Linkable double-ring signature method and device based on NTRU grid, equipment and medium

Abstract

The invention relates to a linkable double-ring signature method, device and equipment based on an NTRU lattice and a medium, and the method comprises the steps: a server side generates a signature link label I < pi > based on a user identity id < pi > corresponding to a ring member user < pi > when the ring member user < pi > signs a message m, generating a signature sigpi according to a user private key skpi, a main public key mpk, an identity set ID of all users in the ring member list and a system global parameter pp; the server side verifies the signature sigpi based on the message m, the identity set ID of all users in the ring member list and the system global parameter pp; and the server side obtains the first signature and the second signature of different messages, and determines that the first signature and the second signature are from the same user according to the link label of the first signature and the link label of the second signature so as to complete the linkable double-ring signature based on the NTRU grid. According to the method, the storage overhead and the time overhead of the server during calculation can be reduced, and the practicability is improved.

Description

Technical Field

[0001] The present application relates to the field of data encryption, and in particular to a linkable double-ring signature method based on NTRU lattice, a corresponding device, an electronic device and a computer-readable storage medium. Background Art

[0002] A ring signature is a special digital signature that provides anonymity protection for the signer. It allows the signer to autonomously collect the public keys of ring members to form a ring without the permission or assistance of other ring members. The signer is included in the set of ring members and signs on behalf of the ring members. The verifier can only determine that the signer is from a ring, but cannot determine which ring member it is.

[0003] Due to the anonymity of ring signatures, they are widely used in fields such as electronic voting, electronic cash, and anonymous reporting. Although anonymity is very important and should be retained in most cases, it can become a problem in some applications where dishonest users overuse anonymity to gain their own benefits. For example, in electronic voting scenarios, dishonest users use anonymity to try to vote again after completing a vote. In order to avoid such dishonest behavior, linkable ring signature technology came into being.

[0004] The identity-based cryptographic system uses the user's identity as the public key, and the user's private key is calculated by the key generation center based on the system master key and the user's identity. The user's public key is uniquely determined by the user's identity, so the user does not need a third party to guarantee the authenticity of the public key. In this way, the communicating parties can securely generate and verify signatures without going through a trusted third party.

[0005] In the post-quantum era, cryptographic schemes based on traditional number theory problems such as large integer decomposition and discrete logarithms are no longer secure. Lattice public key cryptography has become the best candidate for cryptographic standards in the post-quantum era due to its quantum resistance and the existence of a reduction from the worst-case instance to the common instance. However, the keys and signatures generated by the existing lattice-based digital signature technology occupy a large space and take a long time to generate, so they are not very practical. At present, no scholar has proposed a good solution to this problem.

[0006] At present, the linkable ring signature technology in the existing technology has the following technical defects:

[0007] First, the generated user keys and signatures take up a lot of storage space, and the signature generation process is slow. In real-world scenarios, since there are usually many ring users and they frequently generate signatures, the storage and time overhead on the server is high, resulting in low practicality.

[0008] Second, there is no work on identity-based digital signatures combining dual rings and NTRU lattices.

[0009] Third, most of the current linkable ring signature methods are single-ring signatures, that is, multiple response values ​​and a challenge value are generated as part of the signature, while the lattice-based signature system has a larger response value and a smaller challenge value, so the two are poorly compatible.

[0010] To sum up, the user keys and signatures generated by the linkable ring signature technology in the prior art take up a large amount of storage space, and the signature generation is slow, which results in a large storage and time overhead for the server, resulting in low practicality. The applicant has made corresponding explorations to solve this problem. Summary of the invention

[0011] The purpose of the present application is to solve the above problems and provide a linkable dual-ring signature method based on NTRU lattice, a corresponding device, an electronic device and a computer-readable storage medium.

[0012] In order to meet the various objectives of this application, this application adopts the following technical solutions:

[0013] A linkable double-ring signature method based on NTRU lattice is proposed to meet one of the purposes of this application, including:

[0014] The server obtains the security parameter λ and the number of ring member users N, and generates the system global parameter pp, the master public key mpk and the master private key msk based on the security parameter λ and the number of ring member users N, which includes:

[0015] The server determines the polynomial vector length n according to the security parameter λ and the number of ring member users N, and uses the NTRU encryption algorithm to generate four polynomial vectors f, g, F, and G according to the polynomial vector length n, and uses the four polynomial vectors f, g, F, and G as the master private key msk;

[0016] The server determines an integer q based on the security parameter λ and calculates the master public key mpk=g·f -1 mod q;

[0017] The server determines a variance σ based on the security parameter λ and selects two hash functions H 1 , H 2 , taking the master public key mpk, the polynomial vector length n, the integer q and the variance σ as the system global parameter pp;

[0018] The server is based on the master private key mmsk and the user identity id of the ring member user π π , generate the user private key sk of the ring member user π π ;

[0019] When the ring member user π signs a message m, the server side uses the user identity id corresponding to the ring member user π to sign the message m. π Generate Signature Link TagI π , and according to the user private key sk π , the master public key mpk, the identity set ID of all users in the ring member list and the system global parameter pp generate the signature sig π ;

[0020] The server verifies the signature sig based on the message m, the identity set ID of all users in the ring member list, and the system global parameter pp. π ;

[0021] The server obtains the first signature and the second signature of different messages, and determines that the first signature and the second signature are from the same user according to the link tag of the first signature and the link tag of the second signature, so as to complete the linkable dual-ring signature based on the NTRU lattice.

