A method for constructing an efficient post-quantum pseudonym system based on ring lattice

Abstract

The present application relates to the technical field of cryptography privacy protection, more particularly to a method for constructing an efficient post-quantum pseudonym system based on ring lattice. Based on the difficult assumption of ring lattice, the present application can resist quantum computing attacks. The user certificate generated by the present application is reusable, and different organizations can use different group public and private keys. The present application supports internal hierarchical structure of an organization, and internal users can be finely divided into different sub-agencies or departments. The present application avoids certificate lending to the greatest extent, because the pseudonym of a user contains some personal real information of the user and a verification code, which greatly increases the cost of lending the certificate of the user. Compared with the existing post-quantum scheme, the size of the organization public key, the size of the user certificate and the size of the interaction data generated by the method of the present application are all significantly reduced.

Description

Technical Field

[0001] This invention relates to the field of cryptographic privacy protection technology, and more specifically, to a method for constructing an efficient post-quantum pseudonym system based on a ring lattice. Background Technology

[0002] Anonymous credentials, or anonymous trust certificates, are an important privacy protection technology, considered the most ideal known solution for achieving individual privacy in user authentication and access control in increasingly distributed environments. An anonymous credential system typically involves three parties: the user, the certificate authority, and the service provider. A user first obtains a credentials certificate from a certificate authority, which ensures the user's legitimacy to obtain services from a specific service provider. To obtain the service, the user interacts with the corresponding service provider in a "credential presentation" process, proving their eligibility to access the service. If the user's credentials meet the rules for enjoying the service, the service provider agrees to provide the service; otherwise, the user's request is rejected. Compared to general certificate systems, the "credential presentation" process of anonymous credentials is anonymous; it does not reveal any information about the certificate owner, and even for the same user, multiple different "credential presentations" of the same credentials cannot be identified (not even by the certificate authority).

[0003] Current research on post-quantum anonymity certificates is limited. Zhang Zhuoran et al. initially considered how to achieve anonymous two-way authentication using encoding techniques, i.e., a secret handshake. However, this scheme can only use one-time pseudonyms, making it impractical. An Zhiyuan et al. further implemented a secret handshake supporting reusable certificates using ring-based signature and key negotiation techniques, reducing communication overhead during the interaction process. Regarding anonymous one-way authentication, in recent years, Lyubashevsky et al. have constructed a series of group signature schemes with small signature sizes using ring-based zero-knowledge proof schemes. Yang Rupeng et al., combining the traditional Sigma protocol, constructed a zero-knowledge proof protocol for linear relationships and quadratic constraints on ring lattices, thus constructing efficient group signature and ring signature schemes. However, none of these schemes truly consider the construction of the pseudonym system, including its functionality and security requirements in specific application environments. Summary of the Invention

[0004] To overcome the shortcomings of the prior art, this invention provides a method for constructing an efficient post-quantum pseudonym system based on a ring lattice. The method constructs a pseudonym system based on difficult problems on ring lattices (MSIS, MLWE) with high security.

[0005] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is: a method for constructing an efficient post-quantum pseudonym system based on a ring lattice, comprising the following steps:

[0006] S1. System Initialization: This is used to complete the creation of a group organization, including inputting the system security parameter n, and outputting the public group key gpk and the private group key gsk held by the group's management center.

[0007] S2. Certificate Issuance Algorithm: Used to complete the addition of a group member; it includes inputting the group public-private key pair (gpk, gsk) and the real identity of the user to be added. The organization's management body (GA) first verifies whether the user's real identity meets the requirements; if the verification fails, the management body outputs ⊥ and stops the interaction; otherwise, the management body executes the certificate issuance algorithm to generate the user's group certificate.

[0008] S3. Authentication algorithm, which is a one-way authentication protocol: A group user U holding a certain message m sends a signature of the legitimate group identity of user U to a third-party verifier V. V verifies this signature of m. If V outputs 1, it means that the verification is successful, and then the subsequent service is provided to U; if V outputs 0, it means that the verification fails, and then the service is refused to be provided to U. This one-way authentication process will not reveal U's group identity, i.e., group pseudonym, regardless of whether it is successful or not.

[0009] Furthermore, the entity components of the pseudonym system include: a group organization management center (GA), responsible for establishing the corresponding group organization (generating the group organization's public and private keys, etc.) and verifying the user's true identity, adding trusted users to the group organization, which is accomplished by issuing a unique and valid group certificate to the user; a legitimate group member (U), holding a group certificate issued by GA, who can send the signature of relevant messages (transactions or other financial activities) to a third-party verifier to complete one-way authentication; and a third-party verifier (V), providing services only open to group users, authenticating the user by verifying the signature sent by the group member.

