Distributed identity-based ring signature algorithm supporting malicious termination resistance and suitable for block chain

Abstract

The invention relates to a distributed identity-based ring signature algorithm supporting malicious termination resistance and suitable for a block chain, which is characterized in that a threshold identity-based ring signature algorithm, a Joint-Shamir-RSS secret sharing algorithm, a KZG commitment algorithm and an information theory message verification code (IT-MAC) technology are fused. A threshold identity-based ring signature generation process and an anti-malicious termination function without participation of a trusted third party are realized. A main public key of a ring is generated by using a public key aggregation method, and safe and secret sharing of main and private keys is realized by combining a Joint-Shamir-RSS secret sharing algorithm and a KZG commitment algorithm, so that dependence on trusted KGC is eliminated; by introducing IT-MAC into a threshold identity-based ring signature algorithm, a data uploading node can effectively check the validity of a part of signatures generated by an assisting node, so that the function of resisting malicious termination is realized. The distributed signature scheme not only can provide an additional privacy protection function for a signer, but also has the capability of effectively resisting malicious termination, has higher security, and is suitable for being applied to a block chain system.

Description

Technical Field

[0001] The invention relates to the field of information security technology, and specifically relates to a distributed identity-based ring signature algorithm applicable to blockchain that supports anti-malicious termination, which integrates the threshold identity-based ring signature algorithm, the Joint-Shamir-RSS secret sharing algorithm, the KZG commitment algorithm, and the information-theoretic message authentication code (IT-MAC) technology, and realizes the threshold identity-based ring signature generation process without the participation of a trusted third party and the anti-malicious termination function. This distributed signature scheme can not only provide additional privacy protection functions for the signer, but also has the ability to effectively resist malicious termination, has higher security, and is suitable for application in blockchain systems. Background Art

[0002] Blockchain is a distributed database technology that allows a large number of nodes to concurrently record, share and synchronize data without the intervention of a central authority. Blockchain technology is also known as distributed ledger technology because blockchain does not allow any modification of the data on the chain. Therefore, digital signature technology has become one of the underlying core technologies of blockchain technology. Blockchain systems often use digital signature technology to ensure the credibility of data and prevent possible data tampering. Generally, when a user writes data to the blockchain, he needs to provide his own signature on the data block at the same time, which may bring privacy issues. In blockchain, a common privacy protection strategy is to keep users anonymous throughout the process. For example, Bitcoin achieves anonymity by unbinding the user's public key from his real identity. Malicious attackers can use the public key of this anonymous user to locate all the data blocks submitted by him. By using analytical tools, they can extract the behavior pattern of the anonymous user from it, thus preparing for further attacks. To solve this problem, Monero chose to use ring signatures to construct its own signature system. Ring signatures are a digital signature with obfuscated signers. Users can anonymously sign messages on behalf of a group of spontaneously recruited users (including the actual signer). At this time, the ring signature of the data block will be verified by a group of public keys instead of a single public key. Threshold Ring Signature (TRS) is a distributed ring signature algorithm suitable for blockchain systems, which allows multiple users to jointly generate ring signatures. However, directly applying threshold ring signatures to blockchain systems will encounter efficiency issues. In practical applications, in order to ensure security, both the signer and the verifier need to verify the authenticity of all public keys in the ring, which will bring a lot of communication and computing overhead, seriously affecting the operation of the system. Threshold Identity Based Ring Signature (TIBRS) can effectively solve this problem. In TIBRS, the user's public key is calculated based on the user's public identity, and this calculation can be performed by everyone.

