Method and device for generating declarable multi-specified verifier signatures, equipment and storage medium

Abstract

The invention discloses a declarable multi-specified verifier signature generation method and device, equipment and a storage medium, and relates to the technical field of information security, and the method comprises the steps: constructing a standard signature scheme and a commitment scheme; generating a standard signature according to the standard signature scheme and a preset multi-specified verifier signature; and promising the standard signature according to the promise scheme to obtain a declarable multi-specified verifier signature. According to the method, the standard signature scheme and the commitment scheme are combined, so that the declarability of the signature is realized, the ownership problem existing in the signature of multiple specified verifiers is solved, and the security and unforgeability of the signature are ensured.

Description

Technical Field

[0001] The present application relates to the technical field of information security, and in particular to a method, apparatus, device and storage medium for generating declarable multi-designated verifier signatures. Background Art

[0002] In cryptography, group signature schemes such as ring signatures and group signatures allow the signer to create a signature on behalf of a group of users, while the verifier cannot determine the specific identity of the signer. Such schemes have been widely used in scenarios such as e-commerce systems and electronic voting. Among them, ring signatures do not rely on authoritative agencies, ensuring the anonymity of the signature, but the signer cannot claim ownership of his signature afterwards. To solve this problem, existing methods have proposed a group signature scheme with designated verifier signatures, which allows the signer to designate a verifier and create a signature. Only the verifier can verify the signature, allowing the signer to prove his ownership and anonymity of the signature. However, this anonymity also brings about ownership issues, especially when the signer wants to make his signature public.

[0003] Therefore, how to declare signature ownership while maintaining anonymity is a problem that needs to be solved urgently. Summary of the invention

[0004] The main purpose of this application is to provide a method, device, equipment and storage medium for generating a declarable multi-designated verifier signature, aiming to solve the technical problem of how to declare signature ownership while maintaining anonymity.

[0005] To achieve the above objectives, the present application proposes a method for generating a declarable multi-designated verifier signature, the method comprising: Construct standard signature and commitment schemes; Generate a standard signature according to the standard signature scheme and the preset multiple designated verifier signatures; The standard signature is committed according to the commitment scheme to obtain a declarable multi-designated verifier signature.

[0006] In one embodiment, the steps of constructing a standard signature scheme include: Construct a strategy combination according to a preset multi-designated verifier signature strategy, wherein the strategy combination includes an initialization strategy, a key generation strategy, a signature strategy, and a verification strategy; Constructing an oracle, the oracle comprising a signer key generation oracle, a verifier key generation oracle, a signer public key generation oracle, a verifier public key generation oracle, a signature oracle, and a verification oracle; A standard signature scheme is obtained according to the strategy combination and the oracle.

[0007] In one embodiment, the steps of constructing a commitment scheme include: Construct initialization strategy, commitment strategy, and decryption strategy; A commitment scheme is generated according to the initialization strategy, the commitment strategy, and the decryption strategy.

[0008] In one embodiment, the step of generating a standard signature according to the standard signature scheme and the preset multiple designated verifier signatures includes: Acquire public parameters and messages according to the standard signature scheme and the preset multiple designated verifier signatures; Generate a signer key pair and a verifier key pair according to the public parameters; A standard signature is obtained according to the public parameters, the signer key pair, the verifier key pair and the message.

[0009] In one embodiment, the step of committing the standard signature according to the commitment scheme to obtain a declarable multi-designated verifier signature includes: Constructing a pseudo-random function, and generating random numbers according to the pseudo-random function; The standard signature is committed according to the commitment scheme and the random number to obtain a declarable multi-designated verifier signature.

[0010] In one embodiment, after the step of committing the standard signature according to the commitment scheme to obtain the declarable multiple designated verifier signatures, the method further includes: Verifying the correctness of the commitment in the declarable multi-designated verifier signature according to the commitment scheme; When the correctness verification of the commitment scheme passes, the standard signature in the declarable multi-designated verifier signature is verified according to the standard signature scheme.

[0011] In one embodiment, the step of verifying the correctness of the commitment in the declarable multi-designated verifier signature according to the commitment scheme comprises: Obtaining a statement, wherein the statement includes a commitment result, a standard signature, and a random number; According to the decryption strategy of the commitment scheme, the commitment result is matched and verified with the standard signature and the random number to obtain a verification status; When the verification status is that the commitment result matches the standard signature and the random number, it is confirmed that the commitment is correct.

