Identity-based structure-preserving equivalence class signature generation method and system

Abstract

The application discloses an identity-based structure-maintaining equivalence class signature generation method and system, wherein the method comprises the following steps: 1) a key generation center KGC generates a key for a user; 2) a signer generates a signature for a message equivalence class representative element; 3) a verifier verifies the signature; and 4) a user obtaining an original signature can randomize a signed message in a specific manner, or randomize a corresponding signature without knowing the key. The application has the advantages of high security, scalability, perfect functions and the like, and can be applied to multiple fields such as anonymous credentials, group signature, purifiable signature and the like.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to an identity-based structure-preserving equivalence class signature generation method and system. Background Technology

[0002] Structure-preserving signatures (SPS) are a crucial building block for privacy-preserving cryptographic primitives. They are bilinear pairing-based signature schemes where the message, signature, and verification key consist only of source group elements, and signature verification involves only group membership checks and pairwise product equations. SPS are compatible with Groth-Sahai's non-interactive zero-knowledge proofs and help avoid costly exponent extraction operations in security proofs, making them highly favored in modular protocol designs that rely on signatures and non-interactive zero-knowledge proofs. SPS are widely used in privacy-preserving applications such as electronic cash, anonymous credentials, and group signatures.

[0003] Structure-Preserving Signatures on Equivalence Classes (SPS-EQ) is a signature scheme developed by Fuchsbauer et al. to extend randomization. It allows for the randomization of signed messages in specific ways, as well as the randomization of the corresponding signatures without requiring knowledge of the key. This signature scheme is particularly valuable in privacy-enhancing cryptographic protocols because it avoids costly zero-knowledge proofs.

[0004] However, existing structure-preserving equivalence class signatures are all based on PKI cryptography, which makes key management quite complex. Summary of the Invention

[0005] Since structure-preserving equivalence class signature schemes are all based on PKI cryptosystems, in order to fully leverage the advantages of identity-based cryptosystems, this invention designs an identity-based structure-preserving equivalence class signature generation method and system. This scheme is jointly executed by a Key Generation Center (KGC), a signer, and a verifier, which can guarantee the correctness of the signature, as well as its unforgeability and perfect adaptability.

[0006] The first aspect of this invention provides an identity-based structure-preserving equivalence class signature generation method, comprising:

[0007] The key generation center generates publicly available system parameters;

[0008] The key generation center generates keys for users based on publicly available system parameters, the user's real identity, and the length of the message vector. The user key includes the user's anonymous identity and the user's private key.

[0009] The user acts as the signer, generating a signature based on the user's anonymous identity, the user's private key, and a representative meta-class of the message equivalence class.

[0010] The verifier verifies the user-generated signature based on the user's anonymous identity, auxiliary information, master public key, and a representative element of the message equivalence class;

[0011] The user who obtains the original signature can randomize the corresponding signature without knowing the key.

[0012] In one implementation, the key generation center generates publicly disclosed parameters, including:

[0013] Input security parameter κ;

[0014] Choose a q-order cyclic group P, e, P, yes The generator, e is It is a bilinear mapping;

[0015] Select random number The system computes a master private key and a master public key, where the master private key msk = s, and the master public key...

[0016] Choose a safe hash function and

[0017] Generate system public parameters

[0018] In one implementation, the key generation center generates a key for the user based on publicly available system parameters, the user's real identity, and the message vector length parameter, including:

[0019] Input the system's publicly available parameter BG, the user's real identity RID, and the message vector length parameter l;

[0020] Select random number Calculate the anonymous identity AID of user U = (AID) i ) i∈[l+1] ,in

[0021] For i∈[l], calculate the user's private key.

[0022] The user key (AID, sk) is transmitted through a secure channel. ID )Sent to user U.

[0023] In one implementation, the user, as the signer, generates a signature based on the user's anonymous identity, the user's private key, and a representative meta-class of the message equivalence class, including:

[0024] Input the user's anonymous identity AID and the user's private key sk ID And a representative element of message equivalence class

[0025] Choose a random number For i∈[l], calculate R i For supplementary information;

[0026] For i∈[l], calculate α i As an intermediate variable;

[0027] Choose a random number

[0028] Calculate Z = β∑ i∈[l] α i *M i , Z, Y, This is the middle value of the signature;

[0029] Output signature value

[0030] In one implementation, the verifier verifies the user-generated signature based on the user's anonymous identity, auxiliary information, master public key, and a representative element of the message equivalence class, including:

[0031] Input user U's anonymous identity AID, auxiliary information (R) i ) i∈[l] Master public key MPK, structure-preserving equivalence class A representative element and signature

[0032] For i∈[l], calculate a i b i It is a hash value;

[0033] Verify the following equation: If the statement is true, output 1 to indicate that the verification passed; otherwise, output 0 to indicate that the verification failed.