[0003] Chow et al. proposed the first TIBRS algorithm based on bilinear pairing and hash functions in 2005. Since then, new TIBRS algorithms have been proposed continuously. The paper "Chengtang Cao, Lin You, Gengran Hu. Fuzzy identity-based ring signature from lattices [J]. Security and Communication Networks, 2021: 1-9. DOI: 10.1155 / 2021 / 6692608." proposed a lattice-based threshold identity-based ring signature algorithm that can resist quantum attacks. However, the above TIBRS algorithms all rely on a trusted key generation center (KGC) to provide signature private keys. These algorithms are actually centralized and are therefore vulnerable to single-point attacks. Once the KGC is compromised, the entire signature system will become invalid. In practical applications, another threat that needs to be guarded against is malicious termination, that is, malicious participants invalidate the final generated signature by providing an incorrect signature. The paper "Jiguo Li, Hao Yan, Yichen Zhang. Efficient Identity-Based Provable Multi-Copy Data Possession in Multi-Cloud Storage[J]. IEEE Transactions on Cloud Computing, 2022, 10(1): 356-365. DOI: 10.1109 / TCC.2019.2929045" removed KGC from the system by replacing the signature private key with knowledge proof, thus achieving decentralization; the paper "Shuanggen Liu, Kang Chen, Zikang Liu, Teng Wang. Secure Threshold Ring Signature Based on SM9[J]. IEEE Access, 2021, 9: 95507-95516. DOI: 10.1109 / ACCESS.2021.3094902" proposed replacing a single KGC with multiple KGCs to solve the problem of single-point attacks and achieve decentralization. However, neither of the above two solutions can achieve the function of resisting malicious termination. It can be seen that in order to solve the privacy protection problem of blockchain users, it is necessary to design a distributed identity-based ring signature algorithm with anti-malicious termination function. Summary of the invention

[0004] In view of the drawbacks of the prior art, the present invention proposes a distributed identity-based ring signature algorithm suitable for blockchain that supports anti-malicious termination, solving the problem that the existing threshold identity-based ring signature algorithm cannot achieve decentralization and anti-malicious termination at the same time. The present invention integrates the threshold identity-based ring signature algorithm, the Joint-Shamir-RSS secret sharing algorithm, the KZG commitment algorithm, and the information-theoretic message authentication code (IT-MAC) technology to achieve a threshold identity-based ring signature generation process without the participation of a trusted third party and an anti-malicious termination function. This distributed signature scheme can not only provide additional privacy protection functions for the signer, but also has the ability to effectively resist malicious termination, has higher security, and is suitable for application in blockchain systems.

[0005] In order to achieve the above-mentioned object of the invention, the present invention is implemented by the following technical solutions:

[0006] A distributed identity-based ring signature algorithm suitable for blockchain that supports resistance to malicious termination is disclosed. The method inherits the advantages of the existing threshold identity-based ring signature algorithm and introduces the Joint-Shamir-RSS secret sharing algorithm, the KZG commitment algorithm, and the information-theoretic message authentication code (IT-MAC) technology.

[0007] Its technical innovations are: 1. This scheme does not rely on trusted KGC, and the master public key is jointly generated by all signature nodes in the ring. This process can resist rogue-key attacks; 2. The Joint-Shamir-RSS secret sharing strategy and the KZG commitment algorithm are combined to achieve secure distribution of the master private key; 3. By introducing the information-theoretic message authentication code (IT-MAC) technology, the anti-malicious termination function is realized.

[0008] In this scheme, the number of signature nodes in the ring must be greater than or equal to the threshold value t. Whenever a new ring is established or the set of signature nodes in the ring changes, each signature node will generate a public key pair locally to collaboratively generate the master public key and master private key of the ring, and record the master public key of the ring in the blockchain. Next, each signature node will execute the Joint-Shamir-RSS secret sharing strategy and the KZG commitment algorithm to achieve secret sharing of the master private key. When a signature node needs to upload a data block to the blockchain, other signature nodes in the ring will elect t-1 assisting nodes to help the data uploading node generate a valid threshold ring signature. In the process of generating the signature, each assisting node must not only generate the partial signature it holds, but also generate a commitment value for the master private key fragment and random number it holds based on the information theory message authentication code technology; the data uploading node will check the validity of the partial signature provided by the assisting node based on these commitment values, and finally aggregate to obtain a valid threshold ring signature. The specific steps of the method include:

[0009] (1) Initialization Setup: All signature nodes in the ring jointly generate the ring master public key MPK and complete the secret sharing of the master private key MSK. Setup is only executed when the ring is first established or the set of signature nodes in the ring changes.

[0010] (2) Signature private key generation KeyGen: The actual signing nodes participating in this signature jointly generate the temporary public key TPK for this signature. Then each actual signing node will calculate its own signature private key SignSK used in this signature process based on TPK.

