A time-limited group signature method with double privacy

Abstract

The application provides a time-limited group signature method with double privacy. The method comprises the following steps: a system initialization operation: generating system parameters and creating a time tree; an administrator initialization operation: the administrator generates his own public and private keys, pseudonym parameters, a register and a revocation list; a user joining a group operation: the user generates his own public and private keys, generates his own pseudonym and applies to join a group; a group certificate generation operation: the administrator issues a group certificate to the user who is approved and makes the user a group member; a group revocation operation: the administrator uses the time tree to obtain the current encryption time and verifies, and adds the group member whose time limit is invalid to the revocation list; a group signature generation operation: a message is sent to the group member, the group member signs the message and sends it to a signature verifier; a signature verification operation: the signature verifier verifies the group signature; and a signature tracker operation: if there is a dispute between the signature verifiers, the administrator is requested to arbitrate, and the administrator tracks the real identity of the corresponding group member.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of digital signature, and particularly relates to a time-limited group signature method with double privacy. BACKGROUND

[0002] Group signature is widely considered as a specific implementation scheme of digital signature, and is an important technology for identity authentication. It allows any user in a group to represent the entire group to anonymously sign data or files, so as to ensure the integrity, authenticity and non-repudiation. With the rapid development of modern information technology and the wide involvement of computer networks, at present, group signature technology has been widely applied in many fields such as electronic voting, block chain, electronic government affairs and electronic commerce.

[0003] In 2012, Chu et al. proposed a time-limited key revocation scheme (GS-TBK), and introduced natural revocation to reduce the total consumption of verifying revocation checks. After that, Ohara et al. proposed a new revocable group signature scheme with time-limited keys, which associates revoked members and non-revoked members through a hierarchical time tree, and assigns each group member a leaf node. The signature contained in the revocation list has two instances of proof, which ensures that the revoked user is verified by the group user. Emura et al. proposed a signature key, which sets a time limit embedded in each group member, and associates the expiration time with each group member, so as to realize the effective management of group members. Hanser et al. proposed a new dynamic signature scheme (SPS-EQ) using SXDH problem, which allows continuous randomization of signatures and information for group members without knowing any secret. Therefore, it is suitable for signature schemes for any number of group members.

[0004] In the current dynamic group signature scheme, although the existing time revocation scheme can verify whether the signature is valid within the specified time or implement the revocation of group members within the specified time, it does not consider the security problem caused by the leakage of time validity period. In the case of registration table leakage, the attacker can use the validity period to attack the signature; or the attacker forges a time limit, and then attacks and revokes the group members who have not expired according to the registration table. Therefore, it is necessary to strengthen the privacy protection of the time period of the members. In addition, in the group signature scheme, the administrator is responsible for generating the administrator key, generating the key of the member, and needs to bear the task of executing the member revocation and tracking the member, which leads to the fact that the execution time consumption of the administrator restricts the performance of the whole dynamic group signature system. In the revocable scheme, the time limit mechanism is introduced, and since the validity period will increase with the passage of time, the size of the signature will also increase, so the optimization of the signature size of the group signature is also an important point. SUMMARY

[0005] Aiming at the privacy security problem existing in the current dynamic group signature scheme, the application provides a time limit group signature method with double privacy.

[0006] The application provides a time limit group signature method with double privacy, comprising:

[0007] System initialization operation: generating system parameters, and creating a hierarchical tree as a time tree, the first layer, the second layer, the third layer and the fourth layer of the time tree respectively correspond to the root, the year, the month and the day;

[0008] Administrator initialization operation: the administrator generates the public and private keys of himself, pseudonym parameters and a register reg and a revocation list RL for storing member information;

[0009] User joining group operation: the user generates the public and private keys of himself, generates the pseudonym of himself according to the pseudonym parameters and applies to join the group;

[0010] Group certificate generation operation: the administrator issues a group certificate to the user who passes the application and makes him a group member;

[0011] Group revocation operation: the administrator uses the time tree to obtain the current encryption time and verifies whether the group member is valid, and adds the group member whose time limit is invalid to the revocation list RL to perform group revocation;

[0012] Group signature generation operation: sending a message M to the group member, the group member signing the message M, and sending the signature to at least one signature verifier;

[0013] Signature verification operation: the signature verifier verifies the group signature;

[0014] Tracking signer operation: if there is a dispute between the signature verifiers, the administrator is requested to arbitrate, and the administrator traces the real identity of the corresponding group member.

