A reverse firewall method for identity ring signature

Abstract

The present invention discloses a reverse firewall method suitable for identification ring signatures, which belongs to the field of information security technology. The present invention defends against backdoor attacks by deploying a reverse firewall on the private key generation center PKG and the signer in the identification ring signature protocol. Regardless of whether an internal attacker subverts any participant in the signature method, the method of the present invention can ensure that the anonymity of the signing participant will not be destroyed and the private information will not be leaked to the internal attacker, thereby achieving the privacy leakage prevention of the overall ring signature method. Compared with the ordinary ring signature method, the method of the present invention can ensure that even if the signer and PKG of the ring signature use a subverted algorithm, that is, an algorithm tampered with by an internal attacker, the present invention can also ensure that the anonymity of the signer of the ring signature will not be destroyed and the privacy will not be leaked to the attacker.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a reverse firewall method suitable for identification ring signatures. Background Art

[0002] By tampering with cryptographic algorithms and inserting backdoors, the security of the algorithms can be compromised, private information can be leaked, and large-scale global surveillance can be carried out. These insider attacks are extremely dangerous, not only stealing large amounts of private user information but also being extremely difficult to detect. Researchers have found that these attacks can effectively crack various cryptographic algorithms, such as encryption, digital signatures, and key exchange.

[0003] The paper "Rivest RL, Shamir A, Tauman Y. How to leak a secret [C]. Advances in Cryptology—ASIACRYPT 2001, Springer: 552-565" proposes an anonymous digital signature known as a ring signature. After proposing the specific concept of a ring signature, researchers also proposed a ring signature method based on RSA (an asymmetric encryption algorithm). However, in this traditional public key infrastructure (PKI), a user's public key has no relationship with their identity. The trustworthiness of the key rests entirely with a trusted third-party certificate authority (CA), which affects both the efficiency and security of ring signatures. The paper "Zhang F, Kim K. ID-based blind signature and ring signature from pairings [C]. Advances in Cryptography—ASI ACRYPT 2002, Springer: 533-547." builds on the identity-based cryptography proposed in this paper and proposes an identity-based ring signature for the first time. This solves the problem of ring signature certificate management and only requires the user's publicly disclosed characteristic information to generate the signature's public key. The paper "Chow SSM, Yiu SM, Hui LC K. Efficient identity-based ring signature [C]. Applied Cryptography and Network Security, ACNS 2005, Springer: 499-512." proposes an efficient identity-based ring signature. This improves efficiency by using fewer bilinear pairing computations and achieves a constant number of pairing computations.

[0004] The paper "Teniese G, Magri B, Venturi D. Subversion-resilient signature schemes [C]. Computer and Communications Security, 2015: 364-375." studies subversion attacks on digital signatures and proposes a general attack method. This scheme demonstrates how to compromise the security of signatures and leak the user's private key by tampering with the random number generator. Even the highly anonymous digital signature mechanism, ring signatures, cannot effectively defend against this attack. The attacker can easily obtain the real identity of the user who generated the ring signature and even the private key used to sign it. Therefore, the paper "Liu C, Chen R, Wang Y, et al. Asymmetric subversion attacks on signature schemes [C]. Information Security and Privacy, ACISP 2018, Springer: 376-395." proposes an asymmetric attack model for signatures. This model is stronger than the subversion model involved in the above-mentioned general attack methods. It also proposes the concept of splittable signatures and gives a general asymmetric subversion attack on this method. Through two consecutive signatures, the attacker can recover the private key.

[0005] To address this issue, the paper "Mironov I, Stephens-Davidowitz N. Cryptographic reverse firewalls [C]. EUROCRYPT 2015, Springer: 657-686" first proposed the concept of cryptographic reverse firewalls (CRFs) and defined three properties that reverse firewalls must possess: functionality preservation, security preservation, and leakage prevention. Functionality preservation means that reverse firewalls can resist subversion attacks by re-randomizing transmitted information without changing the original algorithm's functionality. Security preservation means that the solution with the reverse firewall retains the security characteristics of the original underlying protocol. Leakage prevention means that even if a user sends information implanted with a backdoor, the reverse firewall can render the backdoor ineffective. Furthermore, the reverse firewall should be "transparent" to all parties involved in the cryptographic protocol, meaning it has no impact on the functionality of the underlying cryptographic scheme. Furthermore, the reverse firewall should be semi-honest, meaning it runs the algorithm honestly but should not gain access to the user's privacy. The paper "Ouyang M, Wang Z, Li F. Digital signature with cryptographic reverse firewalls [J]. Journal of Systems Architecture, 2021, 116: 102029." proposed an identity-based digital signature scheme with a reverse firewall and a digital signature scheme with a reverse firewall that relies on traditional PKI under the standard model to achieve resistance to subversion attacks on digital signatures. The following year, the paper "Kang B, Zhang L, Yang Y, et al. CRFs for digital signature and NIZK proof system in web services [C]. Algorithms and Architectures for Parallel Processing. Springer: 192-213." proposed a Pointcheval-Sanders (PS) digital signature scheme with a reverse firewall, and through comparison, it was shown that the performance of this scheme is better than the digital signature scheme with a reverse firewall that relies on traditional PKI.

