Identity-based multi-signature system and method based on SM9 and key isolation

Abstract

The invention discloses an identity-based multi-signature system and method based on SM9 and key isolation, and the method comprises the steps: a signature user firstly sends identity information to a key generation center, and generates an initial moment signature key of the signature user; and the signature user interacts with the assist device, and the assist device generates key updating information. After receiving the secret key updating information, the signature user updates the temporary signature secret key of the signature user, carries out signature by using the updated temporary signature secret key, and then sends an individual signature to the intelligent contract module; the smart contract module verifies the legality of the individual signature, and if the signature is legal, an aggregation operation is carried out to generate multiple signatures; and if not, rejecting the signature. According to the method, the risk caused by key leakage in the multi-signature process is effectively reduced, the security of the signature process is remarkably improved, and the problems of key leakage risk and low signature efficiency in the existing multi-signature technology are solved.

Description

Technical Field

[0001] The present invention belongs to the field of information security and multi-signature technology, and mainly relates to an identity-based multi-signature method and system based on SM9 and key isolation. Background Art

[0002] Multi-signature technology allows multiple users to jointly generate a digital signature, thereby representing the consensus of a group or multiple participants. Multi-signature technology is particularly important in scenarios that require joint confirmation or authorization by multiple parties. For example, in an era of rapid development of information technology and widespread application of the Internet, electronic contracts, as a new form of contract, have gradually become a common contract method in many fields such as e-government, e-commerce, and financial services. As more and more commercial and administrative activities move to digital platforms, ensuring the reliability and legality of electronic contracts has become an important challenge. In the process of signing an electronic contract, signatures of multiple participants are usually required to reach a consensus, such as shareholder meeting resolutions in corporate decision-making and multi-party agreement signing in cross-border transactions. These scenarios place high demands on the security and efficiency of multi-signatures, and multi-signature mechanisms are therefore widely used.

[0003] The security of current multi-signature schemes mainly relies on the safe storage of signature keys. However, as more and more signature processes are deployed on insecure devices, the risk of key leakage gradually increases. Once the signature key is leaked, malicious attackers can use the leaked key to forge signatures, thereby impersonating users to conduct illegal transactions or tamper with file contents. In electronic contracts, key leakage will cause the signed documents and data to no longer be credible, and even false documents or transactions may appear. This not only undermines the integrity and authenticity of the document, but may also lead to wrong decisions and executions.

[0004] In PKI (Public Key Infrastructure), certificate management faces multiple challenges. First, as the number of users increases, the issuance, verification, renewal, and revocation of certificates become complicated, increasing the management burden. Secondly, the trust issue of certificates is prominent. If any link in the CA (Certificate Authority) trust chain is compromised, the security of the signature will be compromised. In addition, certificate revocation and renewal management is complex and has poor real-time performance. Traditional CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) may be delayed and unable to reflect the certificate status in real time, affecting the security and efficiency of the system. Interoperability between cross-domain CAs also increases the difficulty of certificate management.

[0005] The SM9 digital signature algorithm uses the user's identity information (such as email address, name, etc.) as the public key to implement the digital signature function. Unlike the traditional public key infrastructure (PKI), it does not require users to obtain a public key certificate through a certificate authority (CA). The user's public key is directly given by their identity. This cryptographic system is simpler to implement encryption and signatures, and can reduce the complexity of certificate management. The SM9 signature algorithm is based on the bilinear pairing theory and has the characteristics of high security, high efficiency in signature generation and verification, and is widely used in scenarios that require identity authentication and data integrity assurance.

[0006] Key isolation technology is a strategy to improve the security of cryptographic systems. It aims to ensure that keys are always isolated and updated securely throughout their life cycle to prevent key leakage or tampering. The main idea is to divide the key into two parts, a temporary key and an auxiliary key. The temporary key is saved by the user, and the auxiliary key is stored on the physical security device Helper. When the user processes data in the current time period, the signature key is updated and generated by the auxiliary key, ensuring that the key leakage in the current time period will not deduce the previous and subsequent keys.

[0007] How to design an identity-based multi-signature based on SM9 and key isolation is of great significance for expanding domestic cryptographic algorithms, resisting key leakage, enhancing the efficiency of electronic transactions and ensuring the security of electronic contract signing. Summary of the invention

[0008] The present invention aims to solve one of the technical problems existing in the related art at least to a certain extent.

