Reverse firewall method suitable for identification ring signature

Abstract

The invention discloses a reverse firewall method suitable for an identification ring signature, and belongs to the technical field of information security. According to the method, the backdoor attack is resisted by deploying the reverse firewall for the private key generation center PKG and the signer in the identification ring signature protocol. No matter an internal attacker subverts any participant in the signature method, the method provided by the invention can ensure that the anonymity of the participant of the signature is not damaged and privacy information is not leaked to the internal attacker, so that the privacy leakage prevention of the whole ring signature method is realized. Compared with a common ring signature method, the method provided by the invention can ensure that the anonymity of the signer of the ring signature cannot be damaged and the privacy cannot be leaked to the attacker even if the signer of the ring signature and the PKG use a subverted algorithm, namely an algorithm tampered by an internal attacker.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a reverse firewall method suitable for identification ring signature. Background Art

[0002] By tampering with the cryptographic algorithm and implanting a backdoor, the security of the algorithm can be destroyed and private information can be leaked, thus enabling large-scale global surveillance. Such internal attacks are extremely harmful. Not only can they steal a large amount of private information of users, but they are also extremely difficult to detect. Researchers have found that these attacks can effectively crack various cryptographic algorithms, such as encryption, digital signatures, and key exchange.

[0003] The document "Rivest RL, Shamir A, Tauman Y. How to leak a secret [C]. Advances in Cryptology—ASIACRYPT 2001, Springer: 552-565." proposed a digital signature with anonymity, which is called a ring signature. After proposing the specific concept of ring signature, researchers proposed a ring signature method based on RSA (asymmetric encryption algorithm). However, in this traditional public key infrastructure (PKI), the user's public key has nothing to do with the user's identity. Whether the key is credible is entirely the responsibility of a third-party certificate authority (CA) trusted by everyone, which affects both the efficiency and security of the ring signature. The document "Zhang F, Kim K. ID-based blind signature and ring signature from pairings [C]. Advances in Cryptoptology—ASI ACRYPT 2002, Springer: 533-547." proposed an identity-based ring signature for the first time based on the identity-based cryptographic system, which solved the problem of ring signature certificate management and only required the user's public feature information to generate the signature public key. The document "Chow SSM, Yiu SM, Hui LC K. Efficient identitybased ring signature [C]. Applied Cryptography and Network Security, ACNS 2005, Springer: 499-512." proposed an efficient identity-based ring signature, which improved efficiency and achieved a constant number of pairing calculations by using fewer bilinear pairing calculations.

[0004] The paper "teniese G, Magri B, Venturi D. Subversion-resilient signature schemes [C]. Computer and Communications Security, 2015: 364-375." studies the subversion attack on digital signatures and proposes a general attack method. The scheme shows that the security of the signature is destroyed by tampering with the random number generator, leaking the user's private key. Under this attack, even the highly anonymous digital signature mechanism such as the ring signature cannot effectively defend against the destruction of anonymity and the leakage of private messages. The attacker can easily obtain the real identity of the user who generated the ring signature, and even obtain the private key of the user's signature. Therefore, the paper "Liu C, Chen R, Wang Y, et al. Asymmetric subversion attacks on signature schemes [C]. Information Security and Privacy, ACISP 2018, Springer: 376-395." proposed an asymmetric attack model for signatures, which is stronger than the subversion model involved in the above-mentioned general attack methods. It also proposed the concept of splittable signatures and gave a general asymmetric subversion attack on this method. Through two consecutive signatures, the attacker can recover the private key.

[0005] In order to solve this problem, the document "Mironov I, Stephens-Davidowitz N. Cryptographic reverse firewalls [C]. EUROCRYPT 2015, Springer: 657-686." first proposed the concept of cryptographic reverse firewalls (CRF) and defined three properties that reverse firewalls need to have: maintaining functionality, retaining security, and preventing leakage. Maintaining functionality means that the reverse firewall can achieve anti-subversion attack without changing the original algorithm function by re-randomizing the transmitted information. Retaining security means that the solution after adding the reverse firewall retains the security characteristics of the original underlying protocol. Preventing leakage means that the user sends information implanted with a backdoor, but the reverse firewall can make the backdoor invalid. In addition, the reverse firewall should be "transparent" to the participants of the cryptographic protocol, that is, the reverse firewall has no effect on the function of the underlying cryptographic scheme. In addition, the reverse firewall should also be semi-honest, that is, the reverse firewall runs the algorithm honestly but should not know the user's privacy. The paper "Ouyang M, Wang Z, Li F. Digital signature with cryptographic reverse firewalls [J]. Journal of Systems Architecture, 2021, 116: 102029." proposed an identity-based digital signature scheme with a reverse firewall and a digital signature scheme with a reverse firewall that relies on traditional PKI under the standard model to achieve anti-subversion attack on digital signatures. The following year, the paper "Kang B, Zhang L, Yang Y, et al. CRFs for digital signature and NIZK proof system in web services [C]. Algorithms and Architectures for Parallel Processing. Springer: 192-213." proposed a Pointcheval-Sanders (PS) digital signature scheme with a reverse firewall, and compared it to show that the performance of this scheme is better than that of the digital signature scheme with a reverse firewall that relies on traditional PKI.

