Traceable certificateless aggregation signature method and system

Abstract

The invention discloses a traceable certificateless aggregation signature method, the method is applied to a certificateless aggregation signature system, the system comprises n device collectors, an aggregator in communication connection with each device collector, a key generation center KGC, and a verifier in communication connection with the aggregator, the method comprises the following steps that aggregation information sigma is generated through signature information # imgabs0 #, Mi is data collected by an equipment collector i, and sigma i is signature information of the data Mi; the timeliness of the aggregation information sigma is verified, if verification succeeds, the aggregation information sigma is received, otherwise, an invalid signature node search algorithm is executed to detect invalid signature nodes, the detected invalid signature nodes are added to an invalid signature node group, and other nodes are added to an effective signature node group. According to the method, the signature node causing the aggregation verification failure can be quickly found out, so that the data can be received to the greatest extent, and the data receiving rate is improved instead of discarding all data.

Description

Technical Field

[0001] The present invention belongs to the technical field of Internet of Things, and in particular relates to a traceable certificateless aggregate signature method and system. Background Art

[0002] With the rapid development of the Internet of Things (IoT), more and more devices are connected to the network, forming a huge ecosystem of interconnected devices. These devices are everywhere, from home smart devices, industrial control systems to smart transportation and medical equipment. With the expansion of IoT application scenarios and the surge in data collection devices, security issues have become more prominent. The authenticity, integrity and efficient verification of data are one of the core issues of IoT system security, and aggregate digital signature technology provides an effective solution in this regard.

[0003] Existing IoT digital signature technologies can be divided into the following three categories:

[0004] (1) Public Key Infrastructure (PKI) Aggregate Digital Signature Scheme: This scheme combines the advantages of traditional PKI and aggregate signature to achieve efficient and secure signature verification. Its technical principles include: First, the certificate authority (CA) generates and manages the user's public-private key pair and issues a digital certificate to verify the authenticity of the user's public key. Each user signs a message with a private key to generate an independent digital signature. These signatures are then collected by a trusted aggregation node and aggregated into a single aggregate signature. When verifying, the receiver only needs to calculate once to confirm the validity of all signatures through the aggregate signature and the public keys and certificates of all participating users. This scheme greatly improves the efficiency of signature verification while ensuring the integrity and authenticity of the signature data. It is suitable for large-scale networks and distributed systems that require efficient processing and security. However, although the PKI-based aggregate digital signature scheme provides strong security, it is costly and complex to implement and manage due to its complex setup and maintenance, cumbersome certificate management and revocation, trust issues, and potential single points of failure.

[0005] (2) Identity-Based Aggregate Signature (IBAS): It combines the advantages of identity-based encryption (IBE) and aggregate signature to achieve efficient signature verification without certificates. Its technical principle is as follows: First, the trusted private key generation center (PKG) generates a partial private key based on the user's identity information and transmits it to the user securely. The user uses his identity information and partial private key to generate his own complete private key and public key, eliminating the certificate management step in the traditional public key infrastructure (PKI). Each user uses his complete private key to sign the message to generate an independent digital signature. Then, these signatures are merged into a single aggregate signature through aggregation technology. When verifying, the receiver verifies the validity of all signatures at one time through the user's identity information, aggregate signature, and system public key obtained from PKG. While maintaining data integrity and authenticity, this scheme simplifies the key management and distribution process and improves the efficiency of signature verification. It is particularly suitable for large-scale distributed systems and IoT application scenarios. The IBAS solution simplifies the key management and distribution process by removing the certificate issuance and management steps in the traditional PKI aggregation solution, but it is necessary to ensure the high security of PKG to prevent private key leakage.

[0006] (3) Certificateless Aggregate Signature (CLAS): It combines the advantages of certificateless signature and aggregate signature to simplify key management and improve signature verification efficiency. Its technical principle is as follows: First, the trusted key generation center (KGC) generates a system public key and private key, and generates a partial private key for each user. The user generates his own public key and complete private key through his identity information and system public key. The complete private key consists of the private key generated by the user and the partial private key provided by the KGC. The user uses the complete private key to sign the message to generate an independent certificateless signature. The signatures of multiple users can be aggregated into a single aggregate signature to reduce transmission and storage overhead. The receiver verifies the aggregate signature through the user's public key and the system public key, and only needs one calculation to confirm the validity of all signatures. This scheme avoids the problems of certificate management and private key hosting, improves the security and verification efficiency of the system, and is particularly suitable for large-scale distributed systems and IoT environments that require efficient signature verification.