[0034] In one implementation, the user who obtains the original signature randomizes the corresponding signature without knowing the key, including:

[0035] Input message equivalence class A representative element sign A random scalar User U's anonymous identity AID, auxiliary information (R) i ) i∈[l] And the master public key MPK;

[0036] Call The algorithm verifies whether the signature σ is valid. If it is valid, it continues; otherwise, it exits. Verify() is the signature verification algorithm.

[0037] Random selection Output in ψ is the updated representative element, σ′ is the random number, and σ′ is the randomized signature.

[0038] Based on the same inventive concept, a second aspect of the present invention provides an identity-based structure-preserving equivalence class signature generation system, comprising:

[0039] The system initialization module is used to generate publicly available system parameters through the key generation center;

[0040] The user key generation module is used to generate keys for users through the key generation center based on the system's public parameters, the user's real identity, and the message vector length parameter. The user key includes the user's anonymous identity and the user's private key.

[0041] The signature module is used to generate a signature by having a user as the signer and based on the user's anonymous identity, the user's private key, and a representative element of the message equivalence class.

[0042] The verification module is used to verify the signature generated by the user by a verifier based on the user's anonymous identity, auxiliary information, master public key, and a representative element of message equivalence class;

[0043] The randomization module is used to randomize the corresponding signature by a user who has obtained the original signature without knowing the key.

[0044] Based on the same inventive concept, a third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect.

[0045] Based on the same inventive concept, a fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in the first aspect.

[0046] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0047] (1) Based on identity cryptography, it simplifies key management and reduces the complexity of key distribution; (2) It avoids the expensive zero-knowledge proofs in privacy-enhancing cryptographic protocols; (3) It has the characteristics of simple implementation, high security and easy verification. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 The flowchart illustrates the signature and verification process of the identity-based structure-preserving equivalence class signature generation method provided in this embodiment of the invention. Detailed Implementation

[0050] This invention discloses an identity-based structure-preserving equivalence class signature generation method and system. The method includes the following steps: 1) A Key Generation Center (KGC) generates system public parameters to generate keys for users; 2) The signer generates a signature based on the message equivalence class representative element; 3) The verifier verifies the signature; 4) Users who obtain the original signature can randomize the signed message in a specific way, or randomize the corresponding signature without knowing the key. This invention has advantages such as high security, scalability, and comprehensive functionality, and can be applied to multiple fields such as anonymous credentials, group signatures, and sanitizable signatures.

[0051] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0052] Example 1

[0053] This invention provides an identity-based structure-preserving equivalence class signature generation method, comprising:

[0054] The key generation center generates publicly available system parameters;

[0055] The key generation center generates keys for users based on publicly available system parameters, the user's real identity, and the length of the message vector. The user key includes the user's anonymous identity and the user's private key.

[0056] The user acts as the signer, generating a signature based on the user's anonymous identity, the user's private key, and a representative meta-class of the message equivalence class.

[0057] The verifier verifies the user-generated signature based on the user's anonymous identity, auxiliary information, master public key, and a representative element of the message equivalence class;

[0058] The user who obtains the original signature can randomize the corresponding signature without knowing the key.

[0059] The specific symbols used and involved in this application are described as follows:

[0060] q: a large prime number.

[0061] The set of integers consisting of 0, 1, 2, ..., q-1.

[0062] An additive cyclic group of order q.

[0063] A multiplicative cyclic group of order q.

[0064] κ: Safety parameter.

[0065] P, Groups The generator.

[0066] uP: group The point where element P is a multiple of u.

[0067] e: from arrive The bilinear pairing mapping.

[0068] Cryptographic functions derived from cryptographic hash functions are...

[0069] Cryptographic functions derived from cryptographic hash functions are...

[0070] msk: The system's master private key, held by the key generation center KGC.

[0071] MPK: System Master Public Key Released by KGC.

[0072] BG: System publicly available parameters.

[0073] RID: The user's real identity.

[0074] AID: The user's anonymous identity.

[0075] l: The length of the message vector.

[0076] Messages awaiting signature It is a message equivalence class representative element.

[0077] sk ID User's private key.

[0078] σ: Signature value.

[0079] R i : Auxiliary information.

[0080] s i ,β,ψ,μ: random numbers.

[0081] α i ,b i : Hash value.

[0082] α i : Intermediate variable.