[0012] In addition, to achieve the above purpose, the present application also proposes a declarable multi-designated verifier signature generation device, the device comprising: Scheme building blocks for building standard signature and commitment schemes; A signature generation module, used to generate a standard signature according to the standard signature scheme and preset multiple designated verifier signatures; The signature commitment module is used to commit the standard signature according to the commitment scheme to obtain declarable multi-designated verifier signatures.

[0013] In addition, to achieve the above-mentioned purpose, the present application also proposes a device for generating a declarable multi-designated verifier signature, the device comprising: a memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program being configured to implement the steps of the method for generating a declarable multi-designated verifier signature as described above.

[0014] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the method for generating a declarable multi-designated verifier signature as described above are implemented.

[0015] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the method for generating a declarable multi-designated verifier signature as described above.

[0016] The present application provides a method for generating a declarable multi-designated verifier signature, and the method of the present application includes: constructing a standard signature scheme and a commitment scheme; generating a standard signature according to the standard signature scheme and a preset multi-designated verifier signature; committing to the standard signature according to the commitment scheme to obtain a declarable multi-designated verifier signature. In summary, the present application realizes the declarability of the signature by combining the standard signature scheme and the commitment scheme, solves the ownership problem existing in the multi-designated verifier signature, and ensures the security and unforgeability of the signature. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0019] Figure 1 A flowchart diagram of a first embodiment of a method for generating multiple designated verifier signatures that can be declared by the present application; Figure 2 A flowchart diagram of a second embodiment of a method for generating multiple designated verifier signatures that can be declared by the present application; Figure 3 A flowchart diagram of a third embodiment of a method for generating multiple designated verifier signatures that can be declared in this application; Figure 4 A schematic diagram of the module structure of a device for generating multiple designated verifier signatures that can be declared in an embodiment of the present application; Figure 5 A schematic diagram of the device structure of the hardware operating environment involved in the method for generating multiple designated verifier signatures that can be declared in an embodiment of the present application.

[0020] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0021] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0022] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0023] The main solution of the embodiment of the present application is: construct a standard signature scheme and a commitment scheme; generate a standard signature according to the standard signature scheme and a preset multi-designated verifier signature; commit to the standard signature according to the commitment scheme to obtain a declarable multi-designated verifier signature.

[0024] In cryptography, group signature schemes such as ring signatures and group signatures allow the signer to create a signature on behalf of a group of users, while the verifier cannot determine the specific identity of the signer. Such schemes have been widely used in scenarios such as e-commerce systems and electronic voting. Among them, ring signatures do not rely on authoritative agencies, ensuring the anonymity of the signature, but the signer cannot claim ownership of his signature afterwards. To solve this problem, existing methods have proposed a group signature scheme for designated verifier signatures, which allows the signer to designate a verifier and create a signature. Only the verifier can verify the signature, allowing the signer to prove his ownership and anonymity of the signature. However, this anonymity also brings about ownership issues, especially when the signer wants to make his signature public. Therefore, how to declare the ownership of the signature while maintaining anonymity is a problem that needs to be solved urgently.

[0025] This application achieves the declarability of signatures by combining the standard signature scheme and the commitment scheme, solves the ownership problem existing in the signatures of multiple designated verifiers, and ensures the security and unforgeability of the signatures.

[0026] It should be noted that the execution subject of this embodiment can be a system for generating multiple designated verifier signatures that can be declared, or a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device that can realize the generation function of the above-mentioned multiple designated verifier signatures that can be declared, etc. This embodiment does not specifically limit this. The following takes the generation system of multiple designated verifier signatures that can be declared as an example to illustrate this embodiment and the following embodiments.

[0027] Based on this, the embodiment of the present application provides a method for generating a declarable multi-designated verifier signature, referring to Figure 1 , Figure 1 This is a flowchart of a first embodiment of a method for generating signatures of multiple designated verifiers that can be declared in this application.

[0028] In this embodiment, the method for generating the declarable multi-designated verifier signature includes steps S10 to S30: Step S10: Construct a standard signature scheme and a commitment scheme.

[0029] It should be noted that in this step, the system will first build a standard signature scheme and commitment scheme. The standard signature scheme is used to sign a message and verify the validity of the signature to ensure the integrity and authenticity of the message. The commitment scheme is a technical means to ensure that information is not leaked before it is published. It allows the promiser to keep the information confidential after the commitment is generated and not reveal the information until the commitment is opened. Specifically, for the standard signature scheme, the system will select a secure signature strategy combination, such as RSA, DSA or ECDSA, and set the corresponding security parameters to generate the public parameters pp of the signature scheme, the public key and private key of the signer. For the commitment scheme, the system will select a secure commitment strategy combination, such as a hash function-based commitment scheme or a cryptography-based commitment scheme. Similarly, set security parameters to generate the public parameters of the commitment scheme, the commitment key and other parameters required for the commitment strategy combination. In addition, it should be noted that the standard signature scheme in this step includes the multi-designated verifier signature scheme and the standard signature scheme.