[0006] However, the existing ring signature method cannot guarantee the anonymity and security of privacy information under the threat of backdoor attacks. Therefore, it is necessary to propose a reverse firewall method based on identity ring signature to solve this problem. Summary of the invention

[0007] The purpose of the present invention is to realize a reverse firewall method suitable for an identification ring signature to enhance the ability of the identification-based ring signature to resist active attacks.

[0008] The technical solution adopted by the present invention is:

[0009] A reverse firewall method applicable to an identification ring signature, the method comprising the following steps:

[0010] Step 1: The private key generator (PKG) initializes the system public parameters, re-randomizes the system public parameters based on the reverse firewall deployed on the PKG, and then broadcasts them to all participants, including signers and verifiers;

[0011] Step 2: Based on the identity submitted by the user, PKG extracts the user-side key and returns the private key to the user;

[0012] Step 3: The signer among the ring members generates a ring signature based on the system public parameters, the identity of the ring member and the private key of the ring member; and re-randomizes the generated ring signature based on the reverse firewall deployed on the signer side, and then sends the re-randomized ring signature to the verifier;

[0013] Step 4: The verifier verifies the received re-randomized ring signature based on the system public parameters, the message and the ring member identity set. If the verification passes, the ring signature is accepted, otherwise it is rejected.

[0014] Furthermore, the PKG initialization system common parameters specifically include:

[0015] PKG generates cyclic multiplicative groups G1 and G2 of prime order q and bilinear maps e:G1×G1→G2, and sets two secure hash functions H(·) and H0(·), which are expressed as: H:{0,1} * →G1, Among them, {0,1} * Represents a set of binary sequences of arbitrary bit length, a finite field

[0016] PKG randomly selects random numbers As the master key of PKG, the parameter P is calculated based on the generator P randomly selected from the cyclic multiplicative group G1. pub = xP;

[0017] Public system parameters {G1,G2,e,q,P,P pub ,H,H0}.

[0018] Furthermore, based on the reverse firewall (W PRF ) The specific steps of re-randomizing the system public parameters are as follows:

[0019] The reverse firewall selects random numbers uniformly at random Re-randomize the public parameter P' = f·P,P pub '=f·P pub , and obtain the re-randomized system public parameters {G1,G2,e,q,P',P pub ',H,H0}.

[0020] Furthermore, step 2 specifically includes:

[0021] The user submits his identity information ID to PKG for identification information registration;

[0022] PKG calculates the user public key Q based on the hash function H(·) ID =H(ID), and calculate the user's private key S ID =xQ ID , and then send the private key S ID To the user corresponding to the identity information ID, so that each signer can obtain his private key.

[0023] Furthermore, in step 3, the signer in the ring member generates a ring signature based on the system public parameter, the identity of the ring member and the private key of the ring member, specifically including:

[0024] (1) Define L = {ID1, ID2, …, ID n} represents the identity set of n users in the ring, and index s represents the real signer, that is, the public key of the signer is Q IDs =H(ID s ), ID j Indicates the identity information of ring member j, ID s Represents the identity information of the real signer; where i=1,2,W,n; s∈{1,2,W,n};

[0025] (2) The signer s randomly selects n-1 generators from the cyclic multiplicative group G1 as signatures of the non-signer ring members, denoted by U j , where the non-signer's ring member number j∈{1,2,…,n}\{s};

[0026] Based on U j Calculate the hash value h j =H0(m||L||U j ); where m represents a message;

[0027] (3) The signer s randomly selects a random number Calculate the signature of the current signer s

[0028] (4) Calculate the hash value h of the signer s s =H0(m||L||U s ), calculate the verification parameters

[0029] (5) Based on the signatures U of all ring members i Get the ring signature generated by signer s

[0030] Furthermore, in step 3, re-randomizing the generated ring signature based on the reverse firewall deployed on the signer side specifically includes:

[0031] Reverse firewall randomly selects random numbers And calculate the re-randomized signature and the re-randomized verification parameter V'=αV, and obtain the re-randomized ring signature

[0032] Furthermore, step 4 specifically includes:

[0033] The validator calculates the hash value

[0034] Check if it exists If yes, it means that if the verification passes, the ring signature σ' is accepted, otherwise it is rejected.