[0015] Further, the system parameter generation in the system initialization stage comprises:

[0016] Setting a security parameter λ, generating a cyclic group G1, G2 and G of order p based on the security parameter λ T ;

[0017] Selecting a generator g1 in G1 and a generator g2 in G2;

[0018] Selecting two anti-collision hash functions H1: And H2:

[0019] So as to obtain the system parameters

[0020] Further, the administrator generates his own public and private keys and pseudonym parameters in the administrator initialization phase specifically includes:

[0021] randomly selects an integer and calculates an intermediate parameter thus obtaining the private key of the administrator and the public key of the administrator GPK=(u1, u2, Q1, Q2, Q3);

[0022] randomly selects an integer generates the pseudonym parameters and publishes.

[0023] Further, the user generates his own public and private keys in the user joining group operation specifically includes:

[0024] randomly selects an integer calculates thus obtaining the private key of the user USK=(usk1=n1, usk2=n2) and the public key of the user UPK=(upk1, upk2).

[0025] Further, the user generates his own pseudonym according to the pseudonym parameters and applies to join the group in the user joining group operation, specifically includes:

[0026] sets an arbitrary time period as the validity period Tp, and generates a covering subset E of the validity period Tp according to the characteristics of the time tree, the covering subset E is composed of multiple time intervals, wherein any τ∈E satisfies k τ T, T represents the depth of the time tree;

[0027] for any τ∈E, a random number generates the corresponding time period in a secret state, specifically includes:

[0028] selects a random number generates his own pseudonym

[0029] sets his own identity attribute feas={fea1, fea2, fea3,...}, and calculates an intermediate parameter c=H1(Una||UPK||NK||Kern), R1=n1-c·μ1, R2=n2-c·μ2;

[0030] sends a certificate application request Qcert=(Una, UPK, w, feas, R1, R2) to the administrator.

[0031] Further, the group certificate generation operation specifically includes:

[0032] Receive the certificate application request Qcert = (Una, UPK, w, feas, R1, R2) submitted by the user, and calculate according to zero-knowledge proof

[0033] Generate a challenge value Verify c and Whether they are equal:

[0034] If they are equal, it means the certificate application request is valid. Store the user's pseudonym Una, identity attribute feas, validity period Tp, and secret key usk1 in the registration table reg; and randomly select an integer Calculate the intermediate parameter And And the reputation value Creds = H1(UPK, fea1, fea2, fea3,...), so as to generate a group certificate Send it to the user;

[0035] If they are not equal, it means the certificate application request is invalid, and reject to issue a group certificate to this user.

[0036] Furthermore, the group revocation operation specifically includes: <$

[0037] Automatically generate a time period t according to the current time c , and represent this time period as τ according to the time tree c =(t1, t2,…, t k ) ∈ {1, n} k , and calculate the intermediate parameter

[0038] Judge Whether it holds or not. If it holds, it means the group member's identity is legal; otherwise, query τ from the covering subset E c Prefix of If it can be queried and Satisfies k′ < k, then according to Obtain So as to calculate and obtain Where, e(,) represents the bilinear cyclic group pair;

[0039] Judge Whether it holds or not. If it holds, it means the group member's identity is legal; otherwise, it means the time limit of this group member has expired, and calculate the intermediate parameter And add it and the current time period t c To the revocation list RL.