[0030] In a feasible implementation, the step of constructing a standard signature scheme includes steps A10 to A30: Step A10: Construct a policy combination according to a preset multi-designated verifier signature policy, wherein the policy combination includes an initialization policy, a key generation policy, a signature policy, and a verification policy.

[0031] It should be noted that the initialization strategy is , responsible for receiving security parameters As input, it outputs public parameters pp. These public parameters will be used in the subsequent key generation, signing and verification processes. The key generation strategy is , responsible for generating the signer's key pair based on the public parameter pp ,in is the public key, These key pairs are the key to ensure the security of signatures and the validity of verification. The signature strategy is , responsible for the public parameters pp, private key and the message to be signed as input to generate a signature This signature will be used in the subsequent verification process. The verification strategy is , responsible for pp, public key Message m and signature As input, it outputs a verification result. If the signature is valid, the verification result is true (i.e. 1), otherwise it is false (i.e. 0).

[0032] Step A20: Construct an oracle, which includes a signer key generation oracle, a verifier key generation oracle, a signer public key generation oracle, a verifier public key generation oracle, a signature oracle and a verification oracle.

[0033] It should be noted that in order to meet the correctness, consistency, existence and non-forgeability of the solution and the absence of record attributes in the specified set, the system will pre-build an oracle. The oracle is a tool that simulates the policy execution process. It can receive input and return output to test and analyze the correctness and security of the policy. In this step, the system will build the following oracles: Signer key generation oracle :The oracle is used to generate the signer's public and private key pair, i.e. , and provide these key pairs when needed. It can help test the security and correctness of the signature generation process. :This oracle is used to generate the public and private key pairs of the verifier and provide these key pairs when needed. It helps to test the security and reliability of the verification process. Signer Public Key Generation Oracle :This oracle obtains the signer's public key by calling the signer key generation oracle and provides the public key when needed. It simplifies the public key acquisition step in the signature verification process. Verifier public key generation oracle :This oracle gets the public key of the verifier by calling the verifier key generation oracle and provides the public key when required. It helps the verifier to verify the validity of the signature. Signature Oracle :The oracle obtains the signer's key pair by calling the signer key generation oracle , and for the validator set S, call the public key generation oracle to obtain the public key of each validator , generate a signature , and output the signature. It can help test the correctness and efficiency of the signature generation strategy. Verification Oracle :The oracle obtains the signer's public key by calling the signer's public key generation oracle , and call the validator key generation oracle to obtain the validator's key pair At the same time, for the validator set S, call the validator public key generation oracle to obtain the public key of each validator, and finally use Verify the signature and output the verification result b.

[0034] Step A30: Obtain a standard signature scheme based on the policy combination and the oracle.

[0035] It should be noted that in this step, the system will combine each strategy in the strategy combination with the oracle to obtain a complete standard signature scheme. The scheme includes four parts: initialization strategy, key generation strategy, signature strategy and verification strategy, which correspond to the initialization strategy, key generation strategy, signature strategy and verification strategy in the strategy combination. At the same time, the oracle provides a simulation and testing environment for these strategies to ensure the correctness and security of the strategies. It can be understood that this step obtains a standard signature scheme with correctness, consistency, existence unforgeability, specified set confidentiality and arbitrary subset confidentiality by constructing a strategy combination and an oracle.

[0036] In addition, it should be noted that the correctness in this step means that for any signer , any message , any validator set S, , which all satisfy Formula 1:

[0037] (Formula 1) Among them, consistency means that the signatures of multiple designated verifiers are consistent, that is, it can be proven that the attacker , satisfying the following formula 2:

[0038] (Formula 2) Assume existence , so that , then all keys (whether the signer's public key or the verifier's public key / private key) are generated through an honest key generation process. And the verifier's public key It is not queried during the key generation process, especially for and , the attacker has not requested their public key .

[0039] Among them, the existence of unforgeability means that the signatures of multiple designated verifiers are unforgeable, that is, for any polynomial time provable attacker A, the following formula 3 is satisfied:

[0040] (Formula 3) in Not in The query found that Not in Assuming that there is Make , then the signature is in the verifier Passed verification, and the attacker has not obtained If the public key is found, it returns 1, indicating that the attack is successful. Otherwise, it returns 0, indicating that the attack fails.

