Security signature method and device

Abstract

The embodiment of the present invention provides a secure signature method and device, the method comprising: for a target device in a first device, the target device randomly selects a first secret value, splits the first secret value into multiple secret shares equal to the number of devices included in the first device, and secretly shares different secret shares with different devices in the first device, wherein the target device is any device in the first device. The target device receives and stores the corresponding secret shares in the multiple secret values ​​secretly shared by other devices in the first device, wherein the other devices are devices in the first device other than the target device. The second device recovers the signature private key based on the corresponding secret shares in the multiple secret values ​​stored locally, and calculates the corresponding public key based on the signature private key. The second device performs a distributed signature operation based on the signature private key and the public key. The decentralized process of the signature system can be realized, and the security of the signature private key is improved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a security signature method and device. Background Art

[0002] In practical applications, the SM2 threshold signature algorithm (SM2 is an elliptic curve public key cryptography algorithm issued by the State Cryptography Administration) can be used to implement the signature operation. In the SM2 threshold signature algorithm, you first need to find a trusted third party, who will generate a signature private key and keep the signature private key. The trusted third party will split the complete signature private key into n parts according to the set method, and distribute the different signature private key components obtained by the splitting to n different devices. Each device can only obtain the corresponding signature private key component.

[0003] When a signature is required, at least t devices can be selected from the above n devices according to the set rules, where t is the set threshold. The at least t devices can collaborate to complete the signature operation with their own signature private key components, while the collaboration of less than t devices cannot complete the signature operation. Since the complete signature private key is not stored in any single device among the n devices, if an attacker wants to decipher the complete signature private key, he needs to decipher the signature private key components in at least t devices to restore the complete signature private key. This operation is difficult, thereby achieving the protection of the signature private key.

[0004] However, since the premise of adopting the above solution is that a trusted third party needs to generate a signature private key, then the trusted third party actually knows the complete signature private key. If an attacker directly attacks the trusted third party, the signature private key will be greatly threatened. Therefore, a new solution is urgently needed to ensure the security of the signature private key and thus improve the reliability of the signature operation. Summary of the invention

[0005] The embodiment of the present invention provides a secure signature method and device, which are used to improve the security of a signature private key and improve the reliability of a signature operation.

[0006] In a first aspect, an embodiment of the present invention provides a secure signature method, which is applied to a signature system, wherein the signature system includes a first device and a second device, wherein the first device includes the second device, the second device is a device that actually participates in the signature process, and the number of devices included in the first device and the number of devices included in the second device satisfy a preset quantity relationship;

[0007] The method comprises:

[0008] For a target device in the first devices, the target device randomly selects a first secret value, splits the first secret value into a plurality of secret shares whose number is equal to the number of devices included in the first devices, and secretly shares different secret shares with different devices in the first devices, wherein the target device is any device in the first devices;

[0009] The target device receives and stores corresponding secret shares of a plurality of secret values ​​secretly shared by other devices in the first device, wherein the other devices are devices in the first device other than the target device;

[0010] The second device recovers the signature private key based on the corresponding secret shares of the multiple secret values ​​stored locally, and calculates the corresponding public key based on the signature private key;

[0011] The second device performs a distributed signature operation based on the signature private key and the public key.

[0012] Optionally, splitting the first secret value into a plurality of secret shares whose number is equal to the number of devices included in the first device comprises:

[0013] Constructing a t-order polynomial, wherein t is a set threshold, and the number of devices included in the second device is at least t;

[0014] Based on the t-order polynomial, the first secret value is split into a plurality of secret shares whose number is equal to the number of devices included in the first device.

[0015] Optionally, after the target device receives and stores corresponding secret shares of a plurality of secret values ​​secretly shared by other devices in the first device, the method further includes:

[0016] The target device performs a sum operation on the secret shares of the multiple secret values ​​stored locally to obtain a signature private key component, and shares the signature private key component with a device in the first device;

[0017] The target device determines a corresponding public key component according to the signature private key component, and shares the public key component with a device in the first device;

[0018] The recovering the signature private key and calculating the corresponding public key based on the signature private key includes:

[0019] Performing a sum operation on the signature private key components calculated by all devices in the first device to recover the signature private key;

[0020] A sum operation is performed on the public key components calculated by all the devices in the first device to obtain a public key corresponding to the signature private key.