[0007] In summary, the certificateless aggregate signature scheme avoids the cumbersome certificate issuance and revocation management overhead in the PKI aggregate signature scheme, and does not have the key leakage problem in the IBAS scheme. Therefore, it is very suitable for the IoT environment that requires efficient signature verification. However, the existing certificateless aggregate signature scheme only considers the case where the aggregate verification is successful, and has not given sufficient consideration to the case where the aggregate verification fails, and how to find the signature node that caused the aggregate verification failure. In a specific IoT scenario, it is very necessary to find the problematic signature node, so as to maximize the data reception and improve the data reception rate, instead of discarding all the data. Summary of the invention

[0008] In order to solve the above problems, the present invention provides a traceable certificateless aggregate signature method and system, which can quickly find the signature node that causes the aggregate verification failure, so as to receive data to the maximum extent and improve the data receiving rate, instead of discarding all data.

[0009] The technical solution adopted by the present invention is:

[0010] In a first aspect, the present application discloses a traceable certificateless aggregate signature method, which is applied to a certificateless aggregate signature system, wherein the system comprises n device collectors, an aggregator that is communicatively connected to each device collector, a key generation center KGC, and a verifier that is communicatively connected to the aggregator, wherein the method comprises the following steps: using signature information Generate aggregate information σ, where M i is the data collected by device collector i, σ i It is data M i The signature information, Verify the timeliness of the aggregate information σ. If the verification is successful, receive the aggregate information σ. Otherwise, execute the invalid signature node search algorithm to detect invalid signature nodes, and add the detected invalid signature nodes to the invalid signature node group, and add the remaining nodes to the valid signature node group.

[0011] As an optional technical solution, the method further includes: initializing and broadcasting the system parameter set S P ; Using the system parameter set S P Generate a complete private key pair (x, ppk) and a complete public key pair (X, R); Generate signature information σ based on the complete private key pair (x, ppk) and the complete public key pair (X, R) i .

[0012] As an optional technical solution, the initialization includes: selecting an elliptic curve group G according to the security parameter K, the order of the group is q, and the generator is P; randomly selecting the parameter As the system private key, calculate P pub=s×P as the system public key, gcd(·) represents the greatest common divisor function; five hash functions H, H1~H4 are selected, among which, l indicates the character length; broadcast system parameter set S P And save the system private key s, where S P = {G, q, P, P pub , H, H1~H4}.

[0013] As an optional technical solution, the generation of the complete private key pair (x, ppk) and the complete public key pair (X, R) includes three steps: key value selection, partial key extraction and complete key generation.

[0014] The key value selection step includes: randomly selecting parameters As the key, (ID, X) is sent to the key generation center; where ID represents the real identity information of the device collector, and X is the product of parameter x and generator P. The partial key extraction steps include: the key generation center uses the broadcast system parameter set S P The received (ID, X) is used to calculate the partial key ppk. The complete key generation step includes: the device collector obtains the complete private key pair (x, ppk) and the complete public key pair (X, R) according to the partial key ppk, and publishes the public key pair.

[0015] As an optional technical solution, the partial key extraction step specifically includes: the key generation center calculates the partial key ppk:

[0016] ppk = r + s × h1 × mod (q);

[0017] Among them, r is a randomly selected parameter, mod(q) represents the modulus of the group order q; h1 is calculated according to the following formula:

[0018] h1=H1(PID,R,X,P pub );

[0019] Where R = r × P, and the anonymous PID is calculated according to the following formula:

[0020]

[0021] Where T represents the expiration time of the anonymous PID. Represents the exclusive OR operation;

[0022] The key generation center sends information (PID, ppk, R, h1) to the device collector;

[0023] After receiving the information (PID, ppk, R, h1), the device collector verifies it. If the first verification condition is met, the device collector receives the information (PID, ppk, R, h1), where the first verification condition is:

[0024] ppk×P=R+h1×P pub ………………(1);

[0025] That is, if the above formula (1) holds true, the device collector receives information (PID, ppk, R, h1).

