Ring signature methods, systems, electronic devices and storage media

Abstract

This application provides a ring signature method, system, electronic device, and storage medium. The method is applied to a first signing node, and a second signing node corresponds to a target object. The first signing node has a first private key, and the second signing node has a second private key. The first and second private keys are obtained by splitting the private key corresponding to the target object. The method includes: determining a first sub-signature parameter corresponding to the first signing node based on the base point data of the ring signature curve and a first random number; sending the first sub-signature parameter to the second signing node; receiving a third random number, a fourth random number, a first signature value, and a second signature value sent by the second signing node; determining a third signature value based on the first random number, the first private key, and the first signature value; and obtaining the signature corresponding to the target object based on the first signature value, the third signature value, and the second signature value. This application improves the security of the data to be signed.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a ring signature method, system, electronic device and storage medium. Background Technology

[0002] In cryptography, a ring signature is a type of digital signature that can be executed by any member of a group of users, each with their own key. One of the security properties of ring signatures is that it is impossible to determine, by computation, which member generated the signature.

[0003] However, in traditional ring signature schemes, the private key of a single ring signature user is usually stored on a single host machine. Once the host machine is compromised, the private key is easily lost or leaked, resulting in poor security. Summary of the Invention

[0004] This application provides a ring signature method, system, electronic device, and storage medium to improve the security of private keys.

[0005] This application provides a ring signature method applied to a first signature node, wherein the first signature node and the second signature node correspond to a target object, wherein the first signature node has a first private key, and the second signature node has a second private key, and the first private key and the second private key are obtained by splitting the private key corresponding to the target object, the method comprising:

[0006] Based on the base point data of the curve corresponding to the ring signature and the first random number, the first sub-signature parameters corresponding to the first signature node are determined;

[0007] The first sub-signature parameter is sent to the second signature node, wherein the second signature node is used to determine the first signature parameter based on the base point data, the second random number and the first sub-signature parameter, and to determine the second signature parameter based on the base point data, the third random number and the fourth random number;

[0008] The system receives the third random number, the fourth random number, the first signature value, and the second signature value sent by the second signature node, wherein the first signature value is determined based on the data to be signed, the first signature parameter, the second signature parameter, and the fourth random number, and the second signature value is determined based on the second random number, the second private key, and the first signature value.

[0009] The third signature value is determined based on the first random number, the first private key, and the first signature value, and the signature corresponding to the target object is obtained based on the first signature value, the third signature value, and the second signature value.

[0010] In an optional embodiment, the step of the second signature node determining the second signature parameter based on the base point data, the third random number, and the fourth random number includes:

[0011] Retrieve the public key value corresponding to each ring member in the ring member cluster;

[0012] The second signature parameters are determined based on the base point data, the public key values ​​corresponding to each ring member, the third random number, and the fourth random number.

[0013] In an optional embodiment, the step of obtaining the first signature value includes:

[0014] The hash value is determined based on the data to be signed, the first signature parameter, and the second signature parameter;

[0015] The first signature value is determined based on the hash value and the fourth random number.

[0016] In an optional embodiment, after obtaining the signature value corresponding to the target object based on the third signature value and the second signature value, the method further includes:

[0017] The signature value corresponding to the target object is verified.

[0018] In one alternative embodiment, the target object is any member of each ring member in the ring signature cluster.

[0019] In an optional embodiment, the curve is an SM2 curve.

[0020] This application embodiment also provides a signature system, wherein a first signature node and a second signature node correspond to a target object, wherein the first signature node has a first private key, and the second signature node has a second private key, the first private key and the second private key are obtained by splitting the private key corresponding to the target object, and the system includes:

[0021] The first determining module is used to determine the first sub-signature parameters corresponding to the first signature node based on the base point data of the curve corresponding to the ring signature and the first random number.

[0022] The second determining module is used to send the first sub-signature parameter to the second signing node, wherein the second signing node is used to determine the first signature parameter based on the base point data, the second random number and the first sub-signature parameter, and to determine the second signature parameter based on the base point data, the third random number and the fourth random number;

[0023] The receiving module is configured to receive the third random number, the fourth random number, the first signature value, and the second signature value sent by the second signing node, wherein the first signature value is determined based on the data to be signed, the first signature parameter, the second signature parameter, and the fourth random number, and the second signature value is determined based on the second random number, the second private key, and the first signature value.