[0035] The technical solution provided by the present invention brings at least the following beneficial effects:

[0036] The present invention is a reverse firewall method suitable for an identity ring signature, which constructs a reverse firewall for the private key generator and signer in the protocol, thereby ensuring that even if an internal attacker exists, the privacy of all participants will not be leaked when a backdoor is embedded in the algorithm. The method of the present invention enhances the ability of the identity-based ring signature to resist active attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0038] Figure 1 A schematic diagram of a processing process of a reverse firewall method applicable to an identification ring signature provided by an embodiment of the present invention;

[0039] Figure 2This is a flow chart of system common parameters initialized in an embodiment of the present invention;

[0040] Figure 3 A flowchart of key extraction in an embodiment of the present invention;

[0041] Figure 4 The figure is a flow chart of signature generation and verification in an embodiment of the present invention. DETAILED DESCRIPTION

[0042] To make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be described in detail and completely in conjunction with the drawings in the implementation of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings can be arranged and designed using different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the present application for protection, but merely represents selected embodiments of the present invention.

[0043] The specific implementation process of a reverse firewall method applicable to an identification ring signature provided by an embodiment of the present invention includes: PKG selects a generator P from a cyclic multiplication group G1, sets the master private key to x, and uses it to generate P in the public parameter pub ,like Figure 1 ; The reverse firewall re-randomization public parameters of the PKG shown are P′ and P pub ′, and send the re-randomized public parameters {P′, P pub ′} to all participants; the signer submits his or her identity information ID to PKG, and PKG generates the signer's private key S based on the identity information ID and the master private key submitted by the signer ID Even if PKG uses a backdoored initialization and key extraction algorithm, the re-randomization of PKG's reverse firewall makes it impossible for an attacker to distinguish between the PKG's honest behavior and subversive behavior, let alone extract privacy from it.

[0044] also, Figure 1 We also show the reverse firewall (W SRF )’s operating mechanism. SRF The signature generated by the signer is re-randomized. Due to the re-randomization of the cryptographic reverse firewall, this ensures that even if the signer uses a random number generator with a backdoor, an internal attacker cannot extract any privacy information about the signer from the re-randomized message. The method proposed in the embodiment of the present invention is resistant to leakage. Even if any party (PKG, signer, verifier) ​​is embedded with a backdoor, the privacy information of the participants in the protocol will not be leaked.

[0045] See also Figure 1 , Figure 2 , Figure 3 and Figure 4 In a possible implementation manner, the specific implementation steps of a reverse firewall method applicable to an identification ring signature provided by an embodiment of the present invention include:

[0046] (1) Initialization:

[0047] (1.1)PKG generates cyclic multiplicative groups G1 and G2 of prime order q and bilinear maps e:G1×G1→G2. H(·) and H0(·) are two secure hash functions H:{0,1} * →G1, Among them, {0,1} * Represents a set of binary sequences of arbitrary bit length, a finite field

[0048] (1.2)PKG random selection As the master key of PKG and calculate P pub = xP, and disclose the system's public parameters Params = {G1, G2, e, q, P, P pub ,H,H0};

[0049] (1.3) After receiving the public parameters disclosed by PKG, the reverse firewall deployed in PKG re-randomizes the public parameters. PRF Uniformly randomly select random numbers Re-randomize the public parameter P' = f·P,P pub '=f·P pub , and the re-randomized public parameters Params′={G1,G2,e,q,P',P pub ',H,H0} is broadcast to all participants (including signers and verifiers);

[0050] (2) Key extraction:

[0051] (2.1) The user (signer) submits the identity information ID to PKG for identity information registration;

[0052] (2.2) PKG calculates the public key Q ID =H(ID), calculate the private key S ID =xQ ID , send S ID to the signer;

[0053] (3)Signature:

[0054] (3.1) Let L = {ID1, ID2, …, ID n} represents the identity set of n users in the ring, and index s represents the real signer (i.e., his / her public key is That is, the signer is one of the n ring members;

[0055] (3.2) Randomly select n-1 generators U j ∈G1, and U j Signature as a non-signer ring member; using U j Calculating the hash value

[0056] (3.3) Randomly select random numbers Calculate the signature of signer s

[0057] (3.4) Calculate the hash value h of the signer s s =H0(m||L||U s ) and validation parameters

[0058] (3.5) The ring signature generated by the output signer s is

[0059] (3.6) Reverse firewall W deployed on the signer side SRF Re-randomize the generated ring signature, W SRF Randomly select random numbers And calculate the re-randomized signature and re-randomize the signature verification parameter V' = αV. After this, W SRF Send the re-randomized signature To the validator;

[0060] (4) Verification:

[0061] The verifier can verify the signature by combining the message m and the ring member identity set L The effectiveness of

[0062] (4.1) The verifier calculates the hash value of each ring member

[0063] (4.2) and check if it exists

[0064] (4.3) If the equation is true, accept it, otherwise reject it.