[0009] One object of the present invention is to provide an identity-based multi-signature system based on SM9 and key isolation, to implement a multi-signature scheme based on SM9 signature, and to solve the insecurity problem caused by key leakage in multi-signature.

[0010] Another object of the present invention is to provide an identity-based multi-signature method based on SM9 and key isolation using the above system, expand the application scenarios of SM9, ensure the resistance of multi-signatures to key leakage, and improve the overall security of the system.

[0011] In order to achieve the above-mentioned object, the present invention provides an identity-based multi-signature system based on SM9 and key isolation, including:

[0012] The key generation center is used to generate initial key information for the signing user and auxiliary keys for the facilitator;

[0013] The assistant is used to generate key update information for the signing client to help the signing client complete the update of the temporary key;

[0014] The smart contract module is a program module that runs on the blockchain and self-executes contracts according to preset rules and conditions; the smart contract module issues signature requirements, accepts signatures from different signing users, verifies signatures, and aggregates multiple signatures into a multi-signature;

[0015] The signing user end is a login port for the signer who is to sign the data. Each signing user logs in to the system according to different identity information, signs the data to be signed with their own updated temporary key, and jointly forms a multi-signature to prove the legitimacy of the signed data.

[0016] A further preferred technical solution of the present invention is that the system further comprises:

[0017] The data owner end is a port used by the data owner who owns and publishes the signed data, and is used to define the access rights and signature policies for the signed data;

[0018] The signature verification end is the port used by the signature verifier to verify the legitimacy of multiple signatures.

[0019] The present invention also provides an identity-based multi-signature method based on SM9 and key isolation using the above system, comprising the following steps:

[0020] S1. Generate and publish system public parameters through the key generation center;

[0021] S2. The key generation center generates the initial signing key of each signing user according to the system public parameters and the identity information of each signing user collected by the signing user terminal, and sends it to the signing user terminal; the key generation center also generates a secret value for updating the key of each signing user and sends it to the facilitator;

[0022] S3. The assistant generates key update information of the signing user according to the identity information of the signing user and the current time period, and sends it to the signing user. The signing user terminal updates the initial signing key or the temporary signing key of the previous time period to the temporary signing key of the current time period according to the key update information.

[0023] S4. The smart contract module prepares the data to be signed and broadcasts it to each user to be signed. Each user to be signed updates the temporary signing key according to the method in step S3, signs, and then sends it back to the smart contract module;

[0024] S5. After the smart contract module collects the signatures sent by each signing user, it verifies the signature of the signing user according to the system public parameters. If there is an illegal signature, it re-makes the signature document and broadcasts it to each signing user. If the received signatures are all legal, the smart contract module aggregates all signatures into multiple signatures.

[0025] A further preferred technical solution of the present invention is that the system public parameters are generated and disclosed by the key generation center in step S1; the specific method is:

[0026] S11, let G1, G2 and G T They are two cyclic additive groups and one cyclic multiplicative group whose order is a prime number N, and the bilinear map e:G1×G2→G T , from G1×G2 to G T Bilinear pairing of; P1 is the generator of group G1, P2 is the generator of group G2;

[0027] Generate three cryptographic hash functions: Cryptographic hash function H1(Z,n): Cryptographic hash function H2(Z,n): and cryptographic hash function H3(Z):{0,1}*→G1;

[0028] Public system public parameter set Params = {N, G1, G2, G T ,P1,P2,e,H1(Z,n),H2(Z,n),H3(Z)};

[0029] S12, the key generation center selects two random numbers k, k h ∈[1,N-1] as the signature master private key and the assistant's private key, calculate P pub-s =[k]P2 as the signature master public key, P hpk =[k h ]P2 is the facilitator public key;

[0030] S13, key generation center computing group G T The element g=e(P1,P pub-s ), and expose the element g.

[0031] Preferably, in step S2, the key generation center generates the initial signing key of each signing user according to the system public parameters and the identity information of each signing user collected by the signing user terminal, and sends it to the signing user terminal; the key generation center also generates a secret value for updating the key of each signing user and sends it to the assistant; the specific method is:

[0032] S21, the key generation center selects and publishes a signature private key generation function identifier hid represented by one byte;

[0033] S22. Each signing user sends his / her identity information ID i Send to the key generation center;

[0034] S23, the key generation center uses the signer's identity ID i , calculate the auxiliary key information t1 = H1 (IDi ||hid,N)+k, t3=t1 -1 ×k h , and send t3 to the facilitator as the signing user ID i Update the secret value of a key;

[0035] S24, the key generation center calculates d i,0 =t2P1+t3H3(ID i ,0), and use it as the signing user ID i The initial signing key is sent to the signing user ID i .