[0022] Optionally, the server side uses the master private key msk and the user identity id of the ring member user π π , generate the user private key sk of the ring member user π π The steps include:

[0023] Based on the user identity id of the ring member user π π , the grid point screening algorithm is used to calculate and determine the two polynomial vectors s 1π and 2π , output the user private key sk of the ring member user π π =(s 1π ,s 2π ).

[0024] Optionally, when the ring member user π signs a message m, based on the user identity id corresponding to the ring member user π π Generate Signature Link TagI π , and according to the user private key sk π , the master public key mpk, the identity set ID of all users in the ring member list and the system global parameter pp generate the signature sig π The steps include:

[0025] Randomly select two polynomial vectors of length n from a normal distribution D with variance σ and n-1 short vectors c i ←{0, 1} n , where i∈{1, 2, ..., N} and i≠π;

[0026] Calculation

[0027] Call the hash function H 1 , calculate and determine the signature link label I π =H 1 (id π );

[0028] Call the hash function H 2 , calculate and determine the challenge c = H 2 (m, ID, R);

[0029] Calculate and determine a short vector

[0030] Calculate the first commitment z 1 =c π ·s 1π +y 1 , using the rejection sampling algorithm to The probability of the first commitment z 1 Perform rejection sampling, where M is a large integer;

[0031] Calculate and determine the second commitment z 2 =c π ·s 2π +y 2 , using the rejection sampling algorithm to The probability of the second commitment z 2 Perform rejection sampling, where M is a large integer;

[0032] Output signature sig π =((c 1 , c 2 , ..., c N ), (z 1 , z 2 ), I π ).

[0033] Optionally, based on the message m, the identity set ID of all users in the ring member list and the system global parameter pp, verify the signature sig π The steps include:

[0034] Verify the first commitment z 1 With the second commitment z 2 Is the Euclidean length between less than If the Euclidean length is less than Then calculate and determine

[0035] Computational determination challenges Verify that the challenge c is equal to H 2 (m, ID, R′), if the output result is 1, if the challenge c is equal to the H 2 (m, ID, R′), then the signature is passed.

[0036] Optionally, the step of obtaining a first signature and a second signature of different messages, and determining, according to a link tag of the first signature and a link tag of the second signature, that the first signature and the second signature are from the same user includes:

[0037] Get the first signature sig of different messages 1 With the second signature sig 2 , from the first signature sig 1 And the second signature sig 2 The first signature sig 1 Signature Link Tag I 1 And the second signature sig 2 Signature Link Tag I 2 ;

[0038] Determine the first signature sig 1 Signature Link Tag I 1 With the second signature sig 2 Signature Link Tag I 2 Are they equal? ​​If the signature link tag I 1 Link tag I with the signature 2 If they are equal, the output result is 1, indicating that the first signature sig 1 With the second signature sig 2 From the same user.

[0039] Optionally, the ring member list includes multiple ring member nodes, and the ring member user corresponds to one or more ring member nodes.

[0040] Optionally, the server end is a third-party trusted center end.

[0041] A linkable double-ring signature device based on NTRU lattice is provided to meet another purpose of the present application, comprising:

[0042] The system parameter generation module is configured to obtain the security parameter λ and the number of ring member users N from the server side, and generate the system global parameter pp, the master public key mpk and the master private key msk based on the security parameter λ and the number of ring member users N, which includes:

[0043] The server determines the polynomial vector length n according to the security parameter λ, and uses the NTRU encryption algorithm to generate four polynomial vectors f, g, F, and G according to the polynomial vector length n, and uses the four polynomial vectors f, g, F, and G as the master private key msk;

[0044] The server determines an integer q based on the security parameter λ and calculates the master public key mpk=g·f -1 mod q;

[0045] The server determines a variance σ based on the security parameter λ and selects two hash functions H 1 , H 2 , taking the master public key mpk, the polynomial vector length n, the integer q and the variance σ as the system global parameter pp;

[0046] The user private key generation module is set to the server based on the master private key msk and the user identity id of the ring member user π π , generate the user private key sk of the ring member user π π ;

[0047] The message signature generation module is configured to generate a signature based on the user identity ID corresponding to the ring member user π when the server side signs a message m. π Generate Signature Link TagI π , and according to the user private key sk π , the master public key mpk, the identity set ID of all users in the ring member list and the system global parameter pp generate the signature sig π ;

[0048] The message signature verification module verifies the signature sig based on the message m, the identity set ID of all users in the ring member list, and the system global parameter pp. π ;

[0049] The linkable double-ring signature module is configured to obtain the first signature and the second signature of different messages on the server side, and determine that the first signature and the second signature are from the same user according to the link tag of the first signature and the link tag of the second signature, so as to complete the linkable double-ring signature based on the NTRU grid.