[0010] Furthermore, step S1 specifically includes:

[0011] S11. Select appropriate matrix dimensions κ, λ, α, and standard deviations σ, σ′ of the discrete Gaussian distribution, and select appropriate parameters q, d, l, d0, d1, d2, where q⁻¹≡2lmod4l; define the ring. ring gather The representation is defined on the ring of integers. Polynomial ring on; X d Represents a polynomial ring A monomial on; Represents the ring of integers. Represents the ring of residue classes modulo q; P-polynomial ring A polynomial named p in the polynomial; a suitable discrete Gaussian distribution is selected. Choose an appropriate distribution χ on {-1,0,1} and select a suitable set. Let number theory transformations be functions

[0012] S12. Select three suitable hash functions

[0013] S13. Obtain the auxiliary matrix

[0014]

[0015] and

[0016]

[0017] I α Represents an α×α dimensional identity matrix;

[0018] S14. Uniform random sampling public parameters

[0019] S15. Call the TrapGen algorithm to generate an approximately random matrix. and its trapdoor Define B = AR, and use an auxiliary sampling matrix. X represents a... An α×α dimensional matrix in the matrix;

[0020] S16. Using Discrete Gaussian Distribution Sample internal vector in The asterisk (*) in the vector represents the length of the vector, thus constructing the public vector:

[0021]

[0022] S17. Output and gsk:=R.

[0023] Furthermore, the management authority performs the following steps to generate group certificates for users:

[0024] S21. Encode the user's real identity into a binary bit string. The encoding operation is a set mapping that efficiently computes the inverse operation, followed by calculating the check value of the bit string. Finally, randomly select Let i = [i0|i1|i2] ∈ {0,1} l Calculate the integer corresponding to i. The user's system pseudonym is i;

[0025] S22. If i = 0, select i2 again and calculate the new i;

[0026] S23. Random selection calculate

[0027] S24. Call the preimage sampling algorithm on the lattice and use the group private key gsk to generate two small norm vectors. Satisfying the equation:

[0028]

[0029] The specific process includes: selecting a vector through a discrete Gaussian distribution. Then calculate v′=(v-[A|B+iG]p0)i -1 =(v0,v1,…,v α-1 Then calculate Finally, calculate s′=z[R] T |I 3α ]+p0, where the first 2α elements of s′ are The last 3α elements of s′ are

[0030] S25. Output the user's group certificate.

[0031] Furthermore, the encoding operation of the user's real identity is a set mapping for efficient computation of inverse operations; this includes the binary expansion of the user's ID card number, bank card password, or real name.

[0032] Furthermore, the authentication algorithm includes:

[0033] S31. First stage: U→V:(m,π); U uses a specially designed non-interactive zero-knowledge proof system to produce zero-knowledge proofs of m for the following statements: π

[0034] a) User U's internal pseudonym i∈{0,1,…2^l-1};

[0035] b) User U's system certificate The following linear relationship is satisfied:

[0036]

[0037] S32. Second stage: V→U:0 / 1; After receiving the authentication request from U, the request data contains the message proof (m,π) to verify whether U is a legitimate member of the corresponding organization.

[0038] Furthermore, the zero-knowledge argumentation system includes:

[0039] S310. Sampling mask vector y1 represents a distribution D with 2dα elements. σ The vectors sampled in the middle, vectors y2, y3, y4, r, and so on;

[0040] S311. Define i bin =NTT -1 (i), sampling 0 d / l This represents a vector consisting entirely of zeros with d / l elements.

[0041] S312. Calculate the commitment value Commitment value

[0042]

[0043] S313. Calculate the verification vector t = A0y4.

[0044] S314. Calculate the challenge value and

[0045] S315. Call the rejection sampling algorithm on the lattice, select appropriate parameters σ and M, and calculate the response value.

[0046] S316. Calculate vectors

[0047] S317. Calculate the mask vector j = g + i bin NTT -1 (Q T φ)-iNTT -1 (φ);

[0048] S318. Calculate the challenge value

[0049] S319. Call the rejection sampling algorithm on the lattice to select appropriate parameters σ′ and M and calculate the response value z4=y4+er;

[0050] S320. Let π = (f,t,v0,z1,z2,z3,z4,v1,v2,j), and output the message "Prove (m,π)".