[0011] (3) Commitment: Each assisting node will generate relevant commitment values ​​for the master private key shard and random number it holds, and send them to the data uploading node.

[0012] (4) Signature: Each actual signing node generates a partial signature for the data block to be signed and sends the partial signature to the data uploading node. The data uploading node aggregates all partial signatures and generates the final threshold ring signature.

[0013] (5) Verify: A third-party verifier verifies the validity of the threshold ring signature based on the threshold ring signature, the ring's master public key, the data block, and the ring's membership list. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is the algorithm flow chart of the present invention DETAILED DESCRIPTION

[0015] In view of the drawbacks of the prior art, the present invention provides a distributed identity-based ring signature algorithm applicable to blockchain that supports resistance to malicious termination. The specific implementation of the present invention is described below to facilitate technical personnel in this technical field to understand the present invention, but it should be clear that the present invention is not limited to the scope of the specific implementation. For ordinary technical personnel in this technical field, as long as various changes are within the spirit and scope of the present invention defined and determined by the attached claims, these changes are obvious, and all inventions and creations using the concept of the present invention are protected.

[0016] The method of the present invention consists of five steps, and the specific construction process is as follows:

[0017] For the convenience of description, we define the identity list of n members in the ring as L IDR ={ID1, ID n}, in the following text we will use the node identity ID i To refer to the node; the threshold value is t, the nodes in each ring that agree to participate in the signature process are signature nodes, and their number is k, n ≥ k ≥ t, and their subscript set is recorded as |SISN |=k; In a specific signature process, the signature node in the ring that needs to upload the data block is the data upload node, recorded as ID s , the other t-1 signature nodes are assisting nodes, and their subscript set is denoted by S IAN ∈{1,…,n},|S LAN |=t-1; The above two types of nodes are collectively called actual signature nodes, and their subscript set is denoted by S IASN =ID s ∪S IAN ,|S IASN |=t, the data block to be signed is M.

[0018] (1) Initialize Setup:

[0019] a) Given a security parameter λ, the blockchain is a ring L IDR Generate three group elements Three hash functions H A , H Z , H Q , bilinear pairing e. Among them are all additive cyclic groups of order q, The generator of is P, The generators of are Q, and the bilinear pairing satisfies e: The hash function is defined as follows: A : H Z : H Q : Node ID i The public key is

[0020] b) For each signing node ID i , i∈S ISN , randomly select and calculate PK i =sk i ·P. Subsequent ID i Will randomly select And generate public parameters Next ID i PK i , pp i ) is sent to other signing nodes in the ring.

[0021] c) After receiving the other k-1 copies (PK i , Pp i ) after which ID i You can get a list ID i The master public key of the ring can be calculated as Any signature node will (L IDR , L PK , MPK) is recorded in the blockchain.

[0022] d) ID i Randomly construct a polynomial f of degree t-1 i (x) = sk i ·kac i +f i，1 x+…+f i，t-1 x t-1 And polynomial commitment Next ID i All secret shared values ​​can be calculated and related KZG commitments Last ID i The tuple Sent to all other signing nodes in the ring.

[0023] e) For each secret share value received, ID i The following checks will be performed: If all verifications are successful, then ID i You can get the master private key shard held by it

[0024] (2) Signature private key generation KeyGen:

[0025] a) For each actual signing node ID i , i∈S IASN , ID i Randomly select and calculate Then ID i The tuple (R i , MASK i ) is sent to all other actual signing nodes.

[0026] b) Receive (R) from all other actual signing nodes i , MASK i ) after which ID i Two lists can be obtained Then the random number R and the mask can be aggregated as follows where rac j =H A (S IASN , L R , R j ), mac j =H A (S IASN , L MASK , MASK j).

[0027] c) For each assisting node ID i Random Selection And calculate your own signature value for the message This value is then sent to the ID s . ID s Receive other t-1 s i Then, calculate your own s in the same way s Then ID s The temporary public key for this signature can be calculated ID s Share TPK with all assisting nodes. The signature private key used in this signature is: in

[0028] (3) Commitment:

[0029] a)Data upload node ID s Random Selection A p =a·P. Then ID s Send A to all assisting nodes. For each assisting node ID i , i∈S IAN , ID i Random Selection And calculate the publicly available Then ID i The commitment to the shard holding the master private key and the nonce is calculated as follows: Last ID i Calculate QM i =smk i ·l i ·MASK will verify the code Send to ID s .