[0050] An electronic device provided to meet another purpose of the present application includes a central processing unit and a memory, wherein the central processing unit is used to call and run a computer program stored in the memory to execute the steps of the NTRU-based linkable dual-ring signature method described in the present application.

[0051] A computer-readable storage medium is provided to meet another purpose of the present application, which stores a computer program implemented according to the linkable double-ring signature method based on the NTRU grid in the form of computer-readable instructions. When the computer program is called and executed by a computer, the steps included in the corresponding method are executed.

[0052] Compared with the prior art, the present application aims at the problems that the user key and signature generated by the linkable ring signature technology in the prior art occupy a large amount of storage space, generate signatures slowly, and incur a large amount of storage and time overhead on the server, resulting in low practicality. The present application includes but is not limited to the following beneficial effects:

[0053] First, users often consider economic factors when building a ring signature system. In order to reduce costs, they usually use as few servers as possible for computing and storage. This application combines an identity-based digital signature system to achieve the goal of quickly and securely generating and verifying signatures without exchanging public key certificates and saving key directories.

[0054] Secondly, to address the problem that the signature of the lattice-based digital signature system is too large and too slow to generate, this application intends to use a dual-ring digital signature technology to provide users with a more practical lattice-based linkable ring signature technology;

[0055] Third, in order to solve the problem that the user private key of the lattice-based linkable ring signature system is too large and the generation is too slow, this application proposes an identity-based linkable dual-ring signature scheme on the NTRU lattice. This scheme uses polynomial vectors instead of matrices as user private keys, which can greatly reduce their size, and can be combined with dual-ring digital signature technology to have better performance;

[0056] Fourth, this application uses identity-based digital signature technology. The signer does not need to exchange public key certificates or save key directories. It can quickly and securely generate and verify signatures, reducing server overhead. The use of dual-ring digital signature technology and NTRU format solves problems such as slow key and signature generation speed and large signature length, effectively reduces bandwidth resource consumption, and makes the solution easy to deploy, manage and implement;

[0057] Fifth, this application implements a new identity-based linkable dual-ring signature scheme on the NTRU lattice. When ring users generate signatures, they do not need to exchange public key certificates or save key directories. The NTRU lattice and dual-ring structure are used, so that the invention can quickly and securely generate and verify signatures. It satisfies the unconditional anonymity, unforgeability and linkability under the random oracle model, so that the invention can achieve the security of resisting the key forgery attack, signature forgery attack and double signature attack of the adversary. Compared with the use of traditional lattices, the use of polynomial vectors as keys and signatures can reduce the storage overhead and time overhead of the server during calculation, thereby improving practicality. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0059] Figure 1 An exemplary network architecture adopted by the linkable dual-ring signature system based on the NTRU lattice in the embodiment of the present application;

[0060] Figure 2 It is a flowchart of a linkable double-ring signature method based on NTRU lattice in an embodiment of the present application;

[0061] Figure 3 It is a principle block diagram of a linkable dual-ring signature device based on NTRU lattice in an embodiment of the present application;

[0062] Figure 4 It is a schematic diagram of the structure of the computer device in the embodiment of the present application. DETAILED DESCRIPTION

[0063] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present application.

[0064] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be an intermediate element. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0065] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with those in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as here.

[0066] It will be understood by those skilled in the art that the "client", "terminal" and "terminal device" used herein include both devices with wireless signal receivers, which are devices with only wireless signal receivers without transmission capabilities, and devices with receiving and transmitting hardware, which are devices with receiving and transmitting hardware capable of two-way communication on a two-way communication link. Such devices may include: cellular or other communication devices such as personal computers, tablet computers, which have single-line displays or multi-line displays or cellular or other communication devices without multi-line displays; PCS (Personal Communications Service, personal communication system), which can combine voice, data processing, fax and / or data communication capabilities; PDA (Personal Digital Assistant, personal digital assistant), which may include a radio frequency receiver, pager, Internet / intranet access, web browser, notepad, calendar and / or GPS (Global Positioning System, global positioning system) receiver; conventional laptop and / or palmtop computers or other devices, which have and / or include a conventional laptop and / or palmtop computer or other device with and / or including a radio frequency receiver. The "client", "terminal" and "terminal device" used herein may be portable, transportable, installed in a vehicle (air, sea and / or land), or suitable for and / or configured to run locally, and / or in a distributed form, at any other location on the earth and / or in space. The "client", "terminal" and "terminal device" used herein may also be a communication terminal, an Internet terminal, a music / video playing terminal, for example, a PDA, a MID (Mobile Internet Device) and / or a mobile phone with a music / video playing function, or a smart TV, a set-top box and other devices.

[0067] The hardware referred to by the names such as "server", "client", and "service node" in this application is essentially an electronic device with the equivalent capabilities of a personal computer. It is a hardware device with the necessary components revealed by the von Neumann principle, such as a central processing unit (including an arithmetic unit and a controller), a memory, an input device, and an output device. The computer program is stored in its memory, and the central processing unit calls the program stored in the external memory into the internal memory for execution, executes the instructions in the program, and interacts with the input and output devices to complete specific functions.