[0051] Further, in step S32, V performs the following verification steps:

[0052] S321.

[0053] S322.

[0054] S323.

[0055] S324.

[0056] S325.V extracts the message proof (m, π) from the acquired data packet and calculates the challenge value. and And proceed with the following verification steps:

[0057] S326.A0z4=t+ef0;

[0058] S327.

[0059] S328.

[0060] S329.

[0061]

[0062] S330.(j0,…,j d / l-1 ) = 0;

[0063] S331. If all the above equations are true, V outputs 1 to indicate successful authentication; otherwise, V outputs 0 to indicate authentication failure.

[0064] The present invention also provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described above for constructing an efficient post-quantum pseudonym system based on a ring lattice.

[0065] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which is executed by a processor to implement the above-described method for constructing an efficient post-quantum pseudonym system based on a ring lattice.

[0066] Compared with existing technologies, the advantages of this invention are as follows: The method for constructing an efficient post-quantum pseudonym system based on a ring lattice, implemented using the difficult assumptions (MSIS, MLWE) on a ring lattice, can resist quantum computing attacks. The user certificates generated by this invention are reusable, and different organizations can use different group public and private keys. This invention supports hierarchical structures within organizations, allowing internal users to be finely categorized into different sub-organizations or departments. This invention minimizes the need for certificate lending, as user pseudonyms contain some of the user's real personal information (ID number, bank card password, etc.) and their verification codes, significantly increasing the cost of lending certificates. Compared with existing post-quantum schemes, the method of this invention significantly reduces the size of the organizational public key, user certificate, and interactive data. Attached Figure Description

[0067] Figure 1 This is a schematic diagram of the method flow of the present invention.

[0068] Figure 2 This is a schematic diagram of the present invention used for certificate issuance.

[0069] Figure 3 This is a schematic diagram of the interaction of the user U part in the user authentication algorithm of this invention.

[0070] Figure 4 This is an interactive diagram of the verifier V part in the user authentication algorithm of this invention. Detailed Implementation

[0071] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. The present invention will be described in one embodiment below with reference to specific embodiments. The accompanying drawings are for illustrative purposes only and represent schematic diagrams, not actual pictures, and should not be construed as limiting the present patent. In order to better illustrate the embodiments of the present invention, some parts of the drawings may be omitted, enlarged, or reduced, and do not represent the actual product size. It is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.

[0072] In the description of this invention, it should be understood that if terms such as "upper," "lower," "left," and "right" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, they are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, the terms describing positional relationships in the accompanying drawings are only for illustrative purposes and should not be construed as limiting this patent. For those skilled in the art, the specific meaning of the above terms can be understood according to the specific circumstances. In addition, if the embodiments of this invention involve descriptions of "first," "second," etc., such descriptions are only for descriptive purposes and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Thus, features defined with "first" and "second" may explicitly or implicitly include at least one of those features. Furthermore, the meaning of "and / or" throughout the text is to include three parallel solutions. Taking "A and / or B" as an example, it includes solution A, or solution B, or a solution that simultaneously satisfies A and B.

[0073] Example 1:

[0074] This embodiment provides a method for constructing an efficient post-quantum pseudonym system based on a ring lattice, such as... Figures 1 to 4 As shown;

[0075] First, the parameters and symbols used in this invention will be set and explained:

[0076] ■q=18446744073709557121;

[0077] ■n=93;

[0078] ■d=128;

[0079] ■d0=32;

[0080] ■d1=16;

[0081] ■d2=16;

[0082] ■l=64;

[0083] ■κ=20;

[0084] ■λ=24;

[0085] ■α=24;

[0086] ■σ=199482889599238.75;

[0087] ■σ′=4597.7485968678;

[0088] ■M=33 / 2 ;

[0089] ■ Ring

[0090] ■ Ring

[0091] ■

[0092] ■ Vector, bold italic lowercase letters, such as

[0093] ■Matrix, bold italic uppercase letters, such as

[0094] ■ This indicates a tensor multiplication operation performed on matrices A and B.

[0095] ■<u,v> This indicates that vectors u and v are performing an inner product.

[0096] ■For any Let w denote the Euclidean norm of vector w.

[0097] ■ Functions Defined as in ζ represents the cyclotomic polynomial; function It is the inverse function of NNT.

[0098] ■Distribution express A discrete Gaussian distribution with center at 0 and standard deviation of σ, in sampling When a vector is on, This indicates that all coefficients of the polynomial are sampled on the Gaussian distribution.