[0040] Furthermore, when generating a group signature, the group member signs the message M, which specifically includes: <$

[0041] Randomly select integer ζ1, α <- Z p Calculate intermediate parameter ψ1 = upk1 · Q3 α ,

[0042] Set ζ2 = α · n1 · ζ1, ζ3 = n2 · ζ1; and randomly select Calculate intermediate parameter

[0043] Calculate challenge value

[0044] Calculate intermediate parameter

[0045] Thus, the group signature is obtained

[0046] Further, the signature verification operation specifically includes:

[0047] According to the group signature σ, verify whether the identity of the signer is expired; and according to the revocation list RL, verify whether the identity of the signer is revoked, if yes, then proceed to the next step, otherwise output ⊥. i,g} i∈RL Verify whether e(r g , ψ4) = ψ3 is established, if yes, then proceed to the next step, otherwise output ⊥.

[0048] Calculate auxiliary value

[0049] Calculate challenge value

[0050] Verify whether e(r is established, if yes, then the group signature σ is valid; otherwise, the signature is invalid and 0 is output.

[0051] Further, the administrator traces the real identity of the corresponding group member in the operation of tracing the signer, specifically including:

[0052] Verify whether the behavior of the signer is correct, if yes, then proceed to the next step;

[0053] According to the group signature σ and the key Calculate

[0054] Inquire whether there is a user with K as the public key in the registration table reg, if yes, then the information of the user is the real identity of the user; otherwise, stop tracing and output 0.

[0055] The beneficial effects of the present application are:

[0056] 1. Using SPS-EQ technology, a high-efficiency group signature scheme is constructed, which has less computational cost and shorter signature length than other schemes, and meets the anonymity, unframing and traceability of group signature.

[0057] 2. By converting the validity period of group members into ciphertext time, the privacy leakage problem of the validity period of group members can be solved, and in addition, the validity period set by the group members is not limited by the continuity of time.

[0058] 3. The time mechanism of the time tree is introduced, and the hierarchical encryption algorithm (HIBE) is used to realize effective control of time; and it is applied to the revocation operation, which can effectively improve the efficiency of revocation.

[0059] 4. The scheme provides a pseudonym mechanism for group members, and the user generates a user pseudonym using the pseudonym algorithm provided by the system, and the pseudonym identifier is composed of user attribute information and secret set by the user, and then the user hides personal information and signs with the pseudonym, so that the group members can realize signature while avoiding the exposure of user attribute information and behavior characteristics, thereby realizing double protection of group member privacy.

[0060] 5. Based on the pseudonym mechanism, in view of the problem that anonymous certificate cannot be supervised, in the scheme, when the user applies to join the group, the user needs to provide personal information to the administrator as personal credit, and the administrator performs forced supervision to prevent malicious fraud and the like. BRIEF DESCRIPTION OF DRAWINGS

[0061] Figure 1 A flowchart of a time-limited group signature method with double privacy provided by the embodiment of the present application is shown.

[0062] Figure 2 A schematic diagram of a time tree provided by the embodiment of the present application is shown. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiments of the present application will be described in detail below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0064] As shown in Figure 1 The embodiment of the present application provides a time-limited group signature method with double privacy, which mainly includes the following 8 operations.

[0065] System initialization operation: generate system parameters, and create a hierarchical tree as a time tree, the first layer, the second layer, the third layer and the fourth layer of the time tree correspond to the root, the year, the month and the day respectively, as shown in Figure 2

[0066] Specifically, the generation of the system parameters specifically includes: setting a security parameter λ, generating cyclic groups G1, G2 and G T based on the security parameter λ, selecting a generator g1 G1, a generator g2 G2, and selecting two anti-collision hash functions H1: and H2: Thus, the system parameters

[0067] Specifically, according to the time base, the string {1, n} T-1 is selected to represent the time in n-base, and H0, H1, H2,... H T are randomly selected, where G1 is a parameter in the time tree, and T represents the depth of the tree. For the third layer, one year contains 12 months, and n = 12; for the fourth layer, one month contains 28 days, 30 days or 31 days, and correspondingly, n = 28, 30, 31.

[0068] It should be noted that in the embodiments of the present application, the minimum unit of time is day, and T = 4. It can be understood that a time tree with more layers can be established to represent more fine-grained time nodes, such as the fifth layer representing "hour", T = 5; the sixth layer representing "minute", T = 6; the seventh layer representing "second", and so on, T = 7.