[0068] It should be pointed out that the concept of "server" referred to in this application can also be extended to the case of server clusters. According to the network deployment principle understood by those skilled in the art, the servers should be logically divided. In physical space, these servers can be independent of each other but can be called through interfaces, or integrated into a physical computer or a set of computer clusters. Those skilled in the art should understand this flexibility, and should not use it to restrict the implementation of the network deployment method of this application.

[0069] Unless expressly specified, one or more technical features of the present application can be deployed on a server for implementation and accessed by a client through a remote call to obtain an online service interface provided by the server, or can be directly deployed and run on a client for access.

[0070] The neural network models referenced or may be referenced in this application, unless expressly specified, can be deployed on a remote server and remotely called on the client, or can be deployed and directly called on a client with sufficient device capabilities. In some embodiments, when it runs on the client, its corresponding intelligence can be obtained through transfer learning to reduce the requirements for the client's hardware operating resources and avoid excessive occupation of the client's hardware operating resources.

[0071] Unless explicitly specified, the various data involved in this application can be stored remotely on a server or on a local terminal device, as long as it is suitable for being called by the technical solution of this application.

[0072] Those skilled in the art should be aware that, although the various methods of the present application are described based on the same concept and thus present commonality to each other, unless otherwise specified, these methods can be independently executed. Similarly, for each embodiment disclosed in the present application, they are all proposed based on the same inventive concept, therefore, concepts with the same expression, and concepts that are appropriately changed for convenience despite different expressions, should be understood as equivalent.

[0073] Unless the mutually exclusive relationship between the embodiments to be disclosed in this application is explicitly stated, the relevant technical features involved in each embodiment can be cross-combined to flexibly construct a new embodiment, as long as such combination does not deviate from the creative spirit of this application and can meet the needs of the prior art or solve certain deficiencies in the prior art. Those skilled in the art should be aware of this flexibility.

[0074] A ring signature is a special digital signature that provides anonymity protection for the signer. It allows the signer to autonomously collect the public keys of ring members to form a ring without the permission or assistance of other ring members. The signer is included in the set of ring members and signs on behalf of the ring members. The verifier can only determine that the signer is from a ring, but cannot determine which ring member it is.

[0075] Due to the anonymity of ring signatures, they are widely used in fields such as electronic voting, electronic cash, and anonymous reporting. Although anonymity is very important and should be retained in most cases, it can become a problem in some applications where dishonest users overuse anonymity to gain their own benefits. For example, in electronic voting scenarios, dishonest users use anonymity to try to vote again after completing a vote. In order to avoid such dishonest behavior, linkable ring signature technology came into being.

[0076] The identity-based cryptographic system uses the user's identity as the public key, and the user's private key is calculated by the key generation center based on the system master key and the user's identity. The user's public key is uniquely determined by the user's identity, so the user does not need a third party to guarantee the authenticity of the public key. In this way, the communicating parties can securely generate and verify signatures without going through a trusted third party.

[0077] In the post-quantum era, cryptographic schemes based on traditional number theory problems such as large integer decomposition and discrete logarithms are no longer safe. The lattice public key cryptography system has become the best candidate for the cryptographic standard in the post-quantum era due to its quantum resistance and the existence of the worst-case to ordinary case specification. However, the keys and signatures generated by the existing lattice-based digital signature technology occupy a large space and take a long time to generate, so they are not very practical. At present, no scholar has proposed a good solution to this problem, and this application makes the following exploration.

[0078] Based on the above exemplary scenarios, please refer to Figure 1 as well as Figure 2 In one embodiment, the linkable double-ring signature method based on the NTRU lattice of the present application includes:

[0079] Step S10: The server obtains a security parameter λ and the number of ring member users N, and generates a system global parameter pp, a master public key mpk, and a master private key msk based on the security parameter λ and the number of ring member users N, which includes:

[0080] Step S101: The server determines the polynomial vector length n according to the security parameter λ and the number of ring member users N, and uses the NTRU encryption algorithm to generate four polynomial vectors f, g, F, and G according to the polynomial vector length n, and uses the four polynomial vectors f, g, F, and G as the master private key msk;

[0081] Step S102: The server determines an integer q according to the security parameter λ and calculates the master public key mpk=g·f -1 mod q;

[0082] Step S103: The server determines a variance σ according to the security parameter λ and selects two hash functions H 1 , H 2 , taking the master public key mpk, the polynomial vector length n, the integer q and the variance σ as the system global parameter pp;

[0083] The linkable dual-ring signature method based on the NTRU lattice of the present application can be used in Figure 1 The invention is implemented in the linkable double-ring signature system based on the NTRU lattice shown in the figure, wherein the ring member list includes multiple ring member nodes, and the ring member user corresponds to one or more ring member nodes; the server side can be a third-party trusted center; the server side obtains the security parameter λ and the number of ring member users N, and generates the system global parameter pp, the master public key mpk and the master private key msk based on the security parameter λ and the number of ring member users N. Specifically, the server side determines the polynomial vector length n according to the security parameter λ and the number of ring member users N, and uses the NTRU encryption algorithm to generate four polynomial vectors f, g, F, G according to the polynomial vector length n, and uses the four polynomial vectors f, g, F, G as the master private key msk; the server side determines an integer q according to the security parameter λ, and calculates the master public key mpk=g·f -1 mod q; the server determines a variance σ based on the security parameter λ and selects two hash functions H 1 , H 2 , the master public key mpk, the polynomial vector length n, the integer q and the variance σ are used as the system global parameters pp.