[0099] ■Collection Furthermore, the coefficients of each polynomial in this set satisfy a probability distribution.

[0100] ■The distribution χ on {-1,0,1} satisfies that for any r←χ,

[0101] ■ Hash Function The definition is: sha256 takes the first 16 bits.

[0102] ■ Hash Function The definition is as follows: Perform SHA512 on the input and take the first 128 bits to get an array h0. Then perform SHA256 on the input and take the first 128 bits to get an array g0. If the i-th element of g0 and the i-th element of h0 are both 1, then set the i-th element of g0 to -1. Finally, output the sequence g0.

[0103] ■ Hash Function The definition is as follows: Perform SHA384 on the input and modulo q to get the first number. Then perform SHA384 on the first number and modulo q to get the second number, and so on, until l numbers modulo q are obtained. These numbers are used as... The coefficients in the middle thus obtain a The elements on The return value is that element.

[0104] The method in this embodiment specifically includes the following steps:

[0105] Step 1: System Initialization: This probabilistic multinomial-time algorithm completes the creation of a group organization. It takes the system security parameter n as input and outputs the group's public key gpk and the group's private key gsk held by the group's admin center. Specifically, it includes the following seven steps:

[0106] S11. Select the dimensions κ, λ, α of the matrix, and the standard deviations σ, σ′ of the discrete Gaussian distribution, and select the parameters q, d, l, d0, d1, d2. Define the rings mentioned above. ring gather Select the discrete Gaussian distribution mentioned above Choose the above distribution χ, set Number theory transformation function

[0107] S12. Select the above hash function

[0108] S13. Obtain the auxiliary matrix

[0109]

[0110] and

[0111]

[0112] S14. Uniform random sampling public parameters

[0113] S15. Call the TrapGen algorithm for lattice trapdoor sampling, i.e., a uniform random sampling matrix. Then use the χ distribution sampling matrix That is, sample 2α×3α numbers from the χ² distribution, and then convert each number into... The elements in the matrix are then concatenated into a 2α×3α matrix R. The formula B = AR is calculated, and an auxiliary matrix for uniform random sampling is also used.

[0114] S16. Using the above discrete Gaussian distribution Sample internal vector in The asterisk (*) in the vector represents the length of the vector, thus constructing the public vector.

[0115]

[0116] S17. Output and gsk:=R.

[0117] Step 2: Certificate Issuance Algorithm: such as Figure 2 As shown, this probabilistic multinomial-time algorithm completes the addition of a group member. Inputting the group public / private key pair (gpk, gsk) and the real identity of the user to be added (real_identity), the organization's management body (GA) first verifies whether the user's real identity meets the requirements. If verification fails, the GA outputs ⊥ and stops interaction; otherwise, the GA performs the following steps to generate the user's group certificate:

[0118] S21. Let the real identity code of user U be 123456789. Then, by treating this code as an integer, let the binary bit string of this integer be _____. Where l0 = 27. Next, calculate the check value of the bit string. Where l1 = 16, and finally uniformly and randomly selected. Where l2 = 21. Let i = [i0|i1|i2] ∈ {0, 1} l Calculate the integer corresponding to i. The user's system pseudonym is i.

[0119] S22. If i = 0, select i2 again and calculate the new i.

[0120] S23. Selecting using discrete Gaussian distribution calculate

[0121] S24. Call the preimage sampling algorithm on the lattice (using the group private key gsk) to generate two small norm vectors. Satisfy the equation

[0122]

[0123] The specific process is as follows: Selecting a vector using a discrete Gaussian distribution. Then calculate v′=(v-[A|B+iG]p0)i -1 =(v0,v1,…,v α-1 Then calculate

[0124]

[0125] Finally, calculate s′=z[R] T |I 3α ]+p0, where the first 2α elements of s′ are The last 3α elements of s′ are

[0126] S25. Output the user's group certificate.

[0127] Step 3: Authentication Algorithm: This algorithm is a one-way authentication protocol. A group user U holding a message m sends a signature indicating the user's legitimate group identity to a third-party verifier V. V verifies this signature pair m. If V outputs 1 (verification successful), it provides subsequent services to U; if V outputs 0 (verification failed), it refuses to provide services to U. This one-way authentication process, regardless of success or failure, will not reveal U's group identity, i.e., group pseudonym. The specific execution steps of the authentication algorithm include the following two steps:

[0128] S31. For example Figure 3 As shown, the first stage: U→V:(m,π). U uses a specially designed non-interactive zero-knowledge proof system to generate zero-knowledge proofs about m for the following statements:

[0129] a) User U's internal pseudonym i∈{0,1,…2} l -1}.