[0041] Among them, the confidentiality of the specified set means that the signatures of multiple specified verifiers are not recorded in the specified set. Assume that there is a polynomial time provable strategy FgeDS, which is based on As input, and output a signature , satisfying the following formula 4:

[0042] (Formula 4) Where Q represents The query response collection, all queries arrive Should satisfy i is not in Query on, and all queries arrive Should satisfy ,if Then it returns 1, indicating success, otherwise it returns 0, indicating failure.

[0043] Among them, confidentiality for any subset means that there is no record for any subset. Assume that there is a polynomial time provable strategy FgeAS, which is based on (in ) as input and output a signature , satisfying the following formula 5:

[0044] (Formula 5) in Q express The query response collection, all queries arrive Should satisfy i not Query on, and all queries arrive Should satisfy ,if Then it returns 1, indicating success, otherwise it returns 0, indicating failure.

[0045] In a feasible implementation manner, the step of constructing a commitment scheme includes steps B10 to B20: Step B10: Construct initialization strategy, commitment strategy and decryption strategy.

[0046] It should be noted that the commitment strategy is a message space M, which consists of three polynomial time strategies Specifically: Setup( ) → pp, the initialization strategy, used to receive security parameters As input, it outputs a public parameter pp.

[0047] , i.e. commitment strategy, used to receive public parameters pp and messages , while receiving an internal random input , outputs a promise .

[0048] , i.e. decryption strategy, used to receive public parameters pp, commitment com, and decryption information And the news , output a bit value b∈{0,1}, indicating whether m is consistent with the commitment Matches, where 0 is false and 1 is true.

[0049] Step B20: Generate a commitment scheme according to the initialization strategy, the commitment strategy and the decryption strategy.

[0050] It should be noted that in this step, the system integrates the above three strategies to form a complete commitment scheme. This commitment scheme will be able to receive a message to be committed and an internal random input to generate a commitment; and can verify whether a given message matches the commitment when necessary.

[0051] In addition, it should be noted that the commitment scheme has the following characteristics: Correctness means that for all and , should satisfy Formula 6:

[0052] (Formula 6) Understandably, this means that a correctly generated commitment matches the decryption.

[0053] Binding means that for any polynomial-time strategy adversary A, it should be impossible to find two different messages Satisfy the same promise, as shown in Formula 7:

[0054] (Formula 7) Understandably, this means that the commitment scheme is binding, i.e. the same commitment cannot be generated by different messages.

[0055] Hiddenness means that it is resistant to any polynomial-time strategy adversary. , should satisfy formula 8:

[0056] (Formula 8) Understandably, this means that the adversary cannot effectively distinguish the commitment message and , that is, the commitment scheme is hidden. If is unrestricted and is fixed to 0, then the commitment scheme is called fully hidden.

[0057] Step S20: Generate a standard signature according to the standard signature scheme and preset multiple designated verifier signatures.

[0058] It should be noted that the preset multiple designated verifier signature is the preset MDVS (Multiple Designated Verifiers Signatures) scheme. MDVS is a policy group about message M, as shown in Formula 9:

[0059] (Formula 9) in, The function is to obtain security parameters After that, set the strategy output public parameter pp; The function is to obtain the pp, the signature key generation strategy outputs a signer's public key and a private key . The function is to verify the key generation strategy and output a public key of the verifier after obtaining pp. and a private key . The function is to obtain the private key of pp and signer , specify the public key of the verifier And the news Then, output the signature . The function is to obtain pp , the signer's public key , Validator Private key , specify the public key of the verifier ,information and signature After that, a bit b is output, where b = 1 means acceptance and b = 0 means rejection.

[0060] In addition, it should be noted that in this step, the system will use the built standard signature scheme and the preset MDVS scheme to sign the message. Specifically, the system will obtain the message m, the signer's private key, the designated verifier's public key set and the public parameter pp of the MDVS scheme according to the signature strategy in the MDVS scheme, and generate the MDVS signature Then, the MDVS is signed using the signature strategy combination of the standard signature scheme and the preset random function. Sign again to generate a standard signature .

[0061] Step S30: Commit the standard signature according to the commitment scheme to obtain a declarable multi-designated verifier signature.

[0062] It should be noted that in this step, the system will commit to the generated standard signature according to the constructed commitment scheme and obtain CMDVS (claimable multi-designated verifier signature). Specifically, in this step, the system will obtain the standard signature according to the commitment strategy of the commitment scheme. , commitment key k and other parameters required by the commitment policy to generate the commitment com. Then, the MDVS signature , promise com to combine and obtain CMDVS signature, i.e. combined signature .