[0065] In the embodiment of the present invention, the functional verification is as follows:

[0066] When the verifier receives the signature, it only needs to verify whether the equation holds.

[0067]

[0068] The method proposed in the embodiment of the present invention has the function of maintaining, and can verify the validity of the received signature by verifying the correctness of the formula:

[0069]

[0070] The reverse firewall method for identifying ring signatures disclosed in the embodiment of the present invention defends against backdoor attacks by deploying reverse firewalls on the PKG and signers in the protocol. No matter if an internal attacker subverts any participant in the signature method, the method proposed in the embodiment of the present invention can ensure that the anonymity of the signing party will not be destroyed and the private information will not be leaked to the internal attacker, thereby achieving the privacy leakage prevention of the overall ring signature method. Compared with the ordinary ring signature method, the method proposed in the embodiment of the present invention can achieve that even if the signer and PKG of the ring signature use a subverted algorithm (algorithm tampered by an internal attacker), the anonymity of the ring signature signer will not be destroyed and the privacy will not be leaked to the attacker.

[0071] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0072] The above are only some embodiments of the present invention. For those skilled in the art, several modifications and improvements can be made without departing from the creative concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A reverse firewall method suitable for identification ring signature, characterized in that: The following steps are involved: Step 1: The private key generation center PKG initializes the system public parameters, and re-randomizes the system public parameters based on the reverse firewall deployed on the PKG and broadcasts them to all participants, including signers and verifiers; Step 2: Based on the identity submitted by the user, PKG extracts the user-side key and returns the private key to the user; Step 3: The signer among the members generates a ring signature based on the system public parameters, the identity of the ring member and the private key of the ring member; and re-randomizes the generated ring signature based on the reverse firewall deployed on the signer's side, and then sends the re-randomized ring signature to the verifier; Step 4: The verifier verifies the received re-randomized ring signature based on the system public parameters, the message, and the ring member identity set. If the verification passes, the ring signature is accepted, otherwise it is rejected.

2. The method according to claim 1, characterized in that The PKG initialization system common parameters include: PKG generates cyclic multiplicative groups G1 and G2 of prime order q and bilinear maps e:G1×G1→G2, and sets two secure hash functions H(·) and H0(·), which are expressed as: H:{0,1} * →G1, Among them, {0,1} * Represents a set of binary sequences of arbitrary bit length, a finite field PKG randomly selects random numbers As the master key of PKG, the parameter P is calculated based on the generator P randomly selected from the cyclic multiplicative group G1. pub = xP; Public system parameters {G1,G2,e,q,P,P pub ,H,H0}.

3. The method according to claim 2, characterized in that Based on the reverse firewall deployed on PKG (W PRF ) The specific steps of re-randomizing the system public parameters are as follows: The reverse firewall selects random numbers uniformly at random Re-randomize the public parameter P' = f·P,P pub '=f·P pub , and obtain the re-randomized system public parameters {G1,G2,e,q,P',P pub ',H,H0}.

4. The method according to claim 3, characterized in that Step 2 specifically includes: The user submits his identity information ID to PKG for identification information registration; PKG calculates the user public key Q based on the hash function H(·) ID =H(ID), and calculate the user's private key S ID =xQ ID , and then send the private key S ID To the user corresponding to the identity information ID, so that each signer can obtain his private key.

5. The method according to claim 4, characterized in that In step 3, the signer in the ring member generates a ring signature based on the system public parameters, the identity of the ring member and the private key of the ring member, specifically including: (1) Define L = {ID1, ID2, …, ID n } represents the identity set of n users in the ring, and index s represents the real signer, that is, the public key of the signer is Q IDs =H(ID s ), ID j Indicates the identity information of ring member j, ID s Represents the identity information of the real signer; where i=1,2,…,n; s∈{1,2,…,n}; (2) The signer s randomly selects n-1 generators from the cyclic multiplicative group G1 as signatures of the non-signer ring members, denoted by U j , where the non-signer's ring member number j∈{1,2,…,n}\{s}; Based on U j Calculate the hash value h j =H0(m||L||U j ); where m represents a message; (3) The signer s randomly selects a random number Calculate the signature of the current signer s (4) Calculate the hash value h of the signer s s =H0(m||L||U s ), calculate the verification parameters (5) Based on the signatures U of all ring members i Get the ring signature generated by signer s 6. The method according to claim 5, characterized in that In step 3, the re-randomization of the generated ring signature based on the reverse firewall deployed on the signer side specifically includes: Reverse firewall randomly selects random numbers And calculate the re-randomized signature and the re-randomized verification parameter V'=αV, and obtain the re-randomized ring signature 7. The method according to claim 6, characterized in that Step 4 specifically includes: The validator calculates the hash value Check if it exists If yes, it means that if the verification passes, the ring signature σ' is accepted, otherwise it is rejected.

Images