[0130] b) User U's system certificate The following linear relationship is satisfied:

[0131]

[0132] The zero-knowledge argumentation system described above is described in detail below:

[0133] S310. Sample the mask vector using discrete Gaussian and χ² distributions.

[0134] S311. Calculate i bin =NTT -1 (i), calculate one of the elements That is, the first d / l coefficients of g are all 0, and the remaining coefficients are... The sample is randomly selected from the top.

[0135] S312. Calculate the commitment value Commitment value

[0136] S313. Calculate t=A0y4,

[0137] S314. Calculate the challenge value and

[0138] S315. Call the rejection sampling algorithm on the lattice (selecting the parameters as σ, M) to calculate the response value. For each z j , Where j = {1, 2, 3}, first, randomly and uniformly select rej←[0, 1), then if If the program continues, then proceed; otherwise, return to step S310 and execute again.

[0139] S316. Calculate vectors

[0140] S317. Calculate the mask vector j = g + i bin NTT -1 (Q T φ)-iNTT -1 (φ).

[0141] S318. Calculate the challenge value

[0142] S319. Call the rejection sampling algorithm on the lattice (select the above parameters as σ′, M), calculate the response value z4=y4+er, first randomly and uniformly select rej←[0,1), then if If the program continues, then proceed; otherwise, return to step S310 and execute again.

[0143] S320. Let π = (f,t,v0,z1,z2,z3,z4,v1,v2,j), and output the message "Prove (m,π)".

[0144] S32. For example Figure 4 As shown, in the second phase: V→U: 0 / 1. Upon receiving an authentication request from U (the request data contains the message proof (m,π)), V performs the following verification steps to verify whether U is a legitimate member of the corresponding organization:

[0145] S321.

[0146] S322.

[0147] S323.

[0148] S324.

[0149] S325.V extracts the message proof (m, π) from the acquired data packet and calculates the challenge value. and And proceed with the following verification steps:

[0150] S326.A0z4=t+ef0.

[0151] S327.

[0152] S328.

[0153] S329.

[0154]

[0155] S330.(j0,…,j d / l-1 ) = 0.

[0156] S331. If all the above equations are true, V outputs 1 to indicate successful authentication; otherwise, V outputs 0 to indicate authentication failure.

[0157] This invention provides a method for constructing an efficient post-quantum pseudonym system based on ring lattices. Implementation is based on the difficult assumptions (MSIS, MLWE) on ring lattices, making it resistant to quantum computing attacks. The user certificates generated by this invention are reusable, and different organizations can use different group public and private keys. This invention supports hierarchical structures within organizations, allowing internal users to be finely categorized into different sub-organizations or departments. This invention minimizes the need for certificate lending, as user pseudonyms contain some of the user's real personal information (ID number, bank card password, etc.) and their verification codes, significantly increasing the cost of lending certificates. Compared to existing post-quantum schemes, the method of this invention significantly reduces the size of the generated organizational public key, user certificate, and interactive data.

[0158] Example 2

[0159] This embodiment provides a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor executes the computer program to implement the method for constructing an efficient post-quantum pseudonym system based on a ring lattice as described in Embodiment 1.

[0160] Example 3

[0161] This embodiment provides a computer-readable storage medium storing a computer program that is executed by a processor to implement the method described above for constructing an efficient post-quantum pseudonym system based on a ring lattice.

[0162] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the implementation of the present invention. Those skilled in the art can make other variations or modifications based on the above description. It is neither necessary nor possible to exhaustively describe all embodiments here. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the claims of the present invention.