[0024] The signature module is used to determine a third signature value based on the first random number, the first private key, and the first signature value, and to obtain the signature corresponding to the target object based on the first signature value, the third signature value, and the second signature value.

[0025] In an optional embodiment, the system further includes:

[0026] The verification module is used to verify the signature value corresponding to the target object.

[0027] This application also provides an electronic device, including: a memory, a processor, and a communication interface; wherein, the memory stores executable code, and when the executable code is executed by the processor, the processor executes the above-described ring signature method.

[0028] This application also provides a non-transitory machine-readable storage medium storing executable code. When the executable code is executed by a processor of an electronic device, the processor executes the above-described ring signature method.

[0029] In this embodiment, by splitting the private key corresponding to the target object into a first private key and a second private key, and sending the first and second private keys to the first and second signing nodes respectively, the private key of a single ring signature user is split. This allows the private key of a ring signature user to be stored on two host machines. Even if one host machine is compromised, the complete private key will not be leaked, resulting in good security. Subsequently, based on the base point data of the ring signature curve and the first random number, the first sub-signature parameter corresponding to the first signing node is determined, and the first sub-signature parameter is sent to the second signing node. The second signing node receives the third random number, the fourth random number, the first signature value, and the second signature value. Then, based on the first random number, the first private key, and the first signature value, the third signature value is determined. Finally, based on the first signature value, the third signature value, and the second signature value, the signature corresponding to the target object can be obtained. In this process, the first and second signature parameters can be prepared in advance, effectively shortening the signing task time and improving signing efficiency. Attached Figure Description

[0030] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0031] Figure 1 A flowchart of a ring signature method provided as an exemplary embodiment of this application;

[0032] Figure 2 A flowchart of a signature verification method provided as an exemplary embodiment of this application;

[0033] Figure 3 A schematic diagram of the structure of a signature system provided in an exemplary embodiment of this application;

[0034] Figure 4 A schematic diagram of the structure of an electronic device provided for an exemplary embodiment of this application. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0036] In cryptography, a ring signature is a type of digital signature that can be executed by any member of a group of users, each with their own key. One of the security properties of ring signatures is that it is impossible to determine which group member generated the signature through computation. However, in traditional ring signature schemes, the private key of a single ring signature user is typically stored on a single host machine. If this host machine is compromised, the private key is easily lost or leaked, resulting in poor security.

[0037] Figure 1 The flowchart illustrates a ring signature method provided in this application embodiment. The method is applied to a first signature node, and the first and second signature nodes correspond to a target object. The first signature node has a first private key, and the second signature node has a second private key. The first and second private keys are obtained by splitting the private key corresponding to the target object. The method includes the following steps:

[0038] Step 101: Based on the base point data of the curve corresponding to the ring signature and the first random number, determine the first sub-signature parameters corresponding to the first signature node.

[0039] The curve can be an SM2 curve, which is an SM2 elliptic curve public-key cryptography algorithm.

[0040] Step 102: Send the first sub-signature parameter to the second signature node, wherein the second signature node is used to determine the first signature parameter based on the base point data, the second random number and the first sub-signature parameter, and to determine the second signature parameter based on the base point data, the third random number and the fourth random number.

[0041] Step 103: Receive the third random number, the fourth random number, the first signature value, and the second signature value sent by the second signature node. The first signature value is determined based on the data to be signed, the first signature parameter, the second signature parameter, and the fourth random number. The second signature value is determined based on the second random number, the second private key, and the first signature value.

[0042] Step 104: Determine the third signature value based on the first random number, the first private key, and the first signature value, and obtain the signature corresponding to the target object based on the first signature value, the third signature value, and the second signature value.

[0043] In this embodiment, the first and second signature nodes can be terminal devices (mobile phones, computers, etc.), servers, etc. It should be noted that the use of two signature nodes in this application is only for ease of description. In practical applications, there can be multiple signature nodes. In specific implementation, the private key corresponding to the target object can also be split into multiple parts and stored in different signature nodes. The target object can be any member of each ring member in the ring signature cluster.