[0084] In some embodiments, the NTRU encryption algorithm, NTRU (N-th degree Truncated PolynomialRing) is a lattice-based public key encryption algorithm, first proposed by Christoph Paillier and other researchers in 1996. The main features of the NTRU encryption algorithm are high computational efficiency and security, suitable for countering quantum computer attacks, and aiming to provide an alternative to traditional public key encryption methods (such as RSA and ECC), especially in the context of the popularization of quantum computing. With the deepening of research, NTRU has been included in a number of quantum security standardization processes.

[0085] In some embodiments, the Linkable Ring Signature is a cryptographic signature scheme that combines the privacy protection characteristics of a ring signature with the linkability requirement. A ring signature allows a user to generate a signature in a group while maintaining the privacy of their identity; while linkability means that the same signer can generate identifiable signatures at different times (or different messages), allowing a specific verifier to associate the signature to the same user.

[0086] The ring signature is a cryptographic signature technology that allows a member to sign a message without revealing his or her identity. The signer can choose a set of public keys as a "ring". In this ring, the identity of any member cannot be identified, and only users who can verify the signature can confirm the validity of the signature; the linkability, in the linkable double ring signature, although the identity of the signature is still private, when the same signer generates signatures on different messages, these signatures can be linked together in some way, so that the verifier can confirm that they are from the same signer.

[0087] Step S20: The server uses the master private key msk and the user identity id of the ring member user π to π , generate the user private key sk of the ring member user π π ;

[0088] After generating the system global parameter pp, the master public key mpk and the master private key msk based on the security parameter λ and the number of ring member users N, the server generates the system global parameter pp, the master public key mpk and the master private key msk based on the master private key msk and the user identity id of the ring member user π. π , generate the user private key sk of the ring member user π π ;

[0089] Specifically, the server uses the master private key msk and the user identity id of the ring member user π to π , generate the user private key sk of the ring member user π π The steps include:

[0090] Based on the user identity id of the ring member user π π , the grid point screening algorithm is used to calculate and determine the two polynomial vectors s 1π and 2π , output the user private key sk of the ring member user π π =(s 1π ,s 2π ).

[0091] In some embodiments, the lattice reduction algorithm is a type of algorithm used to optimize and solve lattice problems, and is widely used in cryptography, computational geometry, signal processing, etc. Their main purpose is to simplify the lattice structure so that it becomes more efficient to find a specific solution (such as an integer solution, a minimum vector, etc.) in a given lattice.

[0092] Furthermore, the grid point screening algorithms include LLL algorithm (Lenstra–Lenstra–Lovász algorithm) and BKZ algorithm (Block Korkine-Zolotarev algorithm), etc. The present application may select one of the above grid point screening algorithms.

[0093] Step S30: When the ring member user π signs a message m, the server side signs the message m based on the user identity id corresponding to the ring member user π. π Generate Signature Link TagI π , and according to the user private key sk π , the master public key mpk, the identity set ID of all users in the ring member list and the system global parameter pp generate the signature sig π ;

[0094] Generate the user private key sk of the ring member user π π Afterwards, when the ring member user π signs a message m, the server will use the user ID corresponding to the ring member user π to sign the message m. π Generate Signature Link TagI π , and according to the user private key sk π , the master public key mpk, the identity set ID of all users in the ring member list and the system global parameter pp generate the signature sig π ;

[0095] Specifically, when the ring member user π signs a message m, based on the user identity id corresponding to the ring member user π π Generate Signature Link TagI π , and according to the user private key skπ , the master public key mpk, the identity set ID of all users in the ring member list and the system global parameter pp generate the signature sig π The steps include:

[0096] Step S301: Randomly select two polynomial vectors from a normal distribution D with a variance of σ and n-1 short vectors c i ←{0,1} n , where i∈{1,2,…,N} and i≠π;

[0097] Step S302: Calculate and determine

[0098] Step S303: Call the hash function H 1 , calculate and determine the signature link label I π =H 1 (id π );

[0099] Step S304: Call the hash function H 2 , calculate and determine the challenge c = H 2 (m,ID,R);

[0100] Step S305: Calculate and determine a short vector

[0101] Step S306: Calculate and determine the first commitment z 1 =c π ·s 1π +y 1 , using the rejection sampling algorithm to The probability of the first commitment z 1 Conduct rejection sampling;

[0102] Step S307: Calculate and determine the second commitment z 2 =c π ·s 2π +y 2 , using the rejection sampling algorithm to The probability of the second commitment z 2 Perform rejection sampling, where M is a large integer;

[0103] Step S308: Output signature sig π =((c 1 ,c 2 ,…,c N ),(z 1 ,z 2 ),I π ).