[0026] As an optional technical solution, the complete key generation step also includes: the verifier randomly selects parameters And calculate in As the verification code key, Verification code public key, verification code key pair Used to quickly detect invalid signature nodes.

[0027] As an optional technical solution, the signature information σ i is: i =(Y i ,u i , Mac i , t i ),in:

[0028] Y i =y i ×P;

[0029] u i =y i +h 2i ×x+ppk;

[0030] h 2i =H2(PID i , M i , R, X, P pub , Y i , t i );

[0031]

[0032]

[0033] Among them, y i are randomly selected parameters, PID i is the anonymous identity information of device collector i, M i is the data collected by device collector i, t i Indicates the current time; ID iis the real identity information of device collector i, T i Indicates anonymous PID i The expiration time.

[0034] As an optional technical solution, the generation of the aggregate information σ includes: the device collector i converts the data (M i , σ i ) is sent to the aggregator; the aggregator receives signatures and data information from n device collectors at the same time Aggregate the signatures and data information of all device collectors to obtain aggregate information σ; the aggregator sends the aggregate information σ to the verifier. Among them:

[0035] σ=(M1,…,M n , Mac1, …, Mac n ,η,t now , Y1,…,Y n );

[0036]

[0037]

[0038] As an optional technical solution, the timeliness of verifying the aggregate information σ includes:

[0039] After receiving the aggregate information σ, the verifier verifies t according to the second verification condition now The second verification condition is:

[0040]

[0041] That is, if the above formula (2) holds, the verifier receives the aggregate information σ; where (X i , R i ) is the public key pair published by device collector i, h 1i =H1(PID i , R i , X i , P pub ).

[0042] If the above formula (2) does not hold, the aggregator executes the invalid signature node search algorithm to find the invalid signature node.

[0043] As an optional technical solution, the invalid signature node search algorithm includes: signing information σ1, σ2, ..., σ i , …, σ n Divide into m batches; re-aggregate and verify the signature information in each batch, and receive the successfully verified re-aggregated information σ mj, j = 1, 2, ..., m, σ mj Represents the re-aggregation information of the th batch among m batches, and proceeds to the next step for the batches that failed verification; the aggregator calculates the verification code Mac for each node in the batch that failed verification i ′, and judge Mac i ′=Mac i Is it true? If not, the node will be added to the invalid signature node group. If true, the node will be added to the valid signature node group, where:

[0044]

[0045]

[0046] In a second aspect, the present application also discloses a traceable certificateless aggregate signature system, which includes: a device collector, an aggregator, a verifier, and a key generation center KGC as disclosed in the first aspect above.

[0047] The beneficial effects of the present invention are:

[0048] 1. The designed invalid signature node fast search algorithm can quickly find the invalid signature node when the aggregation verification fails;

[0049] 2. Reject invalid signature node data and accept valid signature node data instead of rejecting all of them, which greatly improves the availability of IoT data. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a flowchart of a traceable certificateless aggregate signature method in an exemplary embodiment.

[0051] Figure 2 It is an architectural diagram of a traceable certificateless aggregate signature system in an exemplary embodiment.

[0052] Figure 3 It is a schematic diagram of a key value selection process in an exemplary embodiment.

[0053] Figure 4 It is a schematic diagram of a partial key extraction process in an exemplary embodiment.

[0054] Figure 5 Schematic diagram of the aggregate signing and verification process in an exemplary embodiment.

[0055] Figure 6 It is a flowchart of an invalid signature node search algorithm in an exemplary embodiment. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. The components and method steps of the embodiments of the present invention generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0057] The relevant symbols involved in this application are explained in Table 1 below.