[0030] b) ID s After receiving all the verification codes, first aggregate all the promises: Then the following check is performed: e(MPK, MASK) = e(P, QM); C msk =a·(MPK-smk s l s ·P)+B msk ; C r =a·(Rr s ·P)+B r If any of the above checks fails, all signature nodes in the ring are required to disclose their polynomial fi (x) and r i , eliminate the dishonest persons and repeat the Setup step.

[0031] (4)Signature:

[0032] a) ID s Calculate the signature of M ID s use Construct a polynomial of degree t g(x) = s0 + g1x + ... + g t x t , where g(0) = s0, g(i) = s i . Then s0, QM is shared with all other assisting nodes.

[0033] b) For each assisting node ID i calculate and Then ID i Calculate the commitment value again And (U i , V i , B i )Send to ID s .

[0034] c) ID s Check whether the following equation holds true to determine the assisting node ID i Validity of the generated partial signature: If the equality does not hold, then ID s The assisting node is marked as a malicious user, and another signing node is selected from the ring to repeat the KeyGen and Sign phases.

[0035] d) For each node ID s Random Selection And set

[0036] e) ID s Calculate your own partial signature and

[0037] f) ID s Aggregate all partial signatures to get the final threshold ring signature

[0038] (5) Verify: The verifier can check the validity of the threshold ring signature in the following two steps.

[0039] a) First, the verifier checks whether g(x) has degree t and checks equality Is it true? If not, the signature is invalid.

[0040] b) Verifier Check If equality holds, the signature is accepted.

Claims

1. A distributed identity-based ring signature algorithm applicable to blockchain that supports anti-malicious termination, characterized by: (1) At all stages of the algorithm, there is no need for the participation of a trusted third party, KGC. (2) During the initialization phase, all signing nodes in the ring jointly negotiate the master public key of the ring. This process can resist rogue-key attacks. By combining the Joint-Shamir-RSS secret sharing algorithm and the KZG commitment algorithm, secure secret sharing of the master private key among all signing nodes in the ring is achieved. (3) During the signature private key generation phase, all actual signing nodes negotiate to obtain the signature public key for this signature. Then, the actual signing node can calculate the signature private key used in this signature process based on the signature public key and the master private key shard it holds. (4) In the commitment phase, each assisting node generates an IT-MAC of the master private key fragment and the random number. In the signing phase, the data uploader can check the validity of the partial signature provided by the assisting node based on the IT-MAC. In this process, the information about the assisting node generating the master private key fragment and the random number will not be exposed. (4) In this scheme, the data uploader can identify malicious assisting nodes and ensure the validity of the generated threshold ring signature.

2. A distributed multi-party digital signature algorithm suitable for blockchain according to claim 1, characterized in that The specific steps of the method include: (1) Initialization Setup: All signature nodes in the ring jointly generate the ring master public key MPK and complete the secret sharing of the master private key MSK. Setup is only executed when the ring is first established or the set of signature nodes in the ring changes. (2) Signature private key generation KeyGen: The actual signing nodes participating in this signature jointly generate the temporary public key TPK for this signature. Then each actual signing node will calculate its own signature private key SignSK used in this signature process based on TPK. (3) Commitment: Each assisting node will generate relevant commitment values ​​for the master private key shard and random number it holds, and send them to the data uploading node. (4) Signature: Each actual signing node generates a partial signature for the data block to be signed and sends the partial signature to the data uploading node. The data uploading node aggregates all partial signatures and generates the final threshold ring signature. (5) Verify: A third-party verifier verifies the validity of the threshold ring signature based on the threshold ring signature, the ring's master public key, the data block, and the ring's membership list.