[0104] In some embodiments, the rejection sampling algorithm is a random sampling method for generating samples from complex distributions, especially when we want to extract samples from a target distribution that is difficult to sample directly (such as a probability distribution). Its basic idea is to generate samples from a simple distribution and decide whether to accept these samples according to a judgment criterion to obtain samples of the target distribution.

[0105] Step S40: The server verifies the signature sig based on the message m, the identity set ID of all users in the ring member list, and the system global parameter pp. π ;

[0106] According to the user private key sk π , the master public key mpk, the identity set ID of all users in the ring member list and the system global parameter pp generate the signature sig π Afterwards, the server verifies the signature sig based on the message m, the identity set ID of all users in the ring member list, and the system global parameter pp. π ;

[0107] Specifically, based on the message m, the identity set ID of all users in the ring member list and the system global parameter pp, the signature sig is verified. π The steps include:

[0108] Step S401: Verify the first commitment 1 With the second commitment z 2 Is the Euclidean length between less than If the Euclidean length is less than Then calculate and determine

[0109] Step S402: Calculate and determine the challenge Verify that the challenge c is equal to H 2 (m,ID,R ′ ), if the output result is 1, if the challenge c is equal to the H 2 (m,ID,R ′ ), it means the signature is passed; if the output result is 0, it means the signature is not passed.

[0110] Step S50: The server obtains the first signature and the second signature of different messages, and determines that the first signature and the second signature are from the same user according to the link tag of the first signature and the link tag of the second signature, so as to complete the linkable dual-ring signature based on the NTRU lattice.

[0111] The server verifies the signature sig based on the message m, the identity set ID of all users in the ring member list, and the system global parameter pp. π Afterwards, the server obtains the first signature and the second signature of different messages, and determines that the first signature and the second signature are from the same user according to the link tag of the first signature and the link tag of the second signature, so as to complete the linkable dual-ring signature based on the NTRU lattice.

[0112] Specifically, the step of obtaining the first signature and the second signature of different messages, and determining that the first signature and the second signature are from the same user according to the link tag of the first signature and the link tag of the second signature includes:

[0113] Step S501: Obtain the first signature sig of different messages 1 With the second signature sig 2 , from the first signature sig 1 And the second signature sig 2 The first signature sig 1 Signature Link Tag I 1 And the second signature sig 2 Signature Link Tag I 2 ;

[0114] Step S502: Determine the first signature sig 1 Signature Link Tag I 1 With the second signature sig 2 Signature Link Tag I 2 Are they equal? ​​If the signature link tag I 1 Link tag I with the signature 2 If they are equal, the output result is 1, indicating that the first signature sig 1 With the second signature sig 2 From the same user.

[0115] It can be seen from the above embodiments that, compared with the prior art, the user key and signature generated by the linkable ring signature technology in the prior art in this application occupy a large amount of storage space, generate signatures slowly, and incur a large amount of storage and time overhead on the server, resulting in low practicality. The present application includes but is not limited to the following beneficial effects:

[0116] First, users often consider economic factors when building a ring signature system. In order to reduce costs, they usually use as few servers as possible for computing and storage. This application combines an identity-based digital signature system to achieve the goal of quickly and securely generating and verifying signatures without exchanging public key certificates and saving key directories.

[0117] Secondly, to address the problem that the signature of the lattice-based digital signature system is too large and too slow to generate, this application intends to use a dual-ring digital signature technology to provide users with a more practical lattice-based linkable ring signature technology;

[0118] Third, in order to solve the problem that the user private key of the lattice-based linkable ring signature system is too large and the generation is too slow, this application proposes an identity-based linkable dual-ring signature scheme on the NTRU lattice. This scheme uses polynomial vectors instead of matrices as user private keys, which can greatly reduce their size, and can be combined with dual-ring digital signature technology to have better performance;

[0119] Fourth, this application uses identity-based digital signature technology. The signer does not need to exchange public key certificates or save key directories. It can quickly and securely generate and verify signatures, reducing server overhead. The use of dual-ring digital signature technology and NTRU format solves problems such as slow key and signature generation speed and large signature length, effectively reduces bandwidth resource consumption, and makes the solution easy to deploy, manage and implement;

[0120] Fifth, this application implements a new identity-based linkable dual-ring signature scheme on the NTRU lattice. When ring users generate signatures, they do not need to exchange public key certificates or save key directories. The NTRU lattice and dual-ring structure are used, so that the invention can quickly and securely generate and verify signatures. It satisfies the unconditional anonymity, unforgeability and linkability under the random oracle model, so that the invention can achieve the security of resisting the key forgery attack, signature forgery attack and double signature attack of the adversary. Compared with the use of traditional lattices, the use of polynomial vectors as keys and signatures can reduce the storage overhead and time overhead of the server during calculation, thereby improving practicality.