Claims

1. A method for constructing an efficient post-quantum pseudonym system based on a ring lattice, characterized in that, Includes the following steps: S1. System Initialization: Used to complete the creation of a group organization, including inputting system security parameters. Output the public group key gpk of the group organization and the private group key gsk held by the group's management center; S2. Certificate Issuance Algorithm: Used to complete the addition of a group member; it includes inputting the group's public / private key pair (gpk, gsk), the real identity of the user to be added, and the organization's management structure. First, verify whether the user's real identity meets the requirements; if the verification fails, the management agency will output... And stop interaction; otherwise, the management authority executes a certificate issuance algorithm to generate a group certificate for the user; wherein, the management authority performs the following steps to generate a group certificate for the user: S21. Encode the user's real identity into a binary bit string. The encoding operation is a set mapping that efficiently computes the inversion operation, followed by calculating the check value of the bit string. Finally, randomly select ;make ,calculate The corresponding integer is The user's system pseudonym is ; S22. If Select again And calculate the new ; S23. Random selection ,calculate ; S24. Call the preimage sampling algorithm on the lattice to generate two small norm vectors using the group private key gsk. Satisfying the equation: ； S25. Output the user's group certificate as follows ; S3. Authentication algorithm, i.e., a one-way authentication protocol: holding a certain message group users To a third-party verifier Send about the user A signature for a legitimate group member. Verify this pair The signature, if Outputting 1 indicates successful verification, then... Provide follow-up services; if An output of 0 indicates that verification failed and the request is rejected. Provide services; this one-way authentication process will not disclose information regardless of success or failure. The group identity, also known as the group pseudonym; the authentication algorithm includes: S31. First Stage: ; Using a specially designed non-interactive zero-knowledge argumentation system, generate information about... Zero-knowledge proofs of the following statements : a) User U's internal pseudonym i∈{0,1, 2^l-1}; b) User system certificate The following linear relationship is satisfied: ； S32. Second Stage: Received from After the authentication request, the request data contains a message proof. For verification Whether they are a legitimate member of the corresponding organization.

2. The method for constructing an efficient post-quantum pseudonym system based on a ring lattice according to claim 1, characterized in that, The entity components of the aforementioned pseudonym system include: a group organization management center. The group is responsible for establishing and verifying the real identities of users within the corresponding group organization, and adding trusted users to the group organization. This operation is completed by issuing a unique and valid group certificate to the user; legitimate group members. ,hold The issued group certificate can send signed messages to third-party validators to complete one-way authentication; third-party validators It provides services that are only available to group users, and authenticates a user by verifying the signature sent by a group member.

3. The method for constructing an efficient post-quantum pseudonym system based on a ring lattice according to claim 1, characterized in that, Step S1 specifically includes: S11. Select an appropriate matrix dimension and the standard deviation of the discrete Gaussian distribution And select appropriate parameters ,in Define ring ring ;gather ; The representation is defined on the ring of integers. Polynomial ring on; Represents a polynomial ring A monomial on; Represents the ring of integers. Modulus The remaining class ring below; P One of them is named The polynomial; select a suitable discrete Gaussian distribution. Choose the appropriate Distribution on Select a suitable set Let the number-theoretic transformation be a function. ; S12. Select three suitable hash functions ; S13. Take the auxiliary matrix and ； S14. Uniform random sampling public parameters ; S15. Call the TrapGen algorithm to generate an approximately random matrix. and its trapdoor ,definition Additionally, sampling auxiliary matrix ; Indicates a In A 3D matrix; S16. Using Discrete Gaussian Distribution Sample internal vector ,in In The length of the vector is used to construct the public vector: ； S17. Output gpk: And GSK: .

4. The method for constructing an efficient post-quantum pseudonym system based on a ring lattice according to claim 1, characterized in that, Step S24 specifically includes: selecting a vector through a discrete Gaussian distribution. , Then calculate , Next calculation ； Final calculation ,in The former The element is , After The element is .

5. The method for constructing an efficient post-quantum pseudonym system based on a ring lattice according to claim 1, characterized in that, The zero-knowledge argumentation system includes: S310. Sampling mask vector ; S311. Definition ,sampling ; S312. Calculate the commitment value Commitment value ; S313. Calculate the verification vector , ; S314. Calculate the challenge value and ; S315. Call the rejection sampling algorithm on the lattice and select appropriate parameters. Calculate the response value ; S316. Calculate vectors , ; S317. Calculate the mask vector ; S318. Calculate the challenge value ; S319. Call the rejection sampling algorithm on the lattice to select appropriate parameters. Calculate response value ; S320. Order Output message to prove .

6. The method for constructing an efficient post-quantum pseudonym system based on a ring lattice according to claim 1, characterized in that, In step S32, V performs the following verification steps: S321. ； S322. ； S323. ； S324. ； S325. Extracting message proof from the acquired data packet Calculate the challenge value , and And so proceed with the following verification steps: S326. ； S327. ； S328. ； S329. ； S330. ； S331. If all the above equations are true. An output of 1 indicates successful authentication; otherwise... An output of 0 indicates that authentication failed.

7. A computer device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the computer program to implement the method for constructing an efficient post-quantum pseudonym system based on a ring lattice as described in any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by a processor to implement the method for constructing an efficient post-quantum pseudonym system based on a ring lattice as described in any one of claims 1 to 6.

Images