[0083] Specifically, this invention provides an identity-based structure-preserving equivalence class signature generation method, including a key generation center (KGC), a signer, and a verifier; wherein, the KGC is responsible for generating the private keys of the signing users within the system, and generating identity-based structure-preserving equivalence class signatures. Specifically, the method includes system initialization Setup(1 κ User key generation Extract(BG,RID,l): Signature verify and randomization The process involves five steps. First, the Key Generation Center (KGC) inputs the security parameter κ and generates the system public parameter BG. The public parameter BG serves as the default input for subsequent steps. Next, the KGC generates a user key for the user. Then, the signer generates a signature value representing a key, which is verified by the verifier. Finally, the user who obtained the original signature randomly generates the corresponding signature without knowing the key.

[0084] It should be noted that the equivalence class in the structure-preserving equivalence class in this invention refers to the message equivalence class, and the two have the same meaning in the following text. Furthermore, after generating the signature, the signer sends the signature to the user who requested the signature; therefore, the user who receives the original signature refers to the user who requested the signature.

[0085] Please see Figure 1 This is a flowchart illustrating the signature and verification process of the identity-based structure-preserving equivalence class signature generation method provided in this embodiment of the invention.

[0086] In one implementation, the key generation center generates publicly disclosed parameters, including:

[0087] Input security parameter κ;

[0088] Choose a q-order cyclic group P, e, P, yes The generator, e is It is a bilinear mapping;

[0089] Select random number The system computes a master private key and a master public key, where the master private key msk = s, and the master public key...

[0090] Choose a safe hash function and

[0091] Generate system public parameters

[0092] It should be noted that the security parameter κ refers to the bit length of order q.

[0093] In one implementation, the key generation center generates a key for the user based on publicly available system parameters, the user's real identity, and the message vector length parameter, including:

[0094] Input the system's publicly available parameter BG, the user's real identity RID, and the message vector length parameter l;

[0095] Select random number Calculate user Y's anonymous identity AID = (AID) i ) i∈[l+1] ,in

[0096] For i∈[l], calculate the user's private key.

[0097] The user key (AID, sk) is transmitted through a secure channel. ID )Sent to user U.

[0098] Specifically, (AID) i ) i∈[l] AID l+1 It is a component of a user's anonymous identity.

[0099] In one implementation, the user, as the signer, generates a signature based on the user's anonymous identity, the user's private key, and a representative meta-class of the message equivalence class, including:

[0100] Input the user's anonymous identity AID and the user's private key sk ID And a representative element of message equivalence class

[0101] Choose a random number For i∈[l], calculate R i For supplementary information;

[0102] For i∈[l], calculate α i As an intermediate variable;

[0103] Choose a random number

[0104] calculate Z, Y, This is the middle value of the signature;

[0105] Output signature value

[0106] In one implementation, the verifier verifies the user-generated signature based on the user's anonymous identity, auxiliary information, master public key, and a representative element of the message equivalence class, including:

[0107] Input user U's anonymous identity AID, auxiliary information (R) i ) i∈[l] Master public key MPK, message equivalence class A representative element and signature

[0108] For i∈[l], calculate a i b i It is a hash value;

[0109] Verify the following equation: If the statement is true, output 1 to indicate that the verification passed; otherwise, output 0 to indicate that the verification failed.

[0110] Specifically, during the verification process, the first step is to determine... Whether it is true or false, then make a judgment. If both conditions are met, the verification passes and outputs 1. If either condition is not met or neither condition is met, the verification fails and outputs 0.

[0111] In one implementation, the user who obtains the original signature randomizes the corresponding signature without knowing the key, including:

[0112] Input message equivalence class A representative element sign A random scalar User U's anonymous identity AID, auxiliary information (R) i ) i∈[l] And the master public key MPK;

[0113] Call The algorithm verifies whether the signature σ is valid. If it is valid, it continues; otherwise, it exits. Verify() is the signature verification algorithm.

[0114] Random selection Output in ψ is the updated representative element, σ′ is the random number, and σ′ is the randomized signature.

[0115] Specifically, after inputting the relevant parameters, the validity of the signature σ is first verified by the signature verification algorithm. If it is valid, the subsequent steps continue; otherwise, the process ends.

[0116] Compared with existing technologies, the present invention has the following advantages: (1) Based on identity cryptography, it simplifies key management and reduces the complexity of key distribution; (2) It avoids the expensive zero-knowledge proof in privacy-enhancing cryptographic protocols; (3) It has the characteristics of simple implementation, high security and easy verification.

[0117] Example 2

[0118] Based on the same inventive concept, this embodiment provides an identity-based structure-preserving equivalence class signature generation system, including:

[0119] The system initialization module is used to generate publicly available system parameters through the key generation center;

[0120] The user key generation module is used to generate keys for users through the key generation center based on the system's public parameters, the user's real identity, and the message vector length parameter. The user key includes the user's anonymous identity and the user's private key.