[0006] However, the existing ring signature method cannot guarantee anonymity and the security of private information under the threat of backdoor attacks. Therefore, it is necessary to propose a reverse firewall method based on identity ring signature to solve this problem. Summary of the Invention

[0007] The purpose of the present invention is to realize a reverse firewall method applicable to an identification ring signature, so as to enhance the ability of the identification-based ring signature to resist active attacks.

[0008] The technical solution adopted in the present invention is:

[0009] A reverse firewall method applicable to an identification ring signature, the method comprising the following steps:

[0010] Step 1: The private key generator (PKG) initializes the system public parameters, re-randomizes them based on the reverse firewall deployed on the PKG, and then broadcasts them to all participants, including signers and verifiers.

[0011] Step 2: Based on the identity submitted by the user, PKG extracts the user key and returns the private key to the user;

[0012] Step 3: The signer among the ring members generates a ring signature based on the system public parameters, the ring member's identity, and the ring member's private key. The generated ring signature is re-randomized using the reverse firewall deployed on the signer's side, and the re-randomized ring signature is sent to the verifier.

[0013] Step 4: The verifier verifies the received re-randomized ring signature based on the system public parameters, the message, and the ring member identity set. If the verification passes, the ring signature is accepted; otherwise, it is rejected.

[0014] Furthermore, the PKG initialization system common parameters specifically include:

[0015] PKG generates cyclic multiplicative groups G1 and G2 of prime order q and bilinear maps e:G1×G1→G2, and sets two secure hash functions H(·) and H0(·), whose expressions are: H:{0,1} * →G1, Among them, {0,1} * Represents a set of binary sequences of arbitrary bit length, a finite field

[0016] PKG randomly selects random numbers As the master key of PKG, and based on the generator P randomly selected from the cyclic multiplicative group G1, the parameter P is calculated pub =xP;

[0017] Public system parameters {G1,G2,e,q,P,P pub ,H,H0}.

[0018] Furthermore, based on the reverse firewall (W PRF ) Re-randomize the system public parameters as follows:

[0019] The reverse firewall selects random numbers uniformly at random Re-randomize the public parameter P' = f·P,P pub '=f·P pub , and obtain the re-randomized system public parameters {G1,G2,e,q,P',P pub ',H,H0}.

[0020] Furthermore, step 2 specifically includes:

[0021] The user submits his identity information ID to PKG for identification information registration;

[0022] PKG calculates the user public key Q based on the hash function H(·) ID =H(ID), and calculate the user's private key S ID =xQ ID , then send the private key S ID To the user corresponding to the identity information ID, so that each signer can obtain his private key.

[0023] Furthermore, in step 3, the signer among the ring members generates a ring signature based on the system public parameters, the ring member's identity, and the ring member's private key, specifically including:

[0024] (1) Define L = {ID1, ID2, ..., ID n} represents the identity set of n users in the ring, and index s represents the real signer, that is, the public key of the signer is Q IDs =H(ID s ), ID j Indicates the identity information of ring member j, ID s Represents the identity information of the real signer; where i = 1, 2, W, n; s∈{1, 2, W, n};

[0025] (2) The signer s randomly selects n-1 generators from the cyclic multiplicative group G1 as signatures of non-signer ring members, denoted as U j , where the non-signer's ring member number j∈{1,2,…,n}\{s};

[0026] Based on U j Calculate the hash value h j =H0(m||L||U j ); where m represents a message;

[0027] (3) The signer s randomly selects a random number Calculate the signature of the current signer s

[0028] (4) Calculate the hash value h of the signer s s =H0(m||L||U s ), calculate the verification parameters

[0029] (5) Based on the signature U of all ring members i Get the ring signature generated by signer s

[0030] Furthermore, in step 3, re-randomizing the generated ring signature based on the reverse firewall deployed on the signer side specifically includes:

[0031] Reverse firewall randomly selects random numbers And calculate the re-randomized signature and the re-randomized verification parameter V'=αV, and obtain the re-randomized ring signature

[0032] Furthermore, step 4 specifically includes:

[0033] The validator calculates the hash value

[0034] Check if it exists If yes, it means that if the verification passes, the ring signature σ' is accepted, otherwise it is rejected.