[0021] Optionally, the second device performs a distributed signature operation based on the signature private key and the public key, including:

[0022] For a third device in the second device, the third device randomly selects a second secret value, splits the second secret value into a plurality of secret shares whose number is equal to the number of devices included in the second device, and secretly shares different secret shares with different devices in the second device, wherein the third device is any device in the second device;

[0023] The third device receives and stores corresponding secret shares of a plurality of secret values ​​secretly shared by other devices in the second device, wherein the other devices are devices in the second device other than the target device;

[0024] The third device performs a sum operation on the secret shares in the multiple secret values ​​stored locally to obtain a target private key component;

[0025] A signing operation is performed based on the target private key components calculated by each device in the second device.

[0026] Optionally, the performing a signing operation based on a target private key component calculated by each device in the second device includes:

[0027] Each device in the second device performs a 2t-order secret sharing operation without a trusted center, wherein the secret shared in the 2t-order secret sharing operation without a trusted center is 0, the secret share obtained by each device in the second device is the first component, t is a set threshold, and the number of devices included in the second device is at least t;

[0028] Determine a second component corresponding to the third device based on the first component corresponding to the third device, the target private key component, and the signature private key component;

[0029] Determine, based on the first component and the second component, a third component corresponding to the third device;

[0030] A signing operation is performed based on the third component corresponding to each device in the second device.

[0031] Optionally, performing the signing operation based on the third component corresponding to each device in the second device includes:

[0032] Generate a random number k, and perform a t-order secret sharing operation of the random number k without a trusted center in the second device, wherein the secret share obtained by each device in the second device is a fourth component;

[0033] Based on the fourth component, determining a fifth component;

[0034] A signature result is generated based on the third component, the fourth component, and the fifth component corresponding to each device in the second device.

[0035] In a second aspect, an embodiment of the present invention provides a secure signature device, which is arranged in a signature system, wherein the signature system includes a first device and a second device, wherein the first device includes the second device, and the second device is a device that actually participates in the signature process, and the number of devices included in the first device and the number of devices included in the second device satisfy a preset quantity relationship;

[0036] The device comprises:

[0037] a secret sharing module, configured to randomly select a first secret value for a target device in the first devices, split the first secret value into a plurality of secret shares equal in number to the number of devices included in the first devices, and secretly share different secret shares with different devices in the first devices, wherein the target device is any device in the first devices;

[0038] a receiving module, configured to receive and store corresponding secret shares of a plurality of secret values ​​secretly shared by other devices in the first device, wherein the other devices are devices in the first device other than the target device;

[0039] A recovery module, configured to recover a signature private key based on corresponding secret shares of the multiple secret values ​​stored locally, and calculate a corresponding public key based on the signature private key;

[0040] The signature module is used to perform a distributed signature operation based on the signature private key and the public key.

[0041] Optionally, the secret sharing module is used to:

[0042] Constructing a t-order polynomial, wherein t is a set threshold, and the number of devices included in the second device is at least t;

[0043] Based on the t-order polynomial, the first secret value is split into a plurality of secret shares whose number is equal to the number of devices included in the first device.

[0044] Optionally, the apparatus further comprises a sharing module, the sharing module being configured to sum the secret shares in the multiple secret values ​​stored locally to obtain a signature private key component, and share the signature private key component with a device in the first device; determine a corresponding public key component according to the signature private key component, and share the public key component with a device in the first device;

[0045] The recovery module is used to sum the signature private key components calculated by all devices in the first device to recover the signature private key; and sum the public key components calculated by all devices in the first device to obtain a public key corresponding to the signature private key.