[0121] See also Figure 3, a linkable double ring signature device based on NTRU lattice is provided to meet one of the purposes of the present application, including a system parameter generation module 1100, a user private key generation module 1200, a message signature generation module 1300, a message signature verification module 1400 and a linkable double ring signature module 1500. Among them, the system parameter generation module 1100 is configured to obtain a security parameter λ and the number of ring member users N at the server end, and generate a system global parameter pp, a master public key mpk and a master private key msk based on the security parameter λ and the number of ring member users N, which includes: the server end determines the polynomial vector length n according to the security parameter λ, and uses the NTRU encryption algorithm to generate four polynomial vectors f, g, F, G according to the polynomial vector length n, and uses the four polynomial vectors f, g, F, G as the master private key msk; the server end determines an integer q according to the security parameter λ, and calculates the master public key mpk=g·f -1 mod q; the server determines a variance σ based on the security parameter λ and selects two hash functions H 1 , H 2 , the master public key mpk, the polynomial vector length n, the integer q and the variance σ are used as the system global parameters pp; the user private key generation module 1200 is set to the server side based on the master private key msk and the user identity id of the ring member user π π , generate the user private key sk of the ring member user π π ; Message signature generation module 1300, set to the server side when the ring member user π signs a message m, based on the ring member user π corresponding to the user identity id π Generate Signature Link TagI π , and according to the user private key sk π , the master public key mpk, the identity set ID of all users in the ring member list and the system global parameter pp generate the signature sig π ; Message signature verification module 1400, the server verifies the signature sig based on the message m, the identity set ID of all users in the ring member list and the system global parameter pp π The linkable dual-ring signature module 1500 is configured to obtain the first signature and the second signature of different messages on the server side, and determine that the first signature and the second signature are from the same user according to the link tag of the first signature and the link tag of the second signature, so as to complete the linkable dual-ring signature based on the NTRU grid.

[0122] Based on any embodiment of this application, please refer to Figure 4 Another embodiment of the present application further provides an electronic device, which can be implemented by a computer device, such as Figure 4As shown, a schematic diagram of the internal structure of a computer device. The computer device includes a processor, a computer-readable storage medium, a memory, and a network interface connected via a system bus. Among them, the computer-readable storage medium of the computer device stores an operating system, a database, and computer-readable instructions. The database may store a control information sequence. When the computer-readable instructions are executed by the processor, the processor can implement a linkable dual-ring signature method based on the NTRU grid. The processor of the computer device is used to provide computing and control capabilities to support the operation of the entire computer device. The memory of the computer device may store computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor can execute the linkable dual-ring signature method based on the NTRU grid of the present application. The network interface of the computer device is used to connect and communicate with a terminal. Those skilled in the art can understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0123] In this embodiment, the processor is used to execute Figure 3 The memory stores the program code and various data required to execute the above modules or submodules. The network interface is used to transmit data between user terminals or servers. The memory in this embodiment stores the program code and data required to execute all modules / submodules in the linkable double-ring signature device based on the NTRU grid of this application, and the server can call the program code and data of the server to execute the functions of all submodules.

[0124] The present application also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the linkable dual-ring signature method based on the NTRU grid described in any embodiment of the present application.

[0125] The present application also provides a computer program product, including a computer program / instruction, which, when executed by one or more processors, implements the steps of the linkable dual-ring signature method based on the NTRU grid described in any embodiment of the present application.

[0126] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments of the present application can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a computer-readable storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0127] The above description is only a partial implementation method of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A linkable double-ring signature method based on NTRU lattice, characterized in that: Applies to any ring member user π in the ring member list, including: The server obtains the security parameter λ and the number of ring member users N, and generates the system global parameter pp, the master public key mpk and the master private key msk based on the security parameter λ and the number of ring member users N, which includes: The server determines the polynomial vector length n according to the security parameter λ and the number of ring member users N, and uses the NTRU encryption algorithm to generate four polynomial vectors f, g, F, and G according to the polynomial vector length n, and uses the four polynomial vectors f, g, F, and G as the master private key msk; The server determines an integer q based on the security parameter λ and calculates the master public key mpk=g·f -1 mod q; The server determines a variance σ according to the security parameter λ, selects two hash functions H1 and H2, and uses the master public key mpk, the polynomial vector length n, the integer q and the variance σ as the system global parameter pp; The server is based on the master private key msk and the user identity id of the ring member user π π , generate the user private key sk of the ring member user π π ; When the ring member user π signs a message m, the server side uses the user identity id corresponding to the ring member user π to sign the message m. π Generate Signature Link TagI π , and according to the user private key sk π , the master public key mpk, the identity set ID of all users in the ring member list and the system global parameter pp generate the signature sig π ; The server verifies the signature sig based on the message m, the identity set ID of all users in the ring member list, and the system global parameter pp. π ; The server obtains the first signature and the second signature of different messages, and determines that the first signature and the second signature are from the same user according to the link tag of the first signature and the link tag of the second signature, so as to complete the linkable dual-ring signature based on the NTRU lattice.

