Complete dynamic group signature method and device through range membership grid

Abstract

The invention relates to the field of group signature, in particular to a complete dynamic group signature method and device through a range membership grid. The method comprises the following steps: designing a zero-knowledge proof method based on a commitment protocol; constructing a to-be-signed dynamic group according to the complete dynamic group signature based on a commitment protocol zero-knowledge proof method; wherein the users in the dynamic group to be signed in the complete dynamic group signature allow dynamic joining and revocation; designing a complete dynamic group signature method through a range membership grid; and according to the complete dynamic group signature, the dynamic group to be signed of the complete dynamic group signature is signed through a complete dynamic group signature method of the range membership grid, and a dynamic group signature result is obtained. Efficiency analysis shows that the full-dynamic grouping signature provided by the invention is superior to an existing full-dynamic version in the aspect of overhead, especially in an actual application scene.

Description

Technical Field

[0001] The present invention relates to the technical field of group signatures, and in particular to a fully dynamic group signature method and device through a range member relationship grid. Background Art

[0002] Group signatures that support verification of information provenance without revealing the ID are one of the