[0046] Optionally, the signature module is used to:

[0047] For a third device in the second device, randomly select a second secret value, split the second secret value into a plurality of secret shares equal in number to the number of devices included in the second device, and secretly share different secret shares with different devices in the second device, wherein the third device is any device in the second device;

[0048] Receiving and storing corresponding secret shares of a plurality of secret values ​​secretly shared by other devices in the second device, wherein the other devices are devices in the second device other than the target device;

[0049] Summing the secret shares in the multiple secret values ​​stored locally to obtain a target private key component;

[0050] A signing operation is performed based on the target private key components calculated by each device in the second device.

[0051] Optionally, the signature module is used to:

[0052] Performing a 2t-order secret sharing operation without a trusted center through each device in the second device, wherein the secret shared in the 2t-order secret sharing operation without a trusted center is 0, the secret share obtained by each device in the second device is the first component, t is a set threshold, and the number of devices included in the second device is at least t;

[0053] Determine a second component corresponding to the third device based on the first component corresponding to the third device, the target private key component, and the signature private key component;

[0054] Determine, based on the first component and the second component, a third component corresponding to the third device;

[0055] A signing operation is performed based on the third component corresponding to each device in the second device.

[0056] Optionally, the signature module is used to:

[0057] Generate a random number k, and perform a t-order secret sharing operation of the random number k without a trusted center in the second device, wherein the secret share obtained by each device in the second device is a fourth component;

[0058] Based on the fourth component, determining a fifth component;

[0059] A signature result is generated based on the third component, the fourth component, and the fifth component corresponding to each device in the second device.

[0060] In the present application, for a target device in a first device, the target device randomly selects a first secret value, splits the first secret value into multiple secret shares equal to the number of devices included in the first device, and secretly shares different secret shares with different devices in the first device, wherein the target device is any device in the first device. The target device receives and stores corresponding secret shares in multiple secret values ​​secretly shared by other devices in the first device, wherein the other devices are devices other than the target device in the first device. The second device recovers the signature private key based on the corresponding secret shares in the multiple secret values ​​stored locally, and calculates the corresponding public key based on the signature private key. The second device performs a distributed signature operation based on the signature private key and the public key.

[0061] By adopting this application, the decentralization process of the signature system can be realized, that is, there is no need to generate and keep the signature private key through a trusted third party, but each first device in the signature system acts as a central device to secretly share its own private key, and these private keys are combined together to form the signature private key. It can be seen that by adopting this method, first of all, the security of the signature process no longer depends on a separate third party, and the signature private key is not generated and managed in the third party, so that the attacker cannot decipher the signature private key by attacking the third party alone. By adopting this application, if the attacker wants to decipher the signature private key, then at least t second devices in the first device need to be intercepted to restore the complete signature private key. It can be seen that the use of this application can greatly improve the security of the signature private key, thereby ensuring the security of the signature process. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0063] Figure 1 A schematic diagram of the structure of a signature system provided by an embodiment of the present invention;

[0064] Figure 2 A schematic diagram of a process flow of a secure signature method provided by an embodiment of the present invention;

[0065] Figure 3 A schematic diagram of the structure of a secure signature device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0067] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings, and "multiple" generally includes at least two.

[0068] As used herein, the words "if" and "if" may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0069] In addition, the step sequence in the following method embodiments is only an example and not a strict limitation.

[0070] The embodiment of the present invention provides a secure signature method, which can be applied to a signature system. Figure 1 As shown, the signature system may include a first device and a second device. The first device includes the second device, the first device may be considered as all devices holding signature private key components in the signature system, the second device may be a device actually participating in the signature process, and the number of the first device and the number of the second device satisfy a preset quantity relationship.

[0071] Assuming that the number of first devices is n, the number of second devices is s, and the threshold is t, then in a possible implementation, , and also need to satisfy In practical applications, for a complete signature private key d, the signature private key d will be split into n signature private key components, each first device corresponds to a signature private key component, and different first devices correspond to different signature private key components. In addition, during the signing process, s second devices need to participate in the signing process. When At this time, these s second devices can recover the complete signature private key and successfully complete the signing process.