[0069] Administrator initialization operation: the administrator generates his own public and private keys, pseudonym parameters and a registration table reg and a revocation list RL for storing member information;

[0070] Specifically, an integer is randomly selected, and an intermediate parameter is calculated. Thus, the private key of the administrator and the public key of the administrator GPK = (u1, u2, Q1, Q2, Q3) are obtained.

[0071] An integer is randomly selected, and pseudonym parameters are generated and published.

[0072] User joining operation: the user generates his own public and private keys, generates his own pseudonym according to the pseudonym parameters and applies to join the group;

[0073] Specifically, the generation process of the public and private keys is as follows: an integer is randomly selected, and is calculated. Thus, the user's private key USK=(usk1=n1, usk2=n2) and the user's public key UPK=(upk1, upk2) are obtained.

[0074] User's validity period generation process: first, the user sets an arbitrary time period as the validity period Tp, and according to the characteristics of the hierarchical tree, E represents the covering subset of the validity period Tp, which is composed of multiple time periods, where any τ∈E satisfies k τ Second, for any τ∈E, the user selects a random number and the system generates a ciphertext time period, which is calculated as follows:

[0075] User's pseudonym certificate request process: first, the user selects a random number to generate his own pseudonym Second, the user sets his own identity attribute feas={fea1, fea2, fea3,...}, and calculates the intermediate parameter c=H1(Una||UPK||NK||Kern), R1=n1-c·μ1, R2=n2-c·μ2; sends the certificate application request Qcert=(Una, UPK, w, feas, R1, R2) to the administrator.

[0076] In this embodiment, since each node of the time tree can be represented as a time period, the group member freely sets the time limit according to the time structure in the time tree, and finally generates an encrypted time ciphertext. If the user sets the validity period to contain multiple valid time nodes, the minimum covering set method is used to obtain all the number of valid time nodes, and the user can only obtain the key values corresponding to these nodes by using the hierarchical encryption algorithm HIBE.

[0077] Group certificate generation operation: the administrator issues a group certificate to the user who passes the application and makes him a group member;

[0078] Specifically, the administrator receives the certificate application request Qcert=(Una, UPK, w, feas, R1, R2) submitted by the user, calculates the challenge value and verifies whether c and are equal:

[0079] If they are equal, it means that the certificate application request is valid, and the user's pseudonym Una, identity attribute feas, validity period Tp, and key usk1 are stored in the registration table reg; and a random integer is selected, and the intermediate parameters and and the reputation value Creds = H1(UPK, fea1, fea2, fea3,...), thereby generating a group certificate and sending it to the user; after receiving the group certificate, the user calculates δ1 = e(upk1, u1)·e(upk2, u2) and δ2 = e(P1, B1), and determines whether δ1 = e(P1, g2) and δ2 = e(P2, g1) hold. If they hold, then is used as its own identity certificate.

[0080] If they are not equal, it means that the certificate application request is invalid, and the group certificate is refused to be issued to this user.

[0081] Group revocation operation: The administrator uses the time tree to obtain the current encrypted time and verify whether the group members are valid, and adds the group members whose time limits have expired to the revocation list RL for group revocation;

[0082] Specifically, a time period t is automatically generated according to the current time c , and this time period is represented as τ c =(t1, t2,…, t k )∈{1, n} k , and the intermediate parameter is calculated

[0083] Judge Whether it holds. If it holds, it means that the identity of this group member is legal; otherwise, query τ from the covering subset E c prefix of If it can be queried and satisfies k′<k, then according to​​​​​​​​​​​​​​​​​​​​​​​​​​Let ζ2=α·n1·ζ1, ζ3=n2·ζ1; and randomly select Compute the intermediate parameter Compute the challenge value Compute the intermediate parameter Thus, the group signature is obtained

[0087] As can be seen from the above group revocation operation and group signature generation operation, in the embodiment, after the time tree is introduced, the validity period of the user is usually represented by a time interval, which is represented as a year, a month, a day, etc. The administrator generates a key from the corresponding day or month according to the time tree, verifies whether the group member has the right to sign, and realizes the revocation of the member. Moreover, the signature time generated by the user can only be completed in the entire signature operation if it is covered by the entire validity period time period.