2. The linkable double-ring signature method based on NTRU lattice according to claim 1, characterized in that: The server is based on the master private key msk and the user identity id of the ring member user π π , generate the user private key sk of the ring member user π π The steps include: Based on the user identity id of the ring member user π π , the grid point screening algorithm is used to calculate and determine the two polynomial vectors s 1π and 2π , output the user private key sk of the ring member user π π =(s 1π ,s 2π ).

3. The linkable double-ring signature method based on NTRU lattice according to claim 1, characterized in that: When the ring member user π signs a message m, based on the user identity id corresponding to the ring member user π π Generate Signature Link TagI π , and according to the user private key sk π , the master public key mpk, the identity set ID of all users in the ring member list and the system global parameter pp generate the signature sig π The steps include: Randomly select two polynomial vectors of length n from a normal distribution D with variance σ and n-1 short vectors c i ←{0,1} n , where i∈{1,2,…,N} and i≠π; Calculation Call the hash function H1 to calculate and determine the signature link tag I π =H1(id π ); Call the hash function H2 and calculate the challenge c = H2 (m, ID, R); Calculate a short vector Calculate and determine the first commitment z1=c π ·s 1π +y1, using the rejection sampling algorithm to The probability of rejecting the first commitment z1 is , where M is a large integer; Calculate and determine the second commitment z2 = c π ·s 2π +y2, using the rejection sampling algorithm The probability of rejecting the second commitment z2 is , where M is a large integer; Output signature sig π =((c1,c2,…,c N ),(z1,z2),I π ).

4. The linkable double-ring signature method based on NTRU lattice according to claim 3, characterized in that: Verify the signature sig based on the message m, the identity set ID of all users in the ring member list, and the system global parameter pp π The steps include: Verify that the Euclidean length between the first commitment z1 and the second commitment z2 is less than If the Euclidean length is less than Then calculate and determine Computational determination challenges Verify that the challenge c is equal to H2(m,ID,R ′ ), if the output result is 1, if the challenge c is equal to H2(m,ID,R ′ ), it means the signature is passed.

5. The linkable double-ring signature method based on NTRU lattice according to claim 1, characterized in that: The step of obtaining a first signature and a second signature of different messages, and determining that the first signature and the second signature are from the same user according to a link tag of the first signature and a link tag of the second signature, comprises: Obtain a first signature sig1 and a second signature sig2 of different messages, and from the first signature sig1 and the second signature sig2, obtain a signature link tag I1 of the first signature sig1 and a signature link tag I2 of the second signature sig2; It is determined whether the signature link tag I1 of the first signature sig1 is equal to the signature link tag I2 of the second signature sig2. If the signature link tag I1 is equal to the signature link tag I2, the output result is 1, indicating that the first signature sig1 and the second signature sig2 are from the same user.

6. The linkable double-ring signature method based on NTRU lattice according to claim 1, characterized in that: The ring member list includes multiple ring member nodes, and the ring member user corresponds to one or more ring member nodes.

7. The linkable double-ring signature method based on NTRU lattice according to claim 1, characterized in that: The server end is a third-party trusted center end.

8. A linkable double-ring signature device based on NTRU lattice, characterized in that: include: The system parameter generation module is configured to obtain the security parameter λ and the number of ring member users N from the server side, and generate the system global parameter pp, the master public key mpk and the master private key msk based on the security parameter λ and the number of ring member users N, which includes: The server determines the polynomial vector length n according to the security parameter λ, and uses the NTRU encryption algorithm to generate four polynomial vectors f, g, F, and G according to the polynomial vector length n, and uses the four polynomial vectors f, g, F, and G as the master private key msk; The server determines an integer q based on the security parameter λ and calculates the master public key mpk=g·f -1 mod q; The server determines a variance σ according to the security parameter λ, selects two hash functions H1 and H2, and uses the master public key mpk, the polynomial vector length n, the integer q and the variance σ as the system global parameter pp; The user private key generation module is set to the server based on the master private key msk and the user identity id of the ring member user π π , generate the user private key sk of the ring member user π π ; The message signature generation module is configured to generate a signature based on the user identity ID corresponding to the ring member user π when the server side signs a message m. π Generate Signature Link TagI π , and according to the user private key sk π , the master public key mpk, the identity set ID of all users in the ring member list and the system global parameter pp generate the signature sig π ; The message signature verification module verifies the signature sig based on the message m, the identity set ID of all users in the ring member list, and the system global parameter pp. π ; The linkable double-ring signature module is configured to obtain the first signature and the second signature of different messages on the server side, and determine that the first signature and the second signature are from the same user according to the link tag of the first signature and the link tag of the second signature, so as to complete the linkable double-ring signature based on the NTRU grid.

9. An electronic device, comprising a central processing unit and a memory, characterized in that: The central processing unit is used to call and run the computer program stored in the memory to execute the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: It stores a computer program implemented according to the method described in any one of claims 1 to 7 in the form of computer-readable instructions, and when the computer program is called and executed by a computer, the steps included in the corresponding method are executed.

Images