[0072] Figure 2 A flowchart of a secure signature method provided by an embodiment of the present invention, such as Figure 2 As shown, the method comprises the following steps:

[0073] 201. For a target device in the first device, the target device randomly selects a first secret value, splits the first secret value into multiple secret shares whose number is equal to the number of devices included in the first device, and secretly shares different secret shares with different devices in the first device, wherein the target device is any device in the first device.

[0074] 202. The target device receives and stores corresponding secret shares of a plurality of secret values ​​secretly shared by other devices in the first device, wherein the other devices are devices other than the target device in the first device.

[0075] 203. The second device recovers the signature private key based on the corresponding secret shares in the multiple secret values ​​stored locally, and calculates the corresponding public key based on the signature private key.

[0076] 204. The second device performs a distributed signature operation based on the signature private key and the public key.

[0077] In practical applications, it is assumed that the first device is recorded as , t is the set threshold, and the target device is recorded as , is any device in the first device, wherein i is the i-th device in the first device. The target device can perform a t-order secret sharing operation without a trusted center.

[0078] Specifically, the process of performing the t-order secret sharing operation without a trusted center can be implemented as follows: the target device can randomly select a first secret value, which can be expressed as It should be noted that the first secret value is a private key of the target device that is randomly generated locally. After obtaining the first secret value, the target device can split the first secret value into n secret shares and secretly share the n secret shares with different devices in the first device. Assume is any device other than the target device in the first device, for For example, You can obtain the first secret value shared by the target device that is exclusive to The secret share.

[0079] Optionally, the process of splitting the first secret value into n secret shares can be implemented as follows: constructing a t-order polynomial, where t is a set threshold and the number of devices included in the second device is at least t; based on the t-order polynomial, splitting the first secret value into n secret shares.

[0080] The above polynomial can be expressed as , where we can set is the first secret value, then . Based on the t-order polynomial constructed above, and , split the first secret value into n secret shares.

[0081] Each device in the first device can generate its own secret value by referring to the above method, and then split the generated secret value into n parts by secret sharing and share the split secret shares with the corresponding devices. Then all devices in the first device can generate n secret values ​​in total, and these secret values ​​are combined to form the signature private key d.

[0082] By adopting the above method, the decentralization process of the signature system can be realized, that is, there is no need to generate and keep the signature private key through a trusted third party, but each first device in the signature system acts as a central device to secretly share its own private key, and these private keys are combined together to form the signature private key. It can be seen that by adopting this method, first of all, the security of the signature process no longer depends on a single third party, and the signature private key is not generated and managed in the third party, so that the attacker cannot decipher the signature private key by only attacking the third party. With this application, if the attacker wants to decipher the signature private key, then at least t second devices in the first device need to be intercepted to restore the complete signature private key. It can be seen that the use of this application can greatly improve the security of the signature private key, thereby ensuring the security of the signature process.

[0083] As mentioned above, for For example, If the first device can receive secret shares sent by n-1 other devices, then a total of n-1 secret shares can be received, and the n-1 secret shares are split from the secret values ​​randomly generated by different devices. The received secret share is recorded as , where j is the jth device in the first device, is the current device, i is the i-th device among the other devices in the first device, for Received The secret share to send.

[0084] exist Receive secret shares from n-1 other devices Afterwards, based on n-1 as well as The corresponding calculation , . Then, in obtaining Afterwards, based on calculate , . Where G is the constant point of the generating point.

[0085] It is understood that the target device can also be used as Based on the above introduction, optionally, after the target device receives and stores the corresponding secret shares in the multiple secret values ​​secretly shared by other devices in the first device, the target device sums the secret shares in the multiple secret values ​​stored locally to obtain the signature private key component, and shares the signature private key component with the devices in the first device; the target device determines the corresponding public key component based on the signature private key component, and shares the public key component with the devices in the first device;

[0086] Among them, the signature private key component is , and The calculation method of is the same, so I will not elaborate on it here. The public key component is , .

[0087] It is understandable that, for each device in the first device, in addition to knowing the complete secret value randomly generated locally, each device also knows the corresponding secret share of other secret values ​​shared by other devices. After knowing this information, any second device greater than or equal to t in the first device can be combined together to restore the complete signature private key, thereby completing the signing process.