[0058] Table 1. Symbols

[0059]

[0060] Example

[0061] This embodiment discloses a traceable certificateless aggregate signature method, which is applied to a certificateless aggregate signature system, wherein the system includes n device collectors, an aggregator that is communicatively connected to each device collector, a key generation center KGC, and a verifier that is communicatively connected to the aggregator, such as Figure 1 As shown, the method comprises the following steps: S1, using signature information Generate aggregate information σ, where M i is the data collected by device collector i, σ i It is data M i The signature information, S2. Verify the timeliness of the aggregate information σ. If the verification is successful, receive the aggregate information σ. Otherwise, execute the invalid signature node search algorithm to detect invalid signature nodes, and add the detected invalid signature nodes to the invalid signature node group, and add the remaining nodes to the valid signature node group.

[0062] As an optional implementation, the signature information σ i The generation of includes the following processes:

[0063] S101, initialize and broadcast system parameter set S P .

[0064] S102, using system parameter set S P Generate a complete private key pair (x, ppk) and a complete public key pair (X, R).

[0065] S103, generate signature information σ based on the complete private key pair (x, ppk) and the complete public key pair (X, R) i .

[0066] As an optional implementation, the initialization in step S101 includes: selecting an elliptic curve group G according to the security parameter κ, the group order is q, and the generator is P; randomly selecting the parameter As the system private key, calculate P pub =s×P as the system public key, gcd(·) represents the greatest common divisor function; five hash functions H, H1~H4 are selected, among which, l indicates the character length; broadcast system parameter set S P And save the system private key s, where S P = {G, q, P, P pub , H, H1~H4}.

[0067] As an optional implementation, the generation of the complete private key pair (x, ppk) and the complete public key pair (X, R) in step S102 includes three steps: key value selection, partial key extraction, and complete key generation.

[0068] The key value selection step includes: randomly selecting parameters As the key, (ID, X) is sent to the key generation center; where ID represents the real identity information of the device collector, and X is the product of parameter x and generator P. The partial key extraction steps include: the key generation center uses the broadcast system parameter set S P The received (ID, X) is used to calculate the partial key ppk. The complete key generation step includes: the device collector obtains the complete private key pair (x, ppk) and the complete public key pair (X, R) according to the partial key ppk, and publishes the public key pair.

[0069] As an optional implementation, the partial key extraction step specifically includes: the key generation center calculates the partial key ppk:

[0070] ppk = r + s × h1 × mod (q);

[0071] Among them, r is a randomly selected parameter, mod(q) represents the modulus of the group order q; h1 is calculated according to the following formula:

[0072] h1=H1(PID,R,X,P pub );

[0073] Where R = r × P, and the anonymous PID is calculated according to the following formula:

[0074]

[0075] Where T represents the expiration time of the anonymous PID. Represents the exclusive OR operation;

[0076] The key generation center sends information (PID, ppk, R) to the device collector;

[0077] After receiving the information (PID, ppk, R), the device collector calculates h1 = H1 (PID, R, X, P pub ), if the first verification condition is met, the information (PID, ppk, R) is received, where the first verification condition is:

[0078] ppk×P=R+h1×P pub ………………(1);

[0079] That is, if the above formula (1) holds true, the device collector receives information (PID, ppk, R).

[0080] As an optional implementation, the complete key generation step further includes: the verifier randomly selects parameters And calculate in As the verification code key, Verification code public key, verification code key pair Used to quickly detect invalid signature nodes.

[0081] As an optional implementation, the signature information σ i is: i =(Y i ,u i , Mac i , t i ),in:

[0082] Y i =y i ×P;

[0083] u i =y i +h 2i ×x+ppk;

[0084] h 2i =H2(PID i , M i , R, X, P pub , Y i , t i );

[0085]

[0086]

[0087] Among them, y i are randomly selected parameters, PID i is the anonymous identity information of device collector i, M i is the data collected by device collector i, t i Indicates the current time; ID i is the real identity information of device collector i, T i Indicates anonymous PID i The expiration time.

[0088] As an optional implementation, the generation of the aggregate information σ in step S1 includes: the device collector i converts the data (M i , σ i ) is sent to the aggregator; the aggregator receives signatures and data information from n device collectors at the same time Aggregate the signatures and data information of all device collectors to obtain aggregate information σ; the aggregator sends the aggregate information σ to the verifier. Among them:

[0089] σ=(M1,…,M n , Mac1, …, Mac n ,η,t now , Y1,…,Y n );

[0090]

[0091]

[0092] As an optional implementation, verifying the timeliness of the aggregate information σ in step S2 includes:

[0093] After receiving the aggregate information σ, the verifier verifies t according to the second verification condition now The second verification condition is:

[0094]

[0095] That is, if the above formula (2) holds, the verifier receives the aggregate information σ; where (X i , R i ) is the public key pair published by device collector i, h 1i =H1(PID i , R i , X i , P pub ).