[0035] The technical solution provided by the present invention brings at least the following beneficial effects:

[0036] This invention provides a reverse firewall method for identity ring signatures. It builds a reverse firewall around the private key generator and signer in the protocol, ensuring that even if an internal attacker embeds a backdoor in the algorithm, the privacy of all participants remains intact. This method enhances the ability of identity-based ring signatures to resist active attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0038] Figure 1 A schematic diagram of the processing process of a reverse firewall method applicable to an identification ring signature provided by an embodiment of the present invention;

[0039] Figure 2This is a flowchart of system common parameters initialized in an embodiment of the present invention;

[0040] Figure 3 This is a flowchart of key extraction in an embodiment of the present invention;

[0041] Figure 4 This is a flowchart of signature generation and verification in an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be described in detail and completely in conjunction with the drawings in the implementation of the present invention. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings can be arranged and designed using different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the present application for protection, but merely represents selected embodiments of the present invention.

[0043] The specific implementation process of the reverse firewall method for identifying ring signature provided by the embodiment of the present invention includes: PKG selects a generator P from the cyclic multiplication group G1, sets the master private key to x, and uses it to generate P in the public parameter pub ,like Figure 1 ; The reverse firewall re-randomization public parameters of the PKG shown are P′ and P pub ′, and send the re-randomized public parameters {P′, P pub ′} to all participants; the signer submits his or her identity information ID to PKG, and PKG generates the signer's private key S based on the identity information ID and master private key submitted by the signer ID Even if the PKG uses a backdoored initialization and key extraction algorithm, the re-randomization of the PKG's reverse firewall makes it impossible for an attacker to distinguish between the PKG's honest behavior and its subversive behavior, let alone extract privacy from it.

[0044] also, Figure 1 We also show the reverse firewall (W SRF )’s operating mechanism. SRF The signature generated by the signer is re-randomized. Due to the re-randomization of the cryptographic reverse firewall, even if the signer uses a random number generator with a backdoor, an internal attacker cannot extract any private information about the signer from the re-randomized message. The method proposed in this embodiment of the present invention is leak-resistant. Even if any party (PKG, signer, verifier) ​​is backdoored, the private information of the participants in the protocol will not be leaked.

[0045] See also Figure 1 、 Figure 2 、 Figure 3 and Figure 4 In one possible implementation, the specific implementation steps of a reverse firewall method applicable to an identification ring signature provided by an embodiment of the present invention include:

[0046] (1) Initialization:

[0047] (1.1) PKG generates cyclic multiplicative groups G1 and G2 of prime order q and bilinear maps e:G1×G1→G2. H(·) and H0(·) are two secure hash functions H:{0,1} * →G1, Among them, {0,1} * Represents a set of binary sequences of arbitrary bit length, a finite field

[0048] (1.2)PKG random selection As the master key of PKG and calculate P pub = xP, and disclose the system's public parameters Params = {G1, G2, e, q, P, P pub ,H,H0};

[0049] (1.3) After receiving the public parameters published by PKG, the reverse firewall deployed in PKG re-randomizes the public parameters. PRF Uniformly randomly select random numbers Re-randomize the public parameter P' = f·P,P pub '=f·P pub And the re-randomized public parameters Params′={G1,G2,e,q,P',P pub ',H,H0} is broadcast to all participants (including signers and verifiers);

[0050] (2) Key extraction:

[0051] (2.1) The user (signer) submits the identity information ID to PKG for identity information registration;

[0052] (2.2) PKG calculates the public key Q ID =H(ID), calculate the private key S ID =xQ ID , send S ID to the signer;

[0053] (3)Signature:

[0054] (3.1) Let L = {ID1, ID2,…, ID n} represents the identity set of n users in the ring, and index s represents the real signer (that is, his / her public key is That is, the signer is one of the n ring members;

[0055] (3.2) Randomly select n-1 generators U j ∈G1, and U j Signature as a non-signer ring member; using U j Calculating the hash value

[0056] (3.3) Randomly select random numbers Calculate the signature of signer s

[0057] (3.4) Calculate the hash value h of the signer s s =H0(m||L||U s ) and validation parameters

[0058] (3.5) The ring signature generated by the output signer s is

[0059] (3.6) Reverse firewall W deployed on the signer side SRF Re-randomize the generated ring signature, W SRF Randomly select random numbers And calculate the re-randomized signature And re-randomize the signature verification parameter V'=αV. After this, W SRF Send the re-randomized signature To the validator;

[0060] (4) Verification:

[0061] The verifier can verify the signature by combining the message m and the ring member identity set L The effectiveness of

[0062] (4.1) The verifier calculates the hash value of each ring member

[0063] (4.2) and check if it exists

[0064] (4.3) If the equation is true, accept it; otherwise reject it.