[0088] The following describes a process in which the second device recovers the signature private key and calculates the corresponding public key based on the signature private key.

[0089] Optionally, the process of recovering the signature private key and calculating the corresponding public key based on the signature private key can be implemented as follows: summing up the signature private key components calculated by all devices in the first device to recover the signature private key; summing up the public key components calculated by all devices in the first device to obtain the public key corresponding to the signature private key.

[0090] Among them, the above signature private key can be expressed as ,have After recovering the signature private key, the corresponding public key can be calculated , .

[0091] In the above manner, without the intervention of a trusted third party, each device in the first device can act as a central device to randomly generate its own secret value and perform a t-order secret sharing operation without a trusted center. Through the above process, the signature system can negotiate a signature private key and a corresponding public key.

[0092] After obtaining the signature private key and the corresponding public key, the distributed signature operation can be performed in the next process.

[0093] Optionally, based on the signature private key and the public key, the process of performing a distributed signature operation can be implemented as follows: for a third device in the second device, the third device randomly selects a second secret value, splits the second secret value into multiple secret shares equal to the number of devices included in the second device, and secretly shares different secret shares with different devices in the second device, wherein the third device is any device in the second device; the third device receives and stores corresponding secret shares in multiple secret values ​​secretly shared by other devices in the second device, wherein the other devices are devices in the second device other than the target device; the third device sums the secret shares in multiple secret values ​​stored locally to obtain a target private key component; and performs a signature operation based on the target private key component calculated by each device in the second device.

[0094] The above process is similar to the process of randomly generating a first secret value and performing a t-order secret sharing operation without a trusted center for the first secret value described above, except that the parameters used therein are changed. The above process will be described in detail below.

[0095] In practical applications, it is assumed that any of the second devices participating in the signing process is a third device, and the third device can be recorded as . A second secret value can be randomly generated and can be expressed as . Can execute The t-order secret sharing operation without a trusted center will Share with different devices in the second device. For each device in the second device, the above process needs to be performed.

[0096] Specifically, execution The process of the t-order secret sharing operation without a trusted center can be implemented as follows: Construct a polynomial that can be expressed as , where x=0, then . Using the above polynomial, we can perform A t-order secret sharing operation without a trusted center.

[0097] After each device in the second device performs a t-order secret sharing operation without a trusted center for the secret value, For example, Can receive messages sent by n-1 other devices ,and then Can be calculated , Among them, the third device can be used as the above , the target private key component is as above .

[0098] Optionally, based on the target private key component calculated by each device in the second device, the process of performing the signing operation can be implemented as follows: each device in the second device performs a 2t-order secret sharing operation without a trusted center, wherein the secret shared in the 2t-order secret sharing operation without a trusted center is 0, and the secret share obtained by each device in the second device is the first component, t is a set threshold, and the number of devices included in the second device is at least t; based on the first component corresponding to the third device, the target private key component and the signature private key component, determine the second component corresponding to the third device; based on the first component and the second component, determine the third component corresponding to the third device; and perform the signing operation based on the third component corresponding to each device in the second device.

[0099] Assume that the object of the above 2t-order secret sharing operation without a trusted center is ,set up , the secret share obtained by each device in the second device can be recorded as .

[0100] Obtained on a third device Afterwards, based on , as well as calculate , .in, is the second component, is the target private key component, is the signature private key component. After that, you can broadcast , so that each device in the second device can know the Then, the third device can also calculate by interpolating the polynomial , . Wherein, T is the set of devices participating in the signing process, that is, the second device.

[0101] In obtaining as well as Afterwards, based on as well as calculate , .in, This is the third component mentioned above.

[0102] Optionally, based on the third component corresponding to each device in the second device, the process of performing the signature operation can be implemented as follows: generate a random number k, perform a t-order secret sharing operation without a trusted center on the random number k in the second device, wherein the secret share obtained by each device in the second device is the fourth component; based on the fourth component, determine the fifth component; based on the third component, the fourth component and the fifth component corresponding to each device in the second device, generate a signature result.

