledge signature consists of three parts: ① User i’s evidence W i Prove x i Indeed, in the current accumulator value V, ② the private key of user i Legal, ③ ciphertext C is composed of the group owner's public key P pub x i Obtained by Elgamal encryption; Non-interactive zero-knowledge proof Where m is the message to be signed; SOK represents the knowledge signature; Enc(x i , r) is the Elgamal encryption algorithm, where x i is the encrypted plaintext message, r is the random number selected by the encryption algorithm; V represents the current accumulator value; Pick a random value Calculate A1 = [r1] G1 + [r2] G2 + [r3] G3; A2 = W i +[r1]G2; α1=[r1]x i ;α2=[r2]x i ; α3=[r3]x i ;π is equivalent toπ′, Pick a random value Calculate T1=[k1]G1+[k2]G2+[k3]G3; T2=[k4]G1+[k5]G2+[k6]G3-[k7]A1; T5=[k8]P2; T6=[k7]P2+[k8]P pub ;ch=H(Params||A1,…,A3||T1,…,T6||m); s1=k1+ch·r1; s2=k2+ch·r2; s3=k3+ch·r3; s4=k4+ch·α1; s5=k5+ch·α2; s6=k6+ch·α3; s7=k7+ch·x i ; s8 = k8 + ch·r; || is the concatenation operator; Params is the public parameter; Step 3.4: Output the signature of m σ = (ch, s1, ..., s8, A1, ..., A3, T1, ..., T6, C).

4. The SM9 group signature generation and verification method supporting membership revocation according to claim 3, characterized in that: The specific implementation process of step 4 is as follows: the verifier uses the group public key to verify whether the signature value σ is valid; verify: T1? =[s1]G1+[s2]G2+[s3]G3-[ch]A1; T2? =[s4]G1+[s5]G2+[s6]G3-[s7]A1; T5? = [s8] P2 - [ch] C1; <h2 style=";text-align:left;direction:ltr">T6?=[s7]P2+[s8]P<h2 style=";text-align:left;direction:ltr"> pub <h2 style=";text-align:left;direction:ltr"> -[ch]C2.

5. The SM9 group signature generation and verification method supporting membership revocation according to any one of claims 1 to 4, characterized in that: It also includes user revocation operations; The user revocation operation is run by the group administrator when a user ID needs to be deregistered from the group. i When the group administrator retrieves the user's H(ID i ) and the current group accumulated value V j And calculate the new group cumulative value V j+1 =[(H(ID i )+d) -1 ]V; Group administrator sends tuple (H(ID i ), 0, V j+1 ) to the public list Arc; the group administrator calculates (H(ID i )]P2, the tuple (H(ID i ), [H(ID i )]P2) Delete in the public list Reg.

6. The SM9 group signature generation and verification method supporting membership revocation according to any one of claims 1 to 4, characterized in that: It also includes evidence update operations; The evidence update operation is run by the user to retrieve the public list Arc, which currently has n rows, and the user ID i The membership evidence is (j, W i，j ), W i，j is the user ID i At the current accumulator V j evidence in; Starting from k=j+1, update the evidence as follows until k≤n; Retrieve the kth row tuple of the public list Arc (H (ID k ), b, V k ); if b=1, then W i，k =V k-1 +(H(ID k )-H(ID i ))W i，k-1 Otherwise W i，k =(H(ID k )-H(ID i )) -1 (W i，k-1 -V k ); return (n, W i，n ).

7. The SM9 group signature generation and verification method supporting membership revocation according to any one of claims 1 to 4, characterized in that: Any party can perform a list search operation after updating the public list, and retrieve the latest row of tuples (H(ID k ), b, V k ); if b=1, return e(V k-1 ,H(ID k )P2+P pub )=e(V k , P2); otherwise return e(V k ,H(ID k )P2+P pub )=e(V k-1 , P2).

8. An SM9 group signature generation and verification system supporting membership revocation, characterized in that: Includes the following modules: Module 1, set initialization common parameters Params = (λ, P1, P2, P pub , G1, G2, G3, V0, Arc, Reg); where λ is the security parameter, N-order cyclic subgroup and its generator P1, N-order cyclic subgroup and its generators P2, G1, G2, Random selection As the group owner key, calculate the group owner public key P pub =[d]P2; the public list Arc consists of three parts: user identification hash value, user registration status, and current accumulator value, denoted as (H(ID i ), b, V i+1 ), b is 1 to add registered user H(ID i ), b is 0 to log out user H(ID i ); Random selection The accumulator value is initialized to V0 = [u] P1; the public list Reg stores the registered user ID hash value H (ID i ) and its [H(ID i )]P2; cryptographic hash function H(·): is the set of integers consisting of 1, 2, ..., q-1, where q is a large prime number; there are j entries in the public list Arc; Module 2, for user registration; Users communicate with group administrators through a registration protocol. There are multiple users, each with a unique ID, and a trusted group administrator. Communication between users and group administrators is private and authenticated. After successful registration, users become authorized members of the group. The output of the member is a member certificate and a member secret. Module 3, used for group signature, outputs the signature σ of m, where m is the message to be signed; Among them, the group owner’s public key P pub Hash value x for user i i Perform Elgamal encryption and obtain C = (C1, C2), C1 = [r] P2, C2 = [x i ]P2+[r]P pub ; r represents the random number selected by the Elgamal encryption algorithm; Module 4, for verifying signatures; The verifier uses the group public key to verify whether the signature value σ is valid; if it is valid, the group master key d is used to decrypt C, that is, [x * ]P2=C2-[d]C1;Search the current public list Reg and find the corresponding user identity H(ID * ).

Images