[0044] In practical applications, assume the base point data of the elliptic curve corresponding to the ring signature is G, and there are n ring members in the ring member cluster, where any ring member i randomly chooses a private key d. i , where d i ∈Z n Z n Let d be a set of integers. i From Z n Choose any integer from the given options. Then, based on the private key d... i Calculate the public key P of ring member i. i , where P i =d i G. After calculating the public keys of all ring members, we can obtain the public key set P corresponding to the set of ring members, where P = {P1, P2, ..., P...} L}

[0045] Regarding the aforementioned private key d i The private key is randomly split to obtain the first private key d. i,1 Second private key d i,2 , where d i,1 +d i,2 =d imod n. At this point, the first private key d can be... i,1 Send the second key d to the first signing node. i,2 Send to the second signature node.

[0046] Based on the above, the specific process of generating ring signatures will be explained in detail below:

[0047] The first signature node is from the set of integers Z. n Select a first random number r from the list. s,1 , that r s,1 ← R Z n Furthermore, it is possible to base the data G of the curve corresponding to the ring signature and the first random number r. s,1 Determine the first sub-signature parameter R corresponding to the first signature node. s,1 The R s,1 =r s,1 G, will use the first sub-signature parameter R s,1 Send to the second signature node.

[0048] The second signature node is from the set of integers Z. n Choose a second random number r from the list. s,2 , that r s,2 ← R Z n Therefore, it is possible to base the data G of the curve corresponding to the ring signature and the first random number r. s,1 Determine the second sub-signature parameter R corresponding to the second signature node. s,2 .

[0049] In this embodiment, the step of the second signature node determining the second signature parameter based on the base point data, the third random number, and the fourth random number includes: obtaining the public key value corresponding to each ring member in the ring member cluster; and determining the second signature parameter based on the base point data, the public key value corresponding to each ring member, the third random number, and the fourth random number. Specifically, based on the base point data G and the second random number r... s,2 First sub-signature parameter R s,1 Second sub-signature parameter R s,2 Determine the first signature parameter R s Based on the base point data G and the third random number z i and the fourth random number c i Determine the second signature parameter R i The R i =z i Gc i P i Where i∈[1,L] and i≠s, z i ← R Z n ,ci ← R Z n That is, the third random number z i and the fourth random number c i Both are from the set of integers Z n Choose a random number.

[0050] Next, the second signature node determines the signature based on the data to be signed m and the first signature parameter R. s Second signature parameter R i and the fourth random number c i Determine the first signature value c s The first signature value c s The acquisition steps include: based on the data to be signed m and the first signature parameter R s Second signature parameter R i Determine the hash value c; based on the hash value c and the fourth random number c. i Determine the first signature value c s .

[0051] In practice, the hash value c = H(m,R1,…R) L ), including the first signature parameter R s It should be noted that when calculating the hash value c, the data to be signed m and the first signature parameter R are first calculated. s Second signature parameter R i The cascading relationship between the rings is determined by calculating the hash value c, eliminating the need to calculate the hash value for each ring member, thus effectively reducing the number of hash value calculations. Then, the calculated hash value c and the fourth random number c are used... i Perform an XOR operation to obtain the first signature value c. s ,Should And calculate the second signature value z s,2 The z s,2 =r s,2 +d s,2 c s It should be noted that, in the embodiments of this application, for all fourth random numbers c... i Performing an XOR operation, without needing to hash all ring members, reduces computational workload and effectively improves computational efficiency. Then, {c i ,z i |i∈[1,L]andi≠s}、c s z s,2 Send to the first signature node.

[0052] Based on the above, this application can calculate the first signature parameter R in advance. s Second signature parameter R iThe pre-calculation mentioned here can be understood as not taking up the signing task's time before receiving the data to be signed m or before starting the signing task for the data to be signed m, thus effectively improving the efficiency of performing complex ring signing tasks.