[0088] For example, the validity period of the user (the validity period is denoted as Tp) is from January 2023 to March 3, 2023, the following time nodes are obtained from the time tree: “2023-Jan”, “2023-Feb”, “2023-Mar-1”, “2023-Mar-2” and “2023-Mar-3”, and it is represented as: τ={(2023,Jan),(2023,Feb),(2023,Mar,1)(2023,Mar,2),(2023,Mar,3)}.

[0089] If the signature date of the user (the signature date is denoted as St) is February 4, 2023, that is, The administrator verifies that the authorized member is valid; on the contrary, if the signature date of the user is March 4, 2023, that is, The administrator verifies that the authorized member is invalid, so the user cannot realize the signature of the message, and at the same time, the administrator will add the user to the revocation list RL.

[0090] Verification signature operation: the verifier verifies the group signature;

[0091] Specifically, according to the group signature σ, it is verified whether the identity of the verifier is expired; and according to the revocation list RL, it is verified whether e(r g ,ψ4)=ψ3 is established, if it is established, the next step is performed, otherwise, outputs ⊥;

[0092] It should be noted that the verification of whether it is expired from the revocation list can avoid the occurrence of malicious behavior of the verifier.

[0093] Compute the auxiliary value

[0094] According to the above result, the challenge value is calculated

[0095] Verification is true, it means that the group signature sigma is valid; otherwise, it means that the signature is invalid and outputs 0.

[0096] Tracking signer operation: if there is a dispute between the signature verifiers, the administrator is requested for arbitration, and the administrator tracks the real identity of the corresponding group member.

[0097] Specifically, whether the behavior of the nuclear experiment signer is correct, if correct, then continue to the next step;

[0098] According to the group signature sigma and the key Calculate At this time, the value of K is actually upk1 in the public key of a certain user;

[0099] Query whether there is a user with K as the public key in the registry reg, if yes, the information of the user is the real identity of the user; otherwise, stop tracking and output 0.

[0100] The group signature method provided by the embodiment of the application can be used in a secure authentication system based on group signature. The application mainly uses keys and system parameters for encryption and decryption and signature verification operation by group administrators and users, and uses knowledge proof and revocation list for validity verification of group members in signature verification and revocation operation. Through the integration of the above algorithms and the implementation of the process, the group signature scheme can meet the security requirements in different scenarios.

[0101] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the application, but not to limit them; although the application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the application.

Claims

1. A time-limited group signature method with dual privacy, characterized in that, include: System initialization operations: Generate system parameters and create a hierarchical tree as a time tree. The first, second, third, and fourth levels of this time tree represent the root, year, month, and day, respectively. Administrator initialization operations: The administrator generates their own public and private keys, pseudonym parameters, and a registry (reg) and undo list (RL) for storing member information; User joining the group: The user generates their own public and private keys, generates their own pseudonym based on the pseudonym parameter, and applies to join the group; Group certificate generation: The administrator issues a group certificate to the approved user and makes them a group member; Group revocation operation: The administrator uses the time tree to obtain the current encryption time and verify whether the group members are valid. Group members whose time limits have expired are added to the revocation list RL for group revocation. Group signature generation operation: Send message M to group members, group members sign message M, and send the signature to at least one signer; Signature verification operation: The verifier verifies the group signature; Tracking signer actions: If there is a dispute among signers, arbitration is requested from the administrator, who will then track the true identity of the corresponding group member.

2. The time-limited group signature method with dual privacy as described in claim 1, characterized in that, The specific system parameters generated during the system initialization phase include: Set a safety parameter λ, and generate p-order cyclic groups G1, G2, and G... T ; Choose generators g1∈G1 and g2∈G2; Choose two collision-resistant hash functions and Thus, the system parameters are obtained.

3. The time-limited group signature method with dual privacy according to claim 2, characterized in that, During the administrator initialization phase, the administrator generates their own public and private keys and pseudonym parameters, specifically including: Randomly select an integer And calculate intermediate parameters This allows you to obtain the administrator's private key. The administrator's public key GPK = (u1, u2, Q1, Q2, Q3); Randomly select an integer Generate pseudonym parameters And it will be announced.