[0063] In a feasible implementation manner, the step S30 specifically includes steps S301-S302: Step S301: construct a pseudo-random function, and generate a random number according to the pseudo-random function.

[0064] It should be noted that in this step, the system will construct a pseudo-random function (PRF). PRF is a polynomial time strategy that receives a key and an input string and outputs a fixed-length string. The system will then use the key generation strategy (KG) of PRF to generate a key k. This key k will be used for subsequent PRF calculations. Then for a given message m and a signer key (including MDVS signature key and standard signature key), the system will select an input string x (which can be a hash value of message m or other signature-related value) and use the calculation strategy (F) of PRF and key k to calculate the random number r = F(k, x).

[0065] It is understood that the pseudo-random function (PRF) is an important cryptographic tool that provides a pseudo-random output under a given key and input. This pseudo-randomness makes it difficult for attackers to predict or infer the output of the PRF, thereby ensuring the security of the signature scheme.

[0066] Step S302: Commit the standard signature according to the commitment scheme and the random number to obtain a declarable multi-designated verifier signature.

[0067] It should be noted that in this step, the system will use the commitment strategy (Com) of the commitment scheme to commit to the standard signature after obtaining the random number r. The commitment strategy receives the public parameter pp, the message m, and an internal random input (i.e., the random number r), and outputs a commitment com. Specifically, the system will input the message to the commitment strategy and use the random number r as the internal random input. The commitment strategy will return a commitment com, which is a binding representation of the standard signature and the random number r.

[0068] It is understood that a commitment scheme is an important cryptographic construction that allows the signer to provide verifiable proof of the authenticity of a message while protecting the content of the message. In CMDVS, the commitment scheme ensures the declarability of the signature while maintaining the anonymity of the signature.

[0069] This embodiment provides a method for generating a declarable multi-designated verifier signature. The method of this embodiment includes: constructing a standard signature scheme and a commitment scheme; generating a standard signature according to the standard signature scheme and a preset multi-designated verifier signature; committing to the standard signature according to the commitment scheme to obtain a declarable multi-designated verifier signature. In summary, this embodiment realizes the declarability of the signature by combining the standard signature scheme and the commitment scheme, solves the ownership problem existing in the multi-designated verifier signature, and ensures the security and unforgeability of the signature.

[0070] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can refer to the above introduction, and will not be repeated later. Figure 2 , Figure 2 This is a flow chart of a second embodiment of a method for generating multiple designated verifier signatures that can be declared in this application, wherein step S20 specifically includes steps S201 to S203: Step S201: Obtain public parameters and messages according to the standard signature scheme and the preset multiple designated verifier signatures.

[0071] It should be noted that in this step, message m refers to the message to be signed. Specifically, in this step, the system will use the initialization strategy of the standard signature scheme , according to the safety parameters Get the public parameter pp of the signature scheme. The public parameter pp includes the MDVS initialization strategy , from the signature scheme initialization strategy , from the commitment scheme initialization strategy .

[0072] Step S202: Generate a signer key pair and a verifier key pair according to the public parameters.

[0073] It should be noted that in this step, the signer key pair includes the signature key pair of the standard signature scheme and the MDVS signature key pair. Specifically, in this step, the system will generate a signature key pair according to the key generation strategy of the standard signature scheme. , generate the MDVS signature key pair according to the signature key generation strategy of the MDVS scheme Then, the verification key generation strategy of the MDVS scheme is used to generate the corresponding public key for each verifier. .

[0074] It can be understood that the key pair generation process in this step ensures the security and anonymity of the signature. The signer uses the private key to sign, and the verifier uses the public key to verify. At the same time, the characteristics of the MDVS scheme allow the signer to sign anonymously for multiple verifiers.

[0075] Step S203: Obtain a standard signature according to the public parameters, the signer key pair, the verifier key pair and the message.

[0076] It should be noted that in this step, the system will use the signer's private key according to the MDVS scheme , specify the public key set of the verifier (where j represents different verifiers) and message m, generate MDVS signature , as shown in Formula 10:

[0077] (Formula 10) The system then uses a pseudo-random function (PRF) to input the MDVS signature And a random number to generate an input value for a standard signature Finally, the signature strategy of the standard signature scheme is used, based on the public parameters , the signer's private key for standard signatures and input value , get the standard signature , as shown in Formula 11:

[0078] (Formula 11) It is understandable that in this step, the standard signature plays a role of proof, that is, it proves that the signer has indeed generated the MDVS signature. This standard signature can be used to declare the ownership of the signature when needed later. At the same time, due to the anonymity of the MDVS signature, even if the signature is made public, it is impossible to directly determine which signer generated it.