[0053] Following the above, after receiving the aforementioned data, the first signature node, based on the first random number r... s,1 First private key d i,1 First signature value c s Determine the third signature value z s,1 The z s,1 =r s,1 +d s,1 c s Furthermore, based on the third signature value z s,1 Second signature value z s,2 Calculate the final signature value z s The z s =z s,1 +z s,2 Here we obtain the first signature value c. s and the final signature value z s Then, the signature corresponding to the target object can be further calculated {(z i ,c i )|i=1,2…L}.

[0054] The ring signature method provided in this application splits the private key corresponding to the target object into a first private key and a second private key, and sends the first and second private keys to the first and second signature nodes respectively. This achieves the splitting of the private key of a single ring signature user, allowing the private key of a ring signature user to be stored on two host machines. Even if one host machine is compromised, the complete private key will not be leaked, resulting in good security. Subsequently, based on the base point data of the ring signature curve and the first random number, the first sub-signature parameter corresponding to the first signature node is determined, and the first sub-signature parameter is sent to the second signature node. The method receives the third random number, the fourth random number, the first signature value, and the second signature value sent by the second signature node. Then, based on the first random number, the first private key, and the first signature value, the third signature value is determined. Finally, based on the first signature value, the third signature value, and the second signature value, the signature corresponding to the target object can be obtained. In this process, the first signature parameter R... s Second signature parameter R i It allows for advance preparation, effectively shortening the signing time and improving signing efficiency.

[0055] Figure 2 A flowchart of a signature verification method provided in this application embodiment is shown below. Figure 2 As shown, the method includes the following steps:

[0056] Step 201: Based on the base point data of the curve corresponding to the ring signature and the first random number, determine the first sub-signature parameters corresponding to the first signature node.

[0057] Step 202: Send the first sub-signature parameter to the second signature node, wherein the second signature node is used to determine the first signature parameter based on the base point data, the second random number and the first sub-signature parameter, and to determine the second signature parameter based on the base point data, the third random number and the fourth random number.

[0058] Step 203: Receive the third random number, the fourth random number, the first signature value, and the second signature value sent by the second signature node. The first signature value is determined based on the data to be signed, the first signature parameter, the second signature parameter, and the fourth random number. The second signature value is determined based on the second random number, the second private key, and the first signature value.

[0059] Step 204: Determine the third signature value based on the first random number, the first private key, and the first signature value, and obtain the signature corresponding to the target object based on the first signature value, the third signature value, and the second signature value.

[0060] Step 205: Verify the signature value corresponding to the target object.

[0061] For the specific implementation of steps 201-204, please refer to the description in the above embodiments. For step 205, the specific verification process is as follows:

[0062] Calculate R i =z i Gc i P i , i∈[1,L]; calculate c′=H(m,R1,…R L ),verify If the condition is not met, an error will be reported and the verification task will be exited; if the condition is met, the verification will be successful.

[0063] Figure 3 This is a schematic diagram of a signature system provided in an embodiment of this application. A first signature node and a second signature node correspond to a target object. The first signature node has a first private key, and the second signature node has a second private key. The first and second private keys are obtained by splitting the private key corresponding to the target object, as shown below. Figure 3 As shown, the system includes: a first determining module 301, a second determining module 302, a receiving module 303, and a signature module 304.

[0064] The first determining module 301 is used to determine the first sub-signature parameters corresponding to the first signature node based on the base point data of the curve corresponding to the ring signature and the first random number.

[0065] The second determining module 302 is used to send the first sub-signature parameter to the second signing node, wherein the second signing node is used to determine the first signature parameter based on the base point data, the second random number and the first sub-signature parameter, and to determine the second signature parameter based on the base point data, the third random number and the fourth random number;

[0066] The receiving module 303 is used to receive a third random number, a fourth random number, a first signature value, and a second signature value sent by the second signing node. The first signature value is determined based on the data to be signed, the first signature parameter, the second signature parameter, and the fourth random number. The second signature value is determined based on the second random number, the second private key, and the first signature value.

[0067] The signature module 304 is used to determine the third signature value based on the first random number, the first private key, and the first signature value, and to obtain the signature value corresponding to the target object based on the first signature value, the third signature value, and the second signature value.

[0068] Optionally, the system also includes a verification module for verifying the signature value corresponding to the target object.

[0069] Optionally, the target object is any member of each ring member in the ring signature cluster.

[0070] Optionally, the curve is an SM2 curve.