[0103] In practical applications, A random number k can be randomly generated, and then a t-order secret sharing operation without a trusted center is performed on the random number k. Assume that the secret share obtained by each device is , is the fourth component. Among them, . Where (x, y) is the horizontal and vertical coordinates of a point on the ellipse. Next, we can calculate , .in, is the fifth component, x is the above-mentioned horizontal coordinate, and q is a fixed value.

[0104] Next, after obtaining , as well as Afterwards, based on , as well as calculate , ,in, It is part of the final signature result.

[0105] Each device in the second device can perform the above process, so that multiple Finally, based on the multiple , calculate the final signature result through the interpolation polynomial , After completing the above calculations, the output .

[0106] By adopting this application, the decentralization process of the signature system can be realized, that is, there is no need to generate and keep the signature private key through a trusted third party, but each first device in the signature system acts as a central device to secretly share its own private key, and these private keys are combined together to form the signature private key. It can be seen that by adopting this method, first of all, the security of the signature process no longer depends on a separate third party, and the signature private key is not generated and managed in the third party, so that the attacker cannot decipher the signature private key by attacking the third party alone. By adopting this application, if the attacker wants to decipher the signature private key, then at least t second devices in the first device need to be intercepted to restore the complete signature private key. It can be seen that the use of this application can greatly improve the security of the signature private key, thereby ensuring the security of the signature process.

[0107] The following will describe in detail the security signature device of one or more embodiments of the present invention. Those skilled in the art will appreciate that these security signature devices can be configured using commercially available hardware components through the steps taught in this solution.

[0108] An embodiment of the present invention provides a secure signature device, which can be set in a signature system. The signature system includes a first device and a second device. The first device includes the second device. The second device is a device that actually participates in the signature process. The number of devices included in the first device and the number of devices included in the second device satisfy a preset quantity relationship.

[0109] Figure 3 A schematic diagram of the structure of the above-mentioned security signature device provided by an embodiment of the present invention is shown as follows: Figure 3 As shown, the device comprises:

[0110] a secret sharing module 31, configured to randomly select a first secret value for a target device in the first devices, split the first secret value into a plurality of secret shares equal in number to the number of devices included in the first devices, and secretly share different secret shares with different devices in the first devices, wherein the target device is any device in the first devices;

[0111] A receiving module 32, configured to receive and store corresponding secret shares of a plurality of secret values ​​secretly shared by other devices in the first device, wherein the other devices are devices in the first device other than the target device;

[0112] A recovery module 33, configured to recover the signature private key based on the corresponding secret shares of the multiple secret values ​​stored locally, and calculate the corresponding public key based on the signature private key;

[0113] The signature module 34 is used to perform a distributed signature operation based on the signature private key and the public key.

[0114] Optionally, the secret sharing module 31 is used to:

[0115] Constructing a t-order polynomial, wherein t is a set threshold, and the number of devices included in the second device is at least t;

[0116] Based on the t-order polynomial, the first secret value is split into a plurality of secret shares whose number is equal to the number of devices included in the first device.

[0117] Optionally, the apparatus further comprises a sharing module, the sharing module being configured to sum the secret shares in the multiple secret values ​​stored locally to obtain a signature private key component, and share the signature private key component with a device in the first device; determine a corresponding public key component according to the signature private key component, and share the public key component with a device in the first device;

[0118] The recovery module 33 is used to sum the signature private key components calculated by all devices in the first device to recover the signature private key; and sum the public key components calculated by all devices in the first device to obtain the public key corresponding to the signature private key.

[0119] Optionally, the signature module 34 is used to:

[0120] For a third device in the second device, randomly select a second secret value, split the second secret value into a plurality of secret shares equal in number to the number of devices included in the second device, and secretly share different secret shares with different devices in the second device, wherein the third device is any device in the second device;

[0121] Receiving and storing corresponding secret shares of a plurality of secret values ​​secretly shared by other devices in the second device, wherein the other devices are devices in the second device other than the target device;

[0122] Summing the secret shares in the multiple secret values ​​stored locally to obtain a target private key component;

[0123] A signing operation is performed based on the target private key components calculated by each device in the second device.