[0079] In this embodiment, by combining the standard signature scheme with the multi-designated verifier signature scheme, a signer key pair and a verifier key pair are generated, and a standard signature is obtained based on this, which provides the necessary basis for subsequent signature generation, commitment and declaration, and ensures the security and declarability of the CMDVS scheme.

[0080] Based on the first and second embodiments of the present application, in the third embodiment of the present application, the same or similar contents as those in the first and second embodiments can be referred to the above description, and will not be described in detail later. Figure 3 , Figure 3 This is a flow chart of a third embodiment of a method for generating multiple designated verifier signatures that can be declared in this application. After step S30, steps S40 to S50 are also included: Step S40: verifying the correctness of the commitment in the declarable multi-designated verifier signature according to the commitment scheme.

[0081] It should be noted that in this step, the system will extract the commitment in the CMDVS. According to the decryption strategy in the commitment scheme, combined with the public parameters, the commitment, and the decryption information provided by the signer (such as the PRF output value and standard signature used to generate the commitment, etc.), the system attempts to open the commitment. If the commitment can be opened correctly, that is, the message output by the decryption strategy matches the standard signature, the system considers the commitment to be correct. Otherwise, the system considers the commitment to be wrong and refuses to accept the CMDVS.

[0082] It is understandable that the role of this step is that it ensures that the commitment in CMDVS is valid, thereby ensuring that the signer can provide sufficient evidence to support his claim when declaring the signature. If the commitment cannot be opened correctly, the signer's statement will be considered invalid.

[0083] Step S50: When the correctness verification of the commitment scheme passes, verify the standard signature in the declarable multi-designated verifier signature according to the standard signature scheme.

[0084] It should be noted that in this step, the system also needs to verify the standard signature in the CMDVS. Specifically, the system will extract the standard signature part in the CMDVS, use the verification strategy in the standard signature scheme, and perform signature verification in combination with the public parameters, the signer's public key, the message, and the standard signature itself. If the verification strategy outputs a bit value indicating successful verification (such as 1), the system considers the standard signature to be valid. Otherwise, the system considers the standard signature to be invalid and refuses to accept the CMDVS.

[0085] It is understandable that the role of this step is that it ensures that the standard signature in CMDVS is generated by the signer using his private key, thereby further enhancing the security and credibility of the signature. If the standard signature verification fails, then even if the commitment is correct, the signer's statement will be considered invalid.

[0086] In a feasible implementation manner, the step S40 specifically includes steps S401 to S403: Step S401: Obtain a statement, which includes a commitment result, a standard signature, and a random number.

[0087] It should be noted that in this step, when the signer wants to declare his ownership of a signature, he first needs to provide a statement to the system. This statement contains three key elements: commitment result, standard signature and random number. The commitment result is the output obtained by the signer through the encryption of the standard signature and random number through the commitment scheme when generating the signature. The standard signature is the result obtained by the signer using his private key to sign the message. The random number is used to enhance the security and unpredictability of the signature.

[0088] Step S402: Verify the match between the commitment result, the standard signature and the random number according to the decryption strategy of the commitment scheme to obtain a verification status.

[0089] It should be noted that in this step, after receiving the signer's statement, the system will decrypt the commitment result according to the decryption strategy of the commitment scheme. During the decryption process, the system needs to use the decryption strategy in the commitment scheme and the random number provided by the signer to restore the standard signature. Then, the system will compare the restored standard signature with the standard signature provided by the signer to confirm whether they are consistent. In addition, it should be noted that the decryption strategy is one of the core parts of the commitment scheme, which ensures that only the verifier who knows the correct random number can successfully restore the standard signature. This mechanism effectively protects the privacy of the signer and the security of the signature.

[0090] Step S403: When the verification status is that the commitment result matches the standard signature and the random number, confirm that the commitment is correct.

[0091] It should be noted that in this step, if the system successfully decrypts the commitment result into a standard signature, and the standard signature is consistent with the standard signature provided by the signer, then the verifier will confirm that the commitment is correct. This means that the signer has successfully proved its ownership of the signature and that the signature has not been tampered with or forged during the previous generation and transmission process.

[0092] In this embodiment, by verifying the correctness of the commitment and further verifying the validity of the standard signature after the verification, the security and unforgeability of the declarable multi-designated verifier signature are ensured, effectively supporting the signer's ability to declare ownership of his signature when necessary.