4. The time-limited group signature method with dual privacy according to claim 3, characterized in that, The process of a user joining a group involves the following: The user generates their own public and private keys. Randomly select an integer calculate This yields the user's private key USK = (usk1 = n1, usk2 = n2) and the user's public key UPK = (upk1, upk2).

5. The time-limited group signature method with dual privacy according to claim 4, characterized in that, The process of a user joining a group involves generating their own pseudonym based on the pseudonym parameter and then applying to join the group. Specifically, this includes: Set an arbitrary time period as the validity period Tp, and obtain the coverage subset E of the validity period Tp according to the time tree. The coverage subset E consists of multiple times components, where n represents the base of the time, and for any τ ∈ E, it satisfies k τ < T, where T represents the depth of the time tree; For any τ∈E, choose a random number. Generate the corresponding dense state time period, specifically including: Among them, H0 and H j These are parameters in the time tree; Select random number Generate its own pseudonym Set its own identity attributes feas={fea1,fea2,fea3,...}, and calculate the intermediate parameter c=H1(Una||UPK||NK||Kern). R1=n1-c·μ1, R2=n2-c·μ2; Send a certificate request to the administrator: Qcert = (Una, UPK, w, feas, R1, R2).

6. The time-limited group signature method with dual privacy according to claim 5, characterized in that, The process of generating a group certificate specifically includes: Receive the certificate request Qcert = (Una, UPK, w, feas, R1, R2) submitted by the user, and calculate it based on zero-knowledge proofs. Generate challenge value Verify c and Are they equal? If they are equal, the certificate application is valid, and the user's pseudonym Una, identity attribute feas, validity period Tp, and key usk1 are stored in the registry reg; and a random integer is selected. Calculate intermediate parameters and And the reputation value Creds = H1(UPK,fea1,fea2,fea3,...), thus generating a group certificate. Send to the user; If they are not equal, it means that the certificate application request is invalid and the group certificate will not be issued to the user.

7. A time-limited group signature method with dual privacy as described in claim 6, characterized in that, The group cancellation operation specifically includes: Automatically generate a time period τ based on the current time. c And represent this time period as τ according to the time tree. c =(t1,t2,…,t k )∈{1,n} k And calculate intermediate parameters Judge Whether it holds. If it holds, it means that the group member identity is legal; otherwise, query τ c Prefix of If it can be queried and Satisfies k′ < k, then according to Obtain Thus, it is calculated to obtain Among them, e(,) represents the bilinear cyclic group pair; judge If the condition is met, the group member's identity is valid; otherwise, the group member's time limit has expired. Calculate intermediate parameters. and the current time period τ c Add to the undo list (RL).

8. A time-limited group signature method with dual privacy as described in claim 7, characterized in that, In the group signature generation operation, group members sign the message M, specifically including: Randomly select integers ζ1, α←Z p Calculate intermediate parameters Set ζ2 = α·n1·ζ1, ζ3 = n2·ζ1; and randomly select... Calculate intermediate parameters Calculate the challenge value Calculate intermediate parameters Thus, group signatures are obtained.

9. A time-limited group signature method with dual privacy as described in claim 8, characterized in that, The signature verification operation specifically includes: Verify the signer's identity based on the group signature σ to see if it has expired; and verify e(r) based on the revocation list RL. g Check if ψ4)=ψ3 is true. If true, proceed to the next step; otherwise, output ⊥. Calculate auxiliary values Calculate the challenge value verify If the condition is met, the group signature σ is valid; otherwise, the signature is invalid and 0 is output.

10. A time-limited group signature method with dual privacy according to claim 9, characterized in that, The administrator tracking the signer's actions tracks the true identity of the corresponding group members, specifically including: Whether the nuclear test signatory's actions were correct; if correct, proceed to the next step. Based on the group signature σ and the administrator's private key calculate Check if a user with K as their public key exists in the registry (reg). If so, the user's information represents their real identity; otherwise, stop tracking and output 0.

Images