[0096] If the above formula (2) does not hold, the aggregator executes the invalid signature node search algorithm to find the invalid signature node.

[0097] As an optional implementation, the invalid signature node search algorithm includes: signing information σ1, σ2, ..., σ i , …, σ n Divide into m batches; re-aggregate and verify the signature information in each batch, and receive the successfully verified re-aggregated information σ mj , j = 1, 2, ..., m, σ mj Represents the re-aggregation information of the th batch among m batches, and proceeds to the next step for the batches that failed verification; the aggregator calculates the verification code Mac for each node in the batch that failed verification i ′, and judge Mac i ′=Mac i Is it true? If not, the node will be added to the invalid signature node group. If true, the node will be added to the valid signature node group, where:

[0098]

[0099]

[0100] In the second aspect, the present application also discloses a traceable certificateless aggregate signature system, which includes: a device collector, an aggregator, a verifier, and a key generation center KGC as disclosed in the above method embodiment. The overall architecture of the system is as follows: Figure 2 As shown, the functions of each component are roughly as follows:

[0101] Device collector: Deployed in the IoT environment, it is used for data collection and signing of the collected data, and finally sends the collected data and signature information to the aggregator.

[0102] Aggregator: Aggregates multiple single signatures received at the same time into a single signature and sends the aggregated signature to the validator.

[0103] Validator: Verify the received data and aggregate signature. If the verification passes, the data is accepted. If the verification fails, the aggregate signature is traced back to find the invalid signature node.

[0104] Key Generation Center KGC: used to generate system keys and distribute keys to device collectors.

[0105] In order to better understand this embodiment, this embodiment is further described below.

[0106] In this embodiment, except for the device itself, other devices cannot obtain the complete private key of the device; the pairing-free method is adopted to reduce the computing overhead; the anonymous mechanism is adopted to protect the identity of the device from being leaked; the signature aggregation method is used to aggregate multiple signatures into a single signature to reduce the signature verification time, and an invalid signature node check algorithm is designed to quickly find the invalid signature node that causes the aggregate signature scheme to fail. The traceable certificateless aggregate signature method provided in this embodiment can be roughly divided into the following parts.

[0107] (a) System initialization.

[0108] Initialize the system, generate system private key, system public key and publish system parameters.

[0109] (a1) KGC selects an elliptic curve group G according to the security parameter κ, the group order is q, and the generator is P;

[0110] (a2), KGC randomly selects parameters As the system private key, calculate P pub =s×P as the system public key, Where gcd(·) represents the greatest common divisor function;

[0111] (a3) KGC selects five hash functions H, H1~H4, where l represents the character length;

[0112] (a4), KGC broadcast system parameter set S P , S P = {G, q, P, P pub , H, H1~H4}, and safely save the system private key s.

[0113] (ii) Key value selection.

[0114] like Figure 3 As shown, the device collector randomly selects As the key, calculate X=x×P, and then send (ID, X) to KGC, where ID represents the real identity of the device collector.

[0115] (3) Extraction of partial keys.

[0116] like Figure 4 As shown in the figure, partial key extraction includes the following processes:

[0117] (c1) When receiving (ID, X) from the device collector, KGC randomly selects parameters Calculate R = r × P, calculate anonymity Where T represents the expiration time of the anonymous PID. Indicates XOR operation. KGC calculates h1=H1(PID, R, X, P pub ), calculate the partial key ppk = r + s × h1 × mod (q). Where mod (q) represents the modulus of the group order q.

[0118] (c2), KGC sends information (PID, ppk, R, h1) to the device collector.

[0119] (c3) After receiving the information (PID, ppk, R, h1), the device collector verifies ppk×P=R+h1×P pub Is it true? If so, receive information (PID, ppk, R, h1).

[0120] (IV) Complete key generation.