[0121] The signature module is used to generate a signature by having a user as the signer and based on the user's anonymous identity, the user's private key, and a representative element of the message equivalence class.

[0122] The verification module is used to verify the signature generated by the user by a verifier based on the user's anonymous identity, auxiliary information, master public key, and a representative element of message equivalence class;

[0123] The randomization module is used to randomize the corresponding signature by a user who has obtained the original signature without knowing the key.

[0124] Since the system described in Embodiment 2 of this invention is the system used to implement the identity-based structure-preserving equivalence class signature generation method in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this system based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All systems used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0125] Example 3

[0126] Based on the same inventive concept, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in Embodiment 1.

[0127] Since the computer-readable storage medium described in Embodiment 3 of this invention is the same computer-readable storage medium used in implementing the identity-based structure-preserving equivalence class signature generation method in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this computer-readable storage medium based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All computer-readable storage media used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0128] Example 4

[0129] Based on the same inventive concept, this application also provides a computer device, including storage, a processor, and a computer program stored in the storage and executable on the processor, wherein the processor executes the program to implement the method in Embodiment 1.

[0130] Since the computer device described in Embodiment 4 of this invention is the same computer device used to implement the identity-based structure-preserving equivalence class signature generation method in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this computer device based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All computer devices used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0131] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0132] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0133] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention.

[0134] Obviously, those skilled in the art can make various modifications and variations to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if these modifications and variations to the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention also intends to include these modifications and variations.

Claims

1. A method for generating identity-based structure-preserving equivalence class signatures, characterized in that, include: The key generation center generates publicly available system parameters; The key generation center generates keys for users based on publicly available system parameters, the user's real identity, and the length of the message vector. The user key includes the user's anonymous identity and the user's private key. The user acts as the signer, generating a signature based on the user's anonymous identity, the user's private key, and a representative meta-class of the message equivalence class. The verifier verifies the user-generated signature based on the user's anonymous identity, auxiliary information, master public key, and a representative element of the message equivalence class; The user who obtains the original signature can randomize the corresponding signature without knowing the key; The public parameters of the key generation center generation system include: Input security parameters ; choose Cyclic group , , , , They are respectively generator, for It is a bilinear mapping; Select random number The computing system's master private key and master public key, where the master private key... public key ; Choose a safe hash function , and ; Generate system public parameters ; The key generation center generates keys for users based on publicly available system parameters, the user's real identity, and the message vector length parameter, including: Input system public parameters The user's real identity and the message vector length parameter ; Select random number Calculate users Anonymous identity ,in , ; for Calculate user private key ; User key via secure channel Send to user ; The user, acting as the signer, generates a signature based on their anonymous identity, private key, and a representative meta-class of the message equivalence class, including: Enter the user's anonymous identity User private key And a representative element of message equivalence class ; Choose a random number ,for ,calculate , For supplementary information; for ,calculate mod , As an intermediate variable; Choose a random number ; calculate , , , , , This is the middle value of the signature; Output signature value ; The verifier verifies the user-generated signature based on the user's anonymous identity, auxiliary information, master public key, and a representative element of the message equivalence class, including: Enter user Anonymous identity Auxiliary information public key A representative element and signature ; for ,calculate , , , It is a hash value; Verify the following equation: If the condition is met, output 1 to indicate that the verification passed; otherwise, output 0 to indicate that the verification failed. The user who obtains the original signature can randomize the corresponding signature without knowing the key, including: Input message equivalence class A representative element ,sign A random scalar ,user Anonymous identity Auxiliary information and the master key ; Call Algorithm verification signature Is it legal? If legal, continue; otherwise, exit. () represents the signature verification algorithm; Random selection Output ,in It is the updated representative element. Random numbers .

2. An identity-based structure-preserving equivalence class signature generation system, used to implement the method as described in claim 1, characterized in that, include: The system initialization module is used to generate publicly available system parameters through the key generation center; The user key generation module is used to generate keys for users through the key generation center based on the system's public parameters, the user's real identity, and the message vector length parameter. The user key includes the user's anonymous identity and the user's private key. The signature module is used to generate a signature by having a user as the signer and based on the user's anonymous identity, the user's private key, and a representative element of the message equivalence class. The verification module is used to verify the signature generated by the user by a verifier based on the user's anonymous identity, auxiliary information, master public key, and a representative element of message equivalence class; The randomization module is used to randomize the corresponding signature by a user who has obtained the original signature without knowing the key.

3. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in claim 1.

4. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in claim 1.

Images