[0093] This application also provides a device for generating signatures of multiple designated verifiers that can be declared, please refer to Figure 4 , the declarable multi-designated verifier signature generation device includes: A scheme construction module 10, used to construct a standard signature scheme and a commitment scheme; A signature generation module 20, configured to generate a standard signature according to the standard signature scheme and preset multiple designated verifier signatures; The signature commitment module 30 is used to commit the standard signature according to the commitment scheme to obtain a declarable multi-designated verifier signature.

[0094] The device for generating a declarable multi-designated verifier signature provided by the present application adopts the method for generating a declarable multi-designated verifier signature in the above-mentioned embodiment, and can solve the technical problem of how to declare the ownership of the signature while maintaining anonymity. Compared with the prior art, the beneficial effects of the device for generating a declarable multi-designated verifier signature provided by the present application are the same as the beneficial effects of the method for generating a declarable multi-designated verifier signature provided by the above-mentioned embodiment, and the other technical features of the device for generating a declarable multi-designated verifier signature are the same as the features disclosed in the above-mentioned embodiment method, and are not described in detail here.

[0095] In one embodiment, the scheme construction module 10 is also used to construct a policy combination according to a preset multi-specified verifier signature policy, wherein the policy combination includes an initialization policy, a key generation policy, a signature policy, and a verification policy; construct an oracle, wherein the oracle includes a signer key generation oracle, a verifier key generation oracle, a signer public key generation oracle, a verifier public key generation oracle, a signature oracle, and a verification oracle; and obtain a standard signature scheme according to the policy combination and the oracle.

[0096] In one embodiment, the scheme construction module 10 is further used to construct an initialization strategy, a commitment strategy and a decryption strategy; and generate a commitment scheme according to the initialization strategy, the commitment strategy and the decryption strategy.

[0097] In one embodiment, the signature generation module 20 is also used to obtain public parameters and messages according to the standard signature scheme and the preset multi-designated verifier signatures; generate a signer key pair and a verifier key pair according to the public parameters; and obtain a standard signature according to the public parameters, the signer key pair, the verifier key pair and the message.

[0098] In one embodiment, the signature generation module 20 is further used to construct a pseudo-random function and generate a random number based on the pseudo-random function; commit the standard signature according to the commitment scheme and the random number to obtain a declarable multi-designated verifier signature.

[0099] In one embodiment, the signature commitment module 30 is further used to verify the correctness of the commitment in the declarable multi-designated verifier signature according to the commitment scheme; when the correctness verification of the commitment scheme passes, verify the standard signature in the declarable multi-designated verifier signature according to the standard signature scheme.

[0100] In one embodiment, the signature commitment module 30 is also used to obtain a statement, which includes a commitment result, a standard signature and a random number; the commitment result is matched and verified with the standard signature and the random number according to the decryption strategy of the commitment scheme to obtain a verification status; when the verification status is that the commitment result matches the standard signature and the random number, the commitment is confirmed to be correct.

[0101] The present application provides a device for generating a declarable multi-designated verifier signature, the device for generating a declarable multi-designated verifier signature comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor so that the at least one processor can execute the method for generating a declarable multi-designated verifier signature in the above-mentioned embodiment one.

[0102] Reference below Figure 5 , which shows a schematic diagram of the structure of a device for generating a declarable multi-designated verifier signature suitable for implementing an embodiment of the present application. The device for generating a declarable multi-designated verifier signature in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The illustrated device for generating declarable multi-designated verifier signatures is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of the present application.

[0103] like Figure 5As shown, the generation device of the declarable multi-designated verifier signature may include a processing device 1001 (such as a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM: Read Only Memory) 1002 or the program loaded from the storage device 1003 to the random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the generation device of the declarable multi-designated verifier signature are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. The acquisition / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems may be connected to the I / O interface 1006: an acquisition device 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 may allow the declarable multi-designated verifier signature generation device to communicate wirelessly or wired with other devices to exchange data. Although the figure shows a declarable multi-designated verifier signature generation device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have instead.

[0104] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0105] The device for generating a declarable multi-designated verifier signature provided by the present application adopts the method for generating a declarable multi-designated verifier signature in the above-mentioned embodiment, which can solve the technical problem of how to declare the ownership of the signature while maintaining anonymity. Compared with the prior art, the beneficial effects of the device for generating a declarable multi-designated verifier signature provided by the present application are the same as the beneficial effects of the method for generating a declarable multi-designated verifier signature provided by the above-mentioned embodiment, and the other technical features in the device for generating a declarable multi-designated verifier signature are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0106] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0107] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0108] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer program) stored thereon, the computer-readable program instructions being used to execute the method for generating a declarable multi-designated verifier signature in the above-mentioned embodiment.