[0121] (d1) The device collector obtains a complete private key pair (x, ppk) and a complete public key pair (X, R), and makes the public key pair public.

[0122] (d2), the validator randomly selects parameters And calculate in As the verification code key, Verification code public key, verification code key pair Used to quickly detect invalid signature nodes.

[0123] (V) Aggregate signature and verification.

[0124] like Figure 5 As shown, aggregate signing and verification generally include the following steps:

[0125] (e1), the device collector f collects the data M i Sign, randomly select Calculate Y i =y i ×P, calculate h 2i =H2(PID i , M i , R, X, P pub , Y i , t i ),u i =y i +h 2i ×x+ppk, where t i Indicates the current time, PID i is the anonymous identity information of device collector i. Output signature information σ i =(Y i ,u i, Mac i , t i ).

[0126] (e2), the device collector will (M i , σ i ) is sent to the aggregator.

[0127] (e3) The aggregator receives signatures and data information from n device collectors at the same time. set up Output aggregation information σ:

[0128] σ=(M1,…,M n , Mac1, …, Mac n ,η,t now , Y1,…,Y n ).

[0129] (e4), send the aggregate information σ to the verifier.

[0130] (e5) After receiving the aggregation information σ, the aggregator verifies t now The timeliness of , first calculate:

[0131]

[0132]

[0133] Then verify the equation Whether it is established or not, if it is established, receive the aggregation information σ.

[0134] (VI) Invalid signature node check.

[0135] When the aggregation verification fails, that is, the equation verified in step (e5) does not hold, the aggregator executes the invalid signature node search algorithm to find the invalid signature node.

[0136] The flowchart of the invalid signature node search algorithm is as follows: Figure 6 As shown, it generally includes:

[0137] (f1) Assume that 2000 signature nodes are aggregated and there are 4 invalid signature nodes. First, divide the 2000 signature nodes into 10 batches, with 200 nodes in each batch.

[0138] (f2) Perform aggregate verification on these 10 batches sequentially or simultaneously. If the verification succeeds, they will be accepted. If the verification fails, proceed to the next step. Figure 6 , assuming that the first and last batches fail validation.

[0139] (f3), the aggregator calculates the verification code Mac for each node in the failed batchi ′, and judge Mac i ′=Mac i Is it true? If not, the node will join the invalid signature node group. If true, the node will join the valid node group and receive.

[0140] The algorithm can be summarized in Table 2:

[0141] Table 2. Invalid signature node search algorithm

[0142]

[0143] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solution according to the embodiment of the present application can be embodied in the form of a software product, which can be stored in a readable medium or on a network, and includes several instructions to enable an electronic device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiment of the present application.

[0144] The above description is only a specific implementation mode of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. All technical solutions that fall within the scope defined by the claims of the present invention fall within the protection scope of the present invention.

Claims

1. A traceable certificateless aggregate signature method, applied to a certificateless aggregate signature system, the system comprising n device collectors, an aggregator connected to each device collector, a key generation center KGC, and a verifier connected to the aggregator, characterized in that: The method comprises the following steps: Using signature information Generate aggregate information σ, where M i is the data collected by device collector i, σ i It is data M i Signature information; Verify the timeliness of the aggregate information σ. If the verification is successful, receive the aggregate information σ. Otherwise, execute the invalid signature node search algorithm to detect invalid signature nodes, and add the detected invalid signature nodes to the invalid signature node group, and add the remaining nodes to the valid signature node group.

2. The traceable certificateless aggregate signature method according to claim 1, characterized in that: The method further comprises: Initialize and broadcast the system parameter set S P ; Using the system parameter set S P Generate a complete private key pair (x, ppk) and a complete public key pair (X, R); Generate signature information σ based on the complete private key pair (x, ppk) and the complete public key pair (X, R) i .

3. The traceable certificateless aggregate signature method according to claim 2, characterized in that: The initialization includes: According to the security parameter κ, an elliptic curve group G is selected, the group order is q, and the generator is P; Randomly select parameters As the system private key, calculate P pub =s×P as the system public key, gcd(·) represents the greatest common divisor function; Select five hash functions H, H1~H4, where l represents the character length; Broadcast system parameter set S P And save the system private key s, where S P = {G,q,P,P pub ,H,H1~H4}.