[0036] Preferably, the assistant in step S3 generates key update information of the signing user according to the identity information of the signing user and the current time period, and sends it to the signing user. The signing user terminal updates the initial signing key or the temporary signing key of the previous time period to the temporary signing key of the current time period according to the key update information. The specific method is:

[0037] S31. Input the signature user ID through the signature user terminal i and the current time period t, the assistant calculates the hash value H3(ID i ,t)、H3(ID i ,t-1), and finally calculate the signature user ID i Key update information

[0038] And update the key information Securely sent to the signing user ID i ;

[0039] S32, Signature User ID i Receive key update information for time period t After that, enter the initial key or the temporary signing key from the previous period Signing User ID i calculate

[0040] Final output As the signing user ID i Temporary signing key in time period t;

[0041] S33, Signature User ID i After updating the signing key, the signing user ID i delete and

[0042] Preferably, the smart contract module in step S4 generates the data to be signed and broadcasts it to each user to be signed. Each user to be signed updates the temporary signing key according to the method in step S3, signs, and then sends it back to the smart contract module. The specific method is:

[0043] S41. The smart contract module generates data to be signed and broadcasts it to each user to be signed;

[0044] S42: Before signing, the signing user updates the key and obtains a temporary signing key for the signing period t.

[0045] S43. After the signing user updates the temporary signing key, the hash value h is calculated. i =H2(h||w i ,N), calculate the integer l i =(r i -h i )modN, if l i =0, return to step S41;

[0046] S44. Calculate the elements in group G1 Output individual signature (S i ,h i ) and the individual signature (S i ,h i ) is sent to the smart contract module.

[0047] Preferably, after the smart contract module in step S5 collects the signatures sent by each signing user, it verifies the signature of the signing user according to the system public parameters. If there is an illegal signature, it re-makes the document to be signed and broadcasts it to each signing user. If the received signatures are all legal, the smart contract module aggregates all signatures into multiple signatures. The specific method is:

[0048] S51, the smart contract module receives the signature message of all signing members (S i ,h i ) first calculate the bilinear pairing e(S i ,H1(ID i ||hid,N)P2+P pub ), and then calculate

[0049] S52, the smart contract module calculates the hash value H2(h||w i ',N), then verify h i '=H2(h||w i ',N)=h i Is it true? If true, then the individual signature (S i ,h i) is legal, otherwise the individual signature is illegal;

[0050] S53. When the smart contract module verifies the individual signature and an illegal individual signature appears, the aggregate signature process is exited and step S4 is performed again;

[0051] S54. If all individual signatures (S i ,h i ) are all legal signatures. The smart contract module aggregates individual signatures and calculates the aggregate signature. Get multi-signature information

[0052] Preferably, in step S4, the smart contract module produces the data to be signed and publishes it to the data owner; the data owner is a port used by the data owner who owns and publishes the signed data, and is used to define the access rights and signature policy of the signed data;

[0053] The data owner publishes a signed message M, and the signature member set {ID i} i＝1,2,...,n and signature time period t;

[0054] Each signing user belonging to the signature member set selects a random number r i ∈[1,N], then calculate: g i =e(H3(ID i ,t),P hpk ), w i =w i,1 w i,2 , w i Send to the smart contract module;

[0055] When the smart contract module receives all the signatories w i Afterwards, calculate As a joint commitment of the signing users, h = H2(M||w,N) is calculated, and finally h is broadcast to each signing user.

[0056] Preferably, in step S5, the smart contract module obtains the multi-signature information After that, the multi-signature information It is sent to the signature verification end through a secure channel. The signature verification end is the port used by the signature verifier to verify the legitimacy of the multi-signature.