[0109] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM: Random Access Memory), a read-only memory (ROM: Read Only Memory), an erasable programmable read-only memory (EPROM: Erasable Programmable Read Only Memory or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM: CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency: Radio Frequency), etc., or any suitable combination of the above.

[0110] The computer-readable storage medium may be included in a declarable multi-designated verifier signature generation device; or may exist independently without being assembled into a declarable multi-designated verifier signature generation device.

[0111] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by a device for generating a declarable multi-designated verifier signature, the device for generating a declarable multi-designated verifier signature: constructs a standard signature scheme and a commitment scheme; generates a standard signature according to the standard signature scheme and a preset multi-designated verifier signature; commits to the standard signature according to the commitment scheme to obtain a declarable multi-designated verifier signature.

[0112] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0113] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0114] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0115] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned method for generating a declarable multi-designated verifier signature, and can solve the technical problem of how to declare signature ownership while maintaining anonymity. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the method for generating a declarable multi-designated verifier signature provided by the above-mentioned embodiment, and will not be repeated here.

[0116] The present application also provides a computer program product, including a computer program, which implements the steps of the method for generating a declarable multi-designated verifier signature as described above when the computer program is executed by a processor.

[0117] The computer program product provided by this application can solve the technical problem of how to declare the ownership of a signature while maintaining anonymity. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the method for generating a declarable multi-designated verifier signature provided by the above embodiment, and will not be repeated here.

[0118] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A method for generating a declarable multi-designated verifier signature, characterized in that: The method comprises: Construct standard signature and commitment schemes; Generate a standard signature according to the standard signature scheme and the preset multiple designated verifier signatures; The standard signature is committed according to the commitment scheme to obtain a declarable multi-designated verifier signature.

2. The method according to claim 1, characterized in that The steps to construct a standard signature scheme include: Construct a strategy combination according to a preset multi-designated verifier signature strategy, wherein the strategy combination includes an initialization strategy, a key generation strategy, a signature strategy, and a verification strategy; Constructing an oracle, the oracle comprising a signer key generation oracle, a verifier key generation oracle, a signer public key generation oracle, a verifier public key generation oracle, a signature oracle, and a verification oracle; A standard signature scheme is obtained according to the strategy combination and the oracle.

3. The method according to claim 1, characterized in that The steps to construct a commitment scheme include: Construct initialization strategy, commitment strategy, and decryption strategy; A commitment scheme is generated according to the initialization strategy, the commitment strategy, and the decryption strategy.

4. The method according to claim 1, characterized in that The step of generating a standard signature according to the standard signature scheme and the preset multiple designated verifier signatures includes: Acquire public parameters and messages according to the standard signature scheme and the preset multiple designated verifier signatures; Generate a signer key pair and a verifier key pair according to the public parameters; A standard signature is obtained according to the public parameters, the signer key pair, the verifier key pair and the message.

5. The method according to claim 1, characterized in that The step of committing the standard signature according to the commitment scheme to obtain a declarable multi-designated verifier signature comprises: Constructing a pseudo-random function, and generating random numbers according to the pseudo-random function; The standard signature is committed according to the commitment scheme and the random number to obtain a declarable multi-designated verifier signature.

6. The method according to claim 1, characterized in that After the step of committing the standard signature according to the commitment scheme to obtain the declarable multiple designated verifier signatures, the method further includes: Verifying the correctness of the commitment in the declarable multi-designated verifier signature according to the commitment scheme; When the correctness verification of the commitment scheme passes, the standard signature in the declarable multi-designated verifier signature is verified according to the standard signature scheme.

7. The method according to claim 6, characterized in that The step of verifying the correctness of the commitment in the declarable multi-designated verifier signature according to the commitment scheme comprises: Obtaining a statement, wherein the statement includes a commitment result, a standard signature, and a random number; According to the decryption strategy of the commitment scheme, the commitment result is matched and verified with the standard signature and the random number to obtain a verification status; When the verification status is that the commitment result matches the standard signature and the random number, it is confirmed that the commitment is correct.

8. A device for generating a declarable multi-designated verifier signature, characterized in that: The device comprises: Scheme building blocks for building standard signature and commitment schemes; A signature generation module, used to generate a standard signature according to the standard signature scheme and preset multiple designated verifier signatures; The signature commitment module is used to commit the standard signature according to the commitment scheme to obtain declarable multi-designated verifier signatures.

9. A device for generating a declarable multi-designated verifier signature, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the method for generating a declarable multi-designated verifier signature according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the method for generating a declarable multi-designated verifier signature as described in any one of claims 1 to 7 are implemented.

Images