3. A distributed multi-party digital signature algorithm suitable for blockchain according to claim 2, characterized in that The specific algorithm of the method includes: For the convenience of description, we define the identity list of n members in the ring as L IDR ={ID1, ID n }, in the following text we will use the node identity ID i To refer to the node; the threshold value is t, the nodes in each ring that agree to participate in the signature process are signature nodes, and their number is k, n ≥ k ≥ t, and their subscript set is recorded as In a specific signing process, the signature node in the ring that needs to upload the data block is the data upload node, recorded as ID s , the other t-1 signature nodes are assisting nodes, and their subscript set is denoted by S IAN ∈{1,…,n},|S IAN |=t-1; The above two types of nodes are collectively called actual signature nodes, and their subscript set is denoted by S IASN =ID s ∪S IAN ,|S IASN |=t, the data block to be signed is M. (1) Initialize Setup: a) Given a security parameter λ, the blockchain is a ring L IDR Generate three group elements Three hash functions H A , H Z , H Q , bilinear pairing e. Among them are all additive cyclic groups of order q, The generator of is P, The generators are Q, and the bilinear pairing satisfies The hash function is defined as follows: Node ID i The public key is b) For each signing node ID i , i∈S ISN , randomly select and calculate PK i =sk i ·P. Subsequent ID i Will randomly select And generate public parameters Next ID i PK i , pp i ) is sent to other signing nodes in the ring. c) After receiving the other k-1 copies (PK i , pp i ) after which ID i You can get a list ID i The master public key of the ring can be calculated as Any signature node will (L IDR , L PK , MPK) is recorded in the blockchain. d) ID i Randomly construct a polynomial f of degree t-1 i (x) = sk i ·kac i +f i，1 x+…+f i，t-1 x t-1 And polynomial commitment Next ID i All secret shared values ​​can be calculated and related KZG commitments Last ID i The tuple Sent to all other signing nodes in the ring. e) For each secret share value received, ID i The following checks will be performed: If all verifications are successful, then ID i You can get the master private key shard held by it (2) Signature private key generation KeyGen: a) For each actual signing node ID i , i∈S IASN , ID i Randomly select and calculate R i = r′ i O, MASK i =mask i Q, followed by ID i The tuple (R i , MASK i ) is sent to all other actual signing nodes. b) Receive (R) from all other actual signing nodes i , MASK i ) after which ID i Two lists can be obtained Then the random number R and mask MASK can be aggregated as follows: where rac j =H A (S IASN , L R , R j ), mac j =HA(S IASN , L MASK , MASK j ). c) For each assisting node ID i Random Selection And calculate your own signature value for the message This value is then sent to the ID s . ID s Receive other t-1 s i Then, calculate your own s in the same way s Then ID s The temporary public key for this signature can be calculated ID s Share TPK with all assisting nodes. The signature private key used in this signature is: in (3) Commitment: a)Data upload node ID s Random Selection A p =a·P. Then ID s Send A to all assisting nodes. For each assisting node ID i , i∈S IAN , ID i Random Selection And calculate the publicly available Then ID i The commitment to the shard holding the master private key and the nonce is calculated as follows: Last ID i Calculate QM i =smk i ·l i ·MASK will verify the code Send to ID s . b) ID s After receiving all the verification codes, first aggregate all the promises: Then the following check is performed: e(MPK, MASK) = e(P, QM); C msk =a·(MPK-smk s l s ·P)+B msk ; C r =a·(Rr s ·P)+B r If any of the above checks fails, all signature nodes in the ring are required to disclose their polynomial f i (x) and r i , eliminate the dishonest persons and repeat the Setup step. (4)Signature: a) ID s Calculate the signature of M ID s use Construct a polynomial of degree t g(x) = s0 + g1x + ... + g t x t , where g(0) = s0, g(i) = s i . Then s0, QM is shared with all other assisting nodes. b) For each assisting node ID i calculate and Then ID i Calculate the commitment value again And (U i , V i , B i )Send to ID s . c) ID s Check whether the following equation holds true to determine the assisting node ID i Validity of the generated partial signature: If the equality does not hold, then ID s The assisting node is marked as a malicious user, and another signing node is selected from the ring to repeat the KeyGen and Sign phases. d) For each node ID s Random Selection And set e) ID s Calculate your own partial signature and f) ID s Aggregate all partial signatures to get the final threshold ring signature (5) Verify: The verifier can check the validity of the threshold ring signature in the following two steps. a) First, the verifier checks whether g(x) has degree t and checks equality Is it true? If not, the signature is invalid. b) Verifier Check If equality holds, the signature is accepted.

Images