[0057] After the signature verifier receives the multi-signature information sent by the smart contract module, it first calculates the hash value H1 (ID i ||hid,N), and then calculate the public key information

[0058] The signature verifier computes two bilinear pairings e(σ,P pub ) and e(U,P2), and then calculate w'=e(σ,P pub )e(U,P2)×Q, and finally calculate h'=H2(M||w',N);

[0059] Compare whether h'=H2(M||w',N)=h are equal. If they are equal, the multi-signature (σ,Q) is a valid signature, otherwise it is an illegal signature.

[0060] Beneficial effects: The present invention provides an identity-based multi-signature system and method based on SM9 and key isolation, which adopts SM9 identity signature, further expands the application scenarios of SM9 algorithm in the direction of multi-signature, helps to promote the popularization and application of domestic cryptographic algorithms, and enhances my country's independent and controllable capabilities in the field of information security.

[0061] The present invention uses key isolation technology, and the key will be dynamically updated during use. The keys of different time periods are independent. Therefore, even if the key of a certain time period is leaked, the attacker cannot deduce the keys of other time periods through this key. The risk caused by key leakage is greatly reduced, and the security of the signing process is guaranteed. The key leakage risk and signature efficiency problems existing in the prior art are effectively solved. Especially in the field requiring high security and identity authentication, it will provide a strong guarantee for information security. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 It is a structural block diagram of the identity-based multi-signature system based on SM9 and key isolation of the present invention.

[0063] Figure 2 It is a flow chart of the identity-based multi-signature method based on SM9 and key isolation of the present invention. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings in the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments, and they should not be understood as limitations on the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. In the description of the present invention, it should be understood that the terms used are only for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0065] Combine the following Figure 1-Figure 2 The present invention describes an identity-based multi-signature system and method based on SM9 and key isolation.

[0066] Embodiment 1: This embodiment provides an identity-based multi-signature system based on SM9 and key isolation.

[0067] The system is Figure 1 As shown, including:

[0068] Key Generation Center (KGC), used to generate initial key information for signing users and auxiliary keys for facilitators;

[0069] Helper, used to generate key update information for the signing client to help the signing client complete the update of the temporary key;

[0070] The smart contract module is a program module that runs on the blockchain and self-executes contracts according to preset rules and conditions; the smart contract module issues signature requirements, accepts signatures from different signing users, verifies signatures, and aggregates multiple signatures into a multi-signature;

[0071] The signing user terminal is a login port for the signer to sign the data. Each signing user logs in to the system according to different identity information, signs the data to be signed with their own updated temporary key, and jointly forms a multi-signature to prove the legitimacy of the signed data;

[0072] The data owner end is a port used by the data owner who owns and publishes the signed data, and is used to define the access rights and signature policies for the signed data;

[0073] The signature verification end is the port used by the signature verifier to verify the legitimacy of multiple signatures.

[0074] To apply this system, the signing user first enters his / her identity information ID i Sent to the key generation center KGC to generate its own initial signing key. The data owner sends the message that needs to be signed to the signing user. The signing user first interacts with the helper Helper, and the helper Helper generates key update information for the signing user. After receiving the key update information, the user updates his temporary signing key, then signs with the updated temporary signing key, and sends the individual signature to the smart contract. After the smart contract receives the individual signatures of all users, it verifies the legitimacy of the individual signatures in turn. If it is legal, it performs an aggregation operation to generate multiple signatures and sends them to the signature verifier. If it is illegal, the signature is rejected. After receiving the multiple signatures, the signature verifier verifies the multiple signatures and outputs the final result of the message signature based on the verification results.

[0075] Embodiment 2: This embodiment provides a method for implementing identity-based multi-signature based on SM9 and key isolation using the system of Embodiment 1.

[0076] The method mainly includes the following stages:

[0077] The specific steps are as follows: system establishment phase, initial key generation phase, key update phase, signature phase, aggregate signature phase and multi-signature verification phase. Figure 2 As shown, including:

[0078] S1, system initialization phase:

[0079] S11, let G1, G2 and G T They are two cyclic additive groups and one cyclic multiplicative group whose order is a prime number N, and the bilinear map e:G1×G2→G T , from G1×G2 to G T The bilinear pairing of the curve used is the BN curve equation with an embedding degree of 12 and an order of 256-bit large prime number: E:y 2 =x 3 +5.

[0080] P1 is the generator of group G1, and P2 is the generator of group G2. SM3 has an output length of 256 bits. Cryptographic hash function H v () uses the SM3 cryptographic hash algorithm, whose output is a hash value of exactly v bits in length.