[0124] Optionally, the signature module 34 is used to:

[0125] Performing a 2t-order secret sharing operation without a trusted center through each device in the second device, wherein the secret shared in the 2t-order secret sharing operation without a trusted center is 0, the secret share obtained by each device in the second device is the first component, t is a set threshold, and the number of devices included in the second device is at least t;

[0126] Determine a second component corresponding to the third device based on the first component corresponding to the third device, the target private key component, and the signature private key component;

[0127] Determine, based on the first component and the second component, a third component corresponding to the third device;

[0128] A signing operation is performed based on the third component corresponding to each device in the second device.

[0129] Optionally, the signature module 34 is used to:

[0130] Generate a random number k, and perform a t-order secret sharing operation of the random number k without a trusted center in the second device, wherein the secret share obtained by each device in the second device is a fourth component;

[0131] Based on the fourth component, determining a fifth component;

[0132] A signature result is generated based on the third component, the fourth component, and the fifth component corresponding to each device in the second device.

[0133] Figure 3 The device shown can perform the aforementioned Figure 1 to Figure 2 The security signature method provided in the illustrated embodiment, the detailed execution process and technical effects are described in the aforementioned embodiment and will not be repeated here.

[0134] In addition, an embodiment of the present invention provides a non-transitory machine-readable storage medium, wherein an executable code is stored on the non-transitory machine-readable storage medium. When the executable code is executed by a processor of an electronic device, the processor can at least implement the above-mentioned Figure 1 to Figure 2 The secure signature method provided in the illustrated embodiment.

[0135] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. Those of ordinary skill in the art may understand and implement the present invention without creative effort.

[0136] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by adding a necessary general hardware platform, and of course can also be implemented by combining hardware and software. Based on such an understanding, the above technical solution can essentially or in other words be embodied in the form of a computer product, and the present invention can be implemented in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0137] The security signature method provided in the embodiment of the present invention can be executed by a certain program / software, which can be provided by the network side. The electronic device mentioned in the above embodiment can download the program / software to a local non-volatile storage medium, and when it needs to execute the above security signature method, the program / software is read into the memory by the CPU, and then the CPU executes the program / software to implement the security signature method provided in the above embodiment. The execution process can refer to the above Figure 1 to Figure 2 Instructions in .

[0138] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A secure signature method, characterized in that: Applied to a signature system, the signature system includes a first device and a second device, the first device includes the second device, the second device is a device actually participating in the signature process, and the number of devices included in the first device and the number of devices included in the second device satisfy a preset quantity relationship; The method comprises: For a target device in the first devices, the target device randomly selects a first secret value, splits the first secret value into a plurality of secret shares whose number is equal to the number of devices included in the first devices, and secretly shares different secret shares with different devices in the first devices, wherein the target device is any device in the first devices; The target device receives and stores corresponding secret shares of a plurality of secret values ​​secretly shared by other devices in the first device, wherein the other devices are devices in the first device other than the target device; The second device recovers the signature private key based on the corresponding secret shares of the multiple secret values ​​stored locally, and calculates the corresponding public key based on the signature private key; The second device performs a distributed signature operation based on the signature private key and the public key; After the target device receives and stores corresponding secret shares of a plurality of secret values ​​secretly shared by other devices in the first device, the method further includes: The target device performs a sum operation on the secret shares of the multiple secret values ​​stored locally to obtain a signature private key component, and shares the signature private key component with a device in the first device; The target device determines a corresponding public key component according to the signature private key component, and shares the public key component with a device in the first device; The recovering the signature private key and calculating the corresponding public key based on the signature private key includes: Performing a sum operation on the signature private key components calculated by all devices in the first device to recover the signature private key; Performing a sum operation on the public key components calculated by all the devices in the first device to obtain a public key corresponding to the signature private key; The second device performs a distributed signature operation based on the signature private key and the public key, including: For a third device in the second device, the third device randomly selects a second secret value, splits the second secret value into a plurality of secret shares whose number is equal to the number of devices included in the second device, and secretly shares different secret shares with different devices in the second device, wherein the third device is any device in the second device; The third device receives and stores corresponding secret shares of a plurality of secret values ​​secretly shared by other devices in the second device, wherein the other devices are devices in the second device other than the target device; The third device performs a sum operation on the secret shares in the multiple secret values ​​stored locally to obtain a target private key component; A signing operation is performed based on the target private key components calculated by each device in the second device.