4. The traceable certificateless aggregate signature method according to claim 3, characterized in that: The generation of the complete private key pair (x, ppk) and the complete public key pair (X, R) includes the following three steps: Key value selection: Random selection parameters As the key, (ID, X) is sent to the key generation center; ID represents the real identity information of the device collector, and X is the product of parameter x and generator P; Partial key extraction: The key generation center uses the broadcast system parameter set S P And the received (ID, X) is calculated to obtain the partial key ppk; And complete key generation: the device collector obtains the complete private key pair (x, ppk) and the complete public key pair (X, R) based on the partial key ppk, and publishes the public key pair.

5. The traceable certificateless aggregate signature method according to claim 4, characterized in that: The partial key extraction includes: The key generation center calculates the partial key ppk: ppk = r + s × h1 × mod (q); Among them, r is a randomly selected parameter, mod(q) represents the modulus of the group order q; h1 is calculated according to the following formula: h1=H1(PID,R,X,P pub ); Where R = r × P, and the anonymous PID is calculated according to the following formula: Where T represents the expiration time of the anonymous PID. Represents the exclusive OR operation; The key generation center sends information (PID, ppk, R, h1) to the device collector; After receiving the information (PID, ppk, R, h1), the device collector verifies it. If the first verification condition is met, the device collector receives the information (PID, ppk, R, h1), where the first verification condition is: ppk×P=R+h1×P pub ………………(1); That is, if the above formula (1) holds true, the device collector receives information (PID, ppk, R, h1).

6. The traceable certificateless aggregate signature method according to claim 5, characterized in that: The complete key generation also includes: the verifier randomly selects parameters And calculate in As the verification code key, Verification code public key, verification code key pair Used to quickly detect invalid signature nodes.

7. The traceable certificateless aggregate signature method according to claim 6, characterized in that: The signature information σ i is: i =(Y i ,u i , Mac i , t i ),in: AND i =and i ×P; u i =y i +h 2i ×x+ppk; h 2i =H2(PID i ,M i ,R,X,P pub ,Y i ,t i ); Among them, y i are randomly selected parameters, PID i is the anonymous identity information of device collector i, M i is the data collected by device collector i, t i Indicates the current time; ID i is the real identity information of device collector i, T i Indicates anonymous PID i The expiration time.

8. The traceable certificateless aggregate signature method according to claim 7, characterized in that: The generation of the aggregation information σ includes: The device collector i will transfer the data (M i ,σ i ) is sent to the aggregator; The aggregator receives signatures and data information from n device collectors at the same time Aggregate the signatures and data information of all device collectors to obtain aggregate information σ: σ=(M1,…,M n ,Mac1,…,Mac n ,h,t now ,Y1…,Y n ); in, The aggregator sends the aggregate information σ to the validator.

9. The traceable certificateless aggregate signature method according to claim 8, characterized in that: The timeliness of verifying the aggregate information σ includes: After receiving the aggregate information σ, the verifier verifies t according to the second verification condition now The second verification condition is: That is, if the above formula (2) holds, the verifier receives the aggregate information σ; where (X i ,R i ) is the public key pair published by device collector i, h 1i =H1(PID i ,R i ,X i ,P pub ). If the above formula (2) does not hold, the aggregator executes the invalid signature node search algorithm to find the invalid signature node.

10. The traceable certificateless aggregate signature method according to claim 9, characterized in that: The invalid signature node search algorithm includes: The signature information σ1, σ2, …, σ of n device collectors is i ,…,σ n Divide into m batches; The signature information in each batch is re-aggregated and verified separately, and the re-aggregated information σ that is successfully verified is received mj , j = 1, 2, ..., m, σ mj Represents the re-aggregation information of the jth batch among m batches, and proceeds to the next step for the batches that failed verification; The aggregator calculates the verification code Mac for each node in the batch that failed verification i ′, and judge Mac i ′=Mac i Is it true? If not, the node will be added to the invalid signature node group. If true, the node will be added to the valid signature node group, where:

11. A traceable certificateless aggregate signature system, characterized by: It includes the device collector, aggregator, verifier and key generation center KGC as described in any one of claims 1 to 10.

Images