[0081] Generate three cryptographic hash functions: Cryptographic hash function H1(Z,n): Cryptographic hash function H2(Z,n): and cryptographic hash function H3(Z):{0,1}*→G1;

[0082] The input of the cryptographic hash function H1(Z,n) is the bit string Z, the integer n and the identifier 0x01, and the output is an integer h1∈[1,n-1].

[0083] The specific algorithm is as follows: Initialize a 32-bit counter ct = 0x00000001, calculate For i from 1 to Execute, calculate Ha i =H v (0x01||Z||ct) If hlen / v is an integer, let Otherwise, for The leftmost bit; command Convert the data type of Ha to an integer; calculate h1=(Hamod(n-1))+1.

[0084] The input of the cryptographic hash function H2(Z,n) is the bit string Z, the integer n and the identifier 0x02, and the output is an integer h2∈[1,n-1]. The specific algorithm is the same as above.

[0085] The cryptographic function H3(Z) uses the standard hash function SHA-256 to process the input bit string {0,1}* and convert it into domain elements, and then uses the simplified Swu method to map the domain elements to the cryptographic hash function on the group G1.

[0086] Public system public parameter set Params = {N, G1, G2, G T ,P1,P2,e,H1(Z,n),H2(Z,n),H3(Z)};

[0087] S12, the key generation center selects two random numbers k, k h ∈[1,N-1] as the signature master private key and the assistant's private key, calculate P pub-s =[k]P2 as the signature master public key, P hpk =[k h ]P2 is the facilitator public key;

[0088] S13, key generation center computing group G T The element g=e(P1,P pub-s ), and expose the element g.

[0089] S2, initial key generation phase:

[0090] S21, the key generation center selects and publishes a signature private key generation function identifier hid represented by one byte;

[0091] S22. Each signing user sends his / her identity information ID i Send to the key generation center;

[0092] S23, the key generation center uses the signer's identity ID i , calculate the auxiliary key information t1 = H1 (ID i ||hid,N)+k, t3=t1 -1 ×k h , and send t3 to the facilitator as the signing user ID i Update the secret value of a key;

[0093] S24, the key generation center first calculates the hash value H3 (ID i ,0), then calculate d i,0 =t2P1+t3H3(ID i ,0), and use it as the signing user ID iThe initial signing key is sent to the signing user ID i .

[0094] S3, key update phase:

[0095] S31. Input the signature user ID through the signature user terminal i and the current time period t, the assistant calculates the hash value H3(ID i ,t), hash value H3(ID i ,t-1), and finally calculate the signature user ID i Key update information And update the key information Securely sent to the signing user ID i ;

[0096] S32, Signature User ID i Receive key update information for time period t After that, enter the initial key or the temporary signing key from the previous period Signing User ID i calculate Final output As the signing user ID i Temporary signing key in time period t;

[0097] S33, Signature User ID i After updating the signing key, the signing user ID i delete and

[0098] S4, Signature Phase:

[0099] S41. The data owner publishes a signed message M, and the signature member set {ID i} i＝1,2,...,n and signature time period t;

[0100] S42. Each signing user belonging to the signing member set selects a random number r i ∈[1,N], then calculate: g i =e(H3(ID i ,t),P hpk ), w i =w i,1 w i,2 , w i Send to the smart contract module;

[0101] S43. When the smart contract module receives all the signatories w i Afterwards, calculate As a joint commitment of the signing users, h = H2(M||w,N) is calculated and finally h is broadcast to each signing user;

[0102] S44. Before signing, the signing user updates the key and obtains a temporary signing key for the signing period t.

[0103] S45. After the signing user updates the temporary signing key, the hash value h is calculated. i =H2(h||w i ,N), calculate the integer l i =(r i -h i )modN, if l i =0, return to step S41;

[0104] S46. Calculate the elements in group G1 Output individual signature (S i ,h i ) and the individual signature (S i ,h i ) is sent to the smart contract module.