[0071] Figure 3 The system shown can perform the steps in the foregoing embodiments. For detailed execution process and technical effects, please refer to the description in the foregoing embodiments, which will not be repeated here.

[0072] This application also provides an electronic device, such as... Figure 4 As shown, the electronic device may include: a processor 31, a memory 32, and a communication interface 33. The memory 32 stores executable code, which, when executed by the processor 31, enables the processor 31 to implement the ring signature method as described in the preceding embodiments.

[0073] In addition, embodiments of the present invention provide a non-transitory machine-readable storage medium storing executable code, which, when executed by a processor of an electronic device, enables the processor to at least implement the ring signature method provided in the foregoing embodiments.

[0074] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0075] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0076] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0077] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0078] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0079] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0080] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0081] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0082] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A ring signature method, characterized by, The method is applied to a first signature node corresponding to a target object, wherein the first signature node has a first private key, and a second signature node has a second private key, the first private key and the second private key are obtained by splitting a private key corresponding to the target object, and the method comprises the following steps: determining a first sub-signature parameter corresponding to the first signature node based on base point data of a curve corresponding to a ring signature and a first random number; sending the first sub-signature parameter to the second signature node, wherein the second signature node is configured to determine a first signature parameter based on the base point data, a second random number and the first sub-signature parameter, and obtain public key values corresponding to each ring member in a ring member cluster respectively, and determine a second signature parameter based on the base point data, the public key values corresponding to each ring member respectively, a third random number and a fourth random number; receiving the third random number, the fourth random number, a first signature value and a second signature value sent by the second signature node, wherein the first signature value is determined according to to-be-signed data, the first signature parameter, the second signature parameter and the fourth random number, and the second signature value is determined according to the second random number, the second private key and the first signature value; determining a third signature value according to the first random number, the first private key and the first signature value, and obtaining a signature corresponding to the target object based on the first signature value, the third signature value and the second signature value.

2. The method of claim 1, wherein, The step of obtaining the first signature value comprises: determining a hash value based on the to-be-signed data, the first signature parameter and the second signature parameter; determining a first signature value based on the hash value and the fourth random number.

3. The method of claim 1, wherein, After obtaining the signature value corresponding to the target object based on the third signature value and the second signature value, the method further comprises: performing a verification operation on the signature value corresponding to the target object.

4. The method of claim 1, wherein, The target object is any one of the ring members in the ring signature cluster.

5. The method of claim 1, wherein, The curve is an SM2 curve.

6. A signature system characterized by comprising: The first signature node and the second signature node correspond to a target object, wherein the first signature node has a first private key, and the second signature node has a second private key, the first private key and the second private key are obtained by splitting a private key corresponding to the target object, and the system comprises: a first determination module configured to determine a first sub-signature parameter corresponding to the first signature node based on base point data of a curve corresponding to a ring signature and a first random number; a second determination module configured to send the first sub-signature parameter to the second signature node, wherein the second signature node is configured to determine a first signature parameter based on the base point data, a second random number and the first sub-signature parameter, and obtain public key values corresponding to each ring member in a ring member cluster respectively, and determine a second signature parameter based on the base point data, the public key values corresponding to each ring member respectively, a third random number and a fourth random number; receive the third random number, the fourth random number, a first signature value and a second signature value sent by the second signature node, wherein the first signature value is determined according to to-be-signed data, the first signature parameter, the second signature parameter and the fourth random number, and the second signature value is determined according to the second random number, the second private key and the first signature value; determine a third signature value according to the first random number, the first private key and the first signature value, and obtain a signature corresponding to the target object based on the first signature value, the third signature value and the second signature value.

7. The system of claim 6, wherein, The system further comprises: verify the signature value corresponding to the target object.

8. An electronic device, comprising: comprise: a memory, a processor, a communication interface; wherein the memory has stored executable codes, when the executable codes are executed by the processor, the processor executes the ring signature method in any one of claims 1 to 5.

9. A non-transitory machine-readable storage medium, comprising: The non-transitory machine-readable storage medium has stored executable codes, when the executable codes are executed by the processor of the electronic device, the processor executes the ring signature method in any one of claims 1 to 5.

Images