[0065] In the embodiment of the present invention, the functional verification is as follows:

[0066] When the verifier receives the signature, it only needs to verify whether the equation holds.

[0067]

[0068] The method proposed in the embodiment of the present invention has the function of maintaining and can verify the validity of the received signature by verifying the correctness of the formula:

[0069]

[0070] The embodiment of the present invention discloses a reverse firewall method for identifying ring signatures. This method defends against backdoor attacks by deploying a reverse firewall on the PKG and signer in the protocol. Regardless of whether an internal attacker subverts any participant in the signature method, the method provided by the embodiment of the present invention can ensure that the anonymity of the signing participant will not be destroyed and the private information will not be leaked to the internal attacker, thereby achieving the privacy leakage prevention of the overall ring signature method. Compared with ordinary ring signature methods, the method provided by the embodiment of the present invention can ensure that even if the ring signature signer and PKG use a subverted algorithm (an algorithm tampered with by an internal attacker), the anonymity of the ring signature signer will not be destroyed and the privacy will not be leaked to the attacker.

[0071] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

[0072] The above are only some embodiments of the present invention. For those skilled in the art, several modifications and improvements can be made without departing from the inventive concept of the present invention, which all fall within the scope of protection of the present invention.

Claims

1. A reverse firewall method suitable for identifying ring signatures, characterized in that: The following steps are involved: Step 1: The private key generation center (PKG) initializes the system public parameters, re-randomizes them based on the reverse firewall deployed on the PKG, and then broadcasts them to all participants, including signers and verifiers. Step 2: Based on the identity submitted by the user, PKG extracts the user key and returns the private key to the user; Step 3: The signer generates a ring signature based on the system public parameters, the ring member's identity, and the ring member's private key. The signer re-randomizes the generated ring signature using the reverse firewall deployed on the signer's side, and then sends the re-randomized ring signature to the verifier. Step 4: The verifier verifies the received re-randomized ring signature based on the system public parameters, the message, and the ring member identity set. If the verification passes, the ring signature is accepted; otherwise, it is rejected. Among them, the PKG initialization system common parameters specifically include: PKG generates cyclic multiplicative groups G1 and G2 of prime order q and bilinear maps e:G1×G1→G2, and sets two secure hash functions H(·) and H0(·), whose expressions are: H:{0,1} * →G1, Among them, {0,1} * Represents a set of binary sequences of arbitrary bit length, a finite field PKG randomly selects random numbers As the master key of PKG, and based on the generator P randomly selected from the cyclic multiplicative group G1, the parameter P is calculated pub =xP; Public system parameters {G1,G2,e,q,P,P pub ,H,H0}; The reverse firewall deployed on PKG re-randomizes the system's public parameters as follows: The reverse firewall selects random numbers uniformly at random Re-randomize the public parameter P' = f·P,P pub '=f·P pub , and obtain the re-randomized system public parameters {G1,G2,e,q,P',P pub ',H,H0}; Step 2 specifically includes: The user submits his identity information ID to PKG for identification information registration; PKG calculates the user public key Q based on the hash function H(·) ID =H(ID), and calculate the user's private key S ID =xQ ID , then send the private key S ID To the user corresponding to the identity information ID, so that each signer can obtain his private key; In step 3, the signer among the ring members generates a ring signature based on the system public parameters, the ring member's identity and the ring member's private key. Specifically, the steps include: (1) Define L = {ID1, ID2, ..., ID n } represents the identity set of n users in the ring, and index s represents the real signer, that is, the public key of the signer is ID i Indicates the identity information of ring member i, ID s Represents the identity information of the real signer; where i = 1, 2, ..., n; s∈{1, 2, ..., n}; (2) The signer s randomly selects n-1 generators from the cyclic multiplicative group G1 as signatures of non-signer ring members, denoted as U j , where the non-signer's ring member number j∈{1,2,…,n}\{s}; Based on U j Calculate the hash value h j =H0(m||L||U j ); where m represents a message; (3) The signer s randomly selects a random number Calculate the signature of the current signer s (4) Calculate the hash value h of the signer s s =H0(m||L||U s ), calculate the verification parameters (5) Based on the signature U of all ring members i Get the ring signature generated by signer s 2. The method according to claim 1, wherein In step 3, the generated ring signature is re-randomized based on the reverse firewall deployed on the signer's side, specifically including: Reverse firewall randomly selects random numbers and calculate the re-randomized signature and the re-randomized verification parameter V'=αV, and obtain the re-randomized ring signature 3. The method according to claim 2, wherein Step 4 specifically includes: The validator calculates the hash value Check if it exists If yes, it means that if the verification passes, the ring signature σ' is accepted, otherwise it is rejected.

Images