[0105] S5, Aggregation Signature Phase:

[0106] S51, the smart contract module receives the signature message of all signing members (S i ,h i ) first calculate the bilinear pairing e(S i ,H1(ID i ||hid,N)P2+P pub ), and then calculate

[0107] S52, the smart contract module calculates the hash value H2(h||w i ',N), then verify h i '=H2(h||w i ',N)=h i Is it true? If true, then the individual signature (S i ,h i ) is legal, otherwise the individual signature is illegal;

[0108] S53. When the smart contract module verifies the individual signature and an illegal individual signature appears, the aggregate signature process is exited and step S4 is performed again;

[0109] S54. If all individual signatures (S i ,h i ) are all legal signatures. The smart contract module aggregates individual signatures and calculates the aggregate signature. Multi-signature information Sent to the signature verifier via a secure channel.

[0110] S6, Multi-signature verification phase:

[0111] S61. After the signature verifier receives the multi-signature information sent by the smart contract module, it first calculates the hash value H1 (ID i ||hid,N), and then calculate the public key information

[0112] S62, the signature verifier calculates two bilinear pairings e(σ,P pub ) and e(U,P2), and then calculate w'=e(σ,P pub )e(U,P2)×Q, and finally calculate h'=H2(M||w',N);

[0113] S63. Compare whether h'=H2(M||w',N)=h are equal. If they are equal, the multi-signature (σ,Q) is a valid signature, otherwise it is an illegal signature.

[0114] Embodiment 3: This embodiment provides a non-transitory computer-readable storage medium having computer instructions stored thereon, the computer instructions causing the computer to execute an identity-based multi-signature method based on SM9 and key isolation, the method comprising the following steps:

[0115] S1. Generate and publish system public parameters through the key generation center;

[0116] S2. The key generation center generates the initial signing key of each signing user according to the system public parameters and the identity information of each signing user collected by the signing user terminal, and sends it to the signing user terminal; the key generation center also generates a secret value for updating the key of each signing user and sends it to the facilitator;

[0117] S3. The assistant generates key update information of the signing user according to the identity information of the signing user and the current time period, and sends it to the signing user. The signing user terminal updates the initial signing key or the temporary signing key of the previous time period to the temporary signing key of the current time period according to the key update information.

[0118] S4. The smart contract module prepares the data to be signed and broadcasts it to each user to be signed. Each user to be signed updates the temporary signing key according to the method in step S3, signs, and then sends it back to the smart contract module;

[0119] S5. After the smart contract module collects the signatures sent by each signing user, it verifies the signature of the signing user according to the system public parameters. If there is an illegal signature, it re-makes the signature document and broadcasts it to each signing user. If the received signatures are all legal, the smart contract module aggregates all signatures into multiple signatures.

[0120] Embodiment 4: This embodiment provides an electronic device, which may include: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus. The processor may call the logic instructions in the memory to execute an identity-based multi-signature method based on SM9 and key isolation, and the method includes the following steps:

[0121] S1. Generate and publish system public parameters through the key generation center;

[0122] S2. The key generation center generates the initial signing key of each signing user according to the system public parameters and the identity information of each signing user collected by the signing user terminal, and sends it to the signing user terminal; the key generation center also generates a secret value for updating the key of each signing user and sends it to the facilitator;

[0123] S3. The assistant generates key update information of the signing user according to the identity information of the signing user and the current time period, and sends it to the signing user. The signing user terminal updates the initial signing key or the temporary signing key of the previous time period to the temporary signing key of the current time period according to the key update information.

[0124] S4. The smart contract module prepares the data to be signed and broadcasts it to each user to be signed. Each user to be signed updates the temporary signing key according to the method in step S3, signs, and then sends it back to the smart contract module;

[0125] S5. After the smart contract module collects the signatures sent by each signing user, it verifies the signature of the signing user according to the system public parameters. If there is an illegal signature, it re-makes the signature document and broadcasts it to each signing user. If the received signatures are all legal, the smart contract module aggregates all signatures into multiple signatures.

[0126] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0127] Embodiment 5: This embodiment provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute an identity-based multi-signature method based on SM9 and key isolation. The method includes the following steps:

[0128] S1. Generate and publish system public parameters through the key generation center;

[0129] S2. The key generation center generates the initial signing key of each signing user according to the system public parameters and the identity information of each signing user collected by the signing user terminal, and sends it to the signing user terminal; the key generation center also generates a secret value for updating the key of each signing user and sends it to the facilitator;

[0130] S3. The assistant generates key update information of the signing user according to the identity information of the signing user and the current time period, and sends it to the signing user. The signing user terminal updates the initial signing key or the temporary signing key of the previous time period to the temporary signing key of the current time period according to the key update information.

[0131] S4. The smart contract module prepares the data to be signed and broadcasts it to each user to be signed. Each user to be signed updates the temporary signing key according to the method in step S3, signs, and then sends it back to the smart contract module;

[0132] S5. After the smart contract module collects the signatures sent by each signing user, it verifies the signature of the signing user according to the system public parameters. If there is an illegal signature, it re-makes the signature document and broadcasts it to each signing user. If the received signatures are all legal, the smart contract module aggregates all signatures into multiple signatures.

[0133] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0134] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0135] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An identity-based multi-signature system based on SM9 and key isolation, characterized in that: include: The key generation center is used to generate initial key information for the signing user and auxiliary keys for the facilitator; The assistant is used to generate key update information for the signing client to help the signing client complete the update of the temporary key; The smart contract module is a program module that runs on the blockchain and self-executes contracts according to preset rules and conditions; the smart contract module issues signature requirements, accepts signatures from different signing users, verifies signatures, and aggregates multiple signatures into a multi-signature; The signing user end is a login port for the signer who is to sign the data. Each signing user logs in to the system according to different identity information, signs the data to be signed with their own updated temporary key, and jointly forms a multi-signature to prove the legitimacy of the signed data.

2. The identity-based multi-signature system based on SM9 and key isolation according to claim 1, characterized in that: The system also includes: The data owner end is a port used by the data owner who owns and publishes the signed data, and is used to define the access rights and signature policies for the signed data; The signature verification end is the port used by the signature verifier to verify the legitimacy of multiple signatures.

3. An identity-based multi-signature method based on SM9 and key isolation implemented using the system of claim 1, characterized in that: The method comprises the following steps: S1. Generate and publish system public parameters through the key generation center; S2. The key generation center generates the initial signing key of each signing user according to the system public parameters and the identity information of each signing user collected by the signing user terminal, and sends it to the signing user terminal; the key generation center also generates a secret value for updating the key of each signing user and sends it to the facilitator; S3. The assistant generates key update information of the signing user according to the identity information of the signing user and the current time period, and sends it to the signing user. The signing user terminal updates the initial signing key or the temporary signing key of the previous time period to the temporary signing key of the current time period according to the key update information. S4. The smart contract module prepares the data to be signed and broadcasts it to each user to be signed. Each user to be signed updates the temporary signing key according to the method in step S3, signs, and then sends it back to the smart contract module; S5. After the smart contract module collects the signatures sent by each signing user, it verifies the signature of the signing user according to the system public parameters. If there is an illegal signature, it re-makes the signature document and broadcasts it to each signing user. If the received signatures are all legal, the smart contract module aggregates all signatures into multiple signatures.

4. The method according to claim 3, characterized in that Step S1 generates and publishes system public parameters through the key generation center; the specific method is: S11, let G1, G2 and G T They are two cyclic additive groups and one cyclic multiplicative group whose order is a prime number N, and the bilinear map e:G1×G2→G T , from G1×G2 to G T Bilinear pairing of; P1 is the generator of group G1, P2 is the generator of group G2; Generate three password hash functions: password hash function Cryptographic Hash Functions and cryptographic hash function H3(Z):{0,1}*→G1; Public system public parameter set Params = {N, G1, G2, G T ,P1,P2,e,H1(Z,n),H2(Z,n),H3(Z)}; S12, the key generation center selects two random numbers k, k h ∈[1,N-1] as the signature master private key and the assistant's private key, calculate P pub-s =[k]P2 as the signature master public key, P hpk =[k h ]P2 is the facilitator public key; S13, key generation center computing group G T The element g=e(P1,P pub-s ), and expose the element g.

5. The method according to claim 4, characterized in that In step S2, the key generation center generates the initial signing key of each signing user according to the system public parameters and the identity information of each signing user collected by the signing user terminal, and sends it to the signing user terminal; the key generation center also generates a secret value for updating the key of each signing user and sends it to the assistant; the specific method is: S21, the key generation center selects and publishes a signature private key generation function identifier hid represented by one byte; S22. Each signing user sends his / her identity information ID i Send to the key generation center; S23, the key generation center uses the signer's identity ID i , calculate the auxiliary key information t1 = H1 (ID i ||hid,N)+k,t2=t1 -1 ×k, t3 = t1 -1 ×k h , and send t3 to the facilitator as the signing user ID i Update the secret value of a key; S24, the key generation center calculates d i,0 =t2P1+t3H3(ID i ,0), and use it as the signing user ID i The initial signing key is sent to the signing user ID i .

6. The method according to claim 5, characterized in that In step S3, the assistant generates key update information of the signing user according to the identity information of the signing user and the current time period, and sends it to the signing user. The signing user terminal updates the initial signing key or the temporary signing key of the previous time period to the temporary signing key of the current time period according to the key update information. The specific method is: S31. Input the signature user ID through the signature user terminal i and the current time period t, the assistant calculates the hash value H3(ID i ,t)、H3(ID i ,t-1), and finally calculate the signature user ID i Key update information And update the key information Securely sent to the signing user ID i ; S32, Signature User ID i Receive key update information for time period t After that, enter the initial key or the temporary signing key from the previous period Signing User ID i calculate Final output As the signing user ID i Temporary signing key in time period t; S33, Signature User ID i After updating the signing key, the signing user ID i delete and 7. The method according to claim 6, characterized in that In step S4, the smart contract module generates the data to be signed and broadcasts it to each user to be signed. Each user to be signed updates the temporary signing key according to the method in step S3, signs, and then sends it back to the smart contract module. The specific method is: S41. The smart contract module generates data to be signed and broadcasts it to each user to be signed; S42: Before signing, the signing user updates the key and obtains a temporary signing key for the signing period t. S43. After the signing user updates the temporary signing key, the hash value h is calculated. i =H2(h||w i ,N), calculate the integer l i =(r i -h i )modN, if l i =0, return to step S41; S44. Calculate the elements in group G1 Output individual signature (S i ,h i ) and the individual signature (S i ,h i ) is sent to the smart contract module.

8. The method according to claim 7, characterized in that After the smart contract module in step S5 collects the signatures sent by each signing user, it verifies the signature of the signing user according to the system public parameters. If there is an illegal signature, it re-makes the signature document and broadcasts it to each signing user. If the received signatures are all legal, the smart contract module aggregates all signatures into multiple signatures. The specific method is as follows: S51, the smart contract module receives the signature message of all signing members (S i ,h i ) first calculate the bilinear pairing e(S i ,H1(ID i ||hid,N)P2+P pub ), and then calculate S52, the smart contract module calculates the hash value H2(h||w i ',N), then verify h i '=H2(h||w i ',N)=h i Is it true? If true, then the individual signature (S i ,h i ) is legal, otherwise the individual signature is illegal; S53. When the smart contract module verifies the individual signature and an illegal individual signature appears, the aggregate signature process is exited and step S4 is performed again; S54. If all individual signatures (S i ,h i ) are all legal signatures. The smart contract module aggregates individual signatures and calculates the aggregate signature. Get multi-signature information 9. The method according to claim 8, characterized in that In step S4, the smart contract module produces the data to be signed and publishes it to the data owner; the data owner is a port used by the data owner who owns and publishes the signed data, and is used to define the access rights and signature policies of the signed data; The data owner publishes a signed message M, and the signature member set {ID i } i＝1,2,...,n and signature time period t; Each signing user belonging to the signature member set selects a random number r i ∈[1,N], then calculate: g i =e(H3(ID i ,t),P hpk ), w i =w i,1 w i,2 , w i Send to the smart contract module; When the smart contract module receives all the signatories w i Afterwards, calculate As a joint commitment of the signing users, h = H2(M||w,N) is calculated, and finally h is broadcast to each signing user.

10. The method according to claim 9, characterized in that In step S5, the smart contract module obtains the multi-signature information After that, the multi-signature information It is sent to the signature verification end through a secure channel. The signature verification end is the port used by the signature verifier to verify the legitimacy of the multi-signature. After the signature verifier receives the multi-signature information sent by the smart contract module, it first calculates the hash value H1 (ID i ||hid,N), and then calculate the public key information The signature verifier computes two bilinear pairings e(s,P pub ) and e(U,P2), and then calculate w'=e(s,P pub )e(U,P2)×Q, and finally calculate h'=H2(M||w',N); Compare whether h'=H2(M||w',N)=h are equal. If they are equal, the multi-signature (s,Q) is a valid signature, otherwise it is an illegal signature.

Images