2. The method according to claim 1, characterized in that The step of splitting the first secret value into a plurality of secret shares whose number is equal to the number of devices included in the first device comprises: Constructing a t-order polynomial, wherein t is a set threshold, and the number of devices included in the second device is at least t; Based on the t-order polynomial, the first secret value is split into a plurality of secret shares whose number is equal to the number of devices included in the first device.

3. The method according to claim 1, characterized in that The performing a signing operation based on the target private key component calculated by each device in the second device includes: Each device in the second device performs a 2t-order secret sharing operation without a trusted center, wherein the secret shared in the 2t-order secret sharing operation without a trusted center is 0, the secret share obtained by each device in the second device is the first component, t is a set threshold, and the number of devices included in the second device is at least t; Determine a second component corresponding to the third device based on the first component corresponding to the third device, the target private key component, and the signature private key component; Determine, based on the first component and the second component, a third component corresponding to the third device; A signing operation is performed based on the third component corresponding to each device in the second device.

4. The method according to claim 3, characterized in that The performing a signing operation based on the third component corresponding to each device in the second device includes: Generate a random number k, and perform a t-order secret sharing operation of the random number k without a trusted center in the second device, wherein the secret share obtained by each device in the second device is a fourth component; Based on the fourth component, determining a fifth component; A signature result is generated based on the third component, the fourth component, and the fifth component corresponding to each device in the second device.

5. A secure signature device, characterized in that: Set in a signature system, the signature system includes a first device and a second device, the first device includes the second device, the second device is a device actually participating in the signature process, and the number of devices included in the first device and the number of devices included in the second device meet a preset quantity relationship; The device comprises: a secret sharing module, configured to randomly select a first secret value for a target device in the first devices, split the first secret value into a plurality of secret shares equal in number to the number of devices included in the first devices, and secretly share different secret shares with different devices in the first devices, wherein the target device is any device in the first devices; a receiving module, configured to receive and store corresponding secret shares of a plurality of secret values ​​secretly shared by other devices in the first device, wherein the other devices are devices in the first device other than the target device; A recovery module, configured to recover a signature private key based on corresponding secret shares of the multiple secret values ​​stored locally, and calculate a corresponding public key based on the signature private key; A signature module, used to perform a distributed signature operation based on the signature private key and the public key; The device further includes a sharing module, the sharing module being configured to sum the secret shares in the multiple secret values ​​stored locally to obtain a signature private key component, and share the signature private key component with a device in the first device; determine a corresponding public key component according to the signature private key component, and share the public key component with a device in the first device; The recovery module is configured to sum the signature private key components calculated by all the devices in the first device to recover the signature private key; and sum the public key components calculated by all the devices in the first device to obtain a public key corresponding to the signature private key; Wherein, the signature module is used to: For a third device in the second device, randomly select a second secret value, split the second secret value into a plurality of secret shares equal in number to the number of devices included in the second device, and secretly share different secret shares with different devices in the second device, wherein the third device is any device in the second device; Receiving and storing corresponding secret shares of a plurality of secret values ​​secretly shared by other devices in the second device, wherein the other devices are devices in the second device other than the target device; Summing the secret shares in the multiple secret values ​​stored locally to obtain a target private key component; A signing operation is performed based on the target private key components calculated by each device in the second device.

6. The device according to claim 5, characterized in that The secret sharing module is used to: Constructing a t-order polynomial, wherein t is a set threshold, and the number of devices included in the second device is at least t; Based on the t-order polynomial, the first secret value is split into a plurality of secret shares whose number is equal to the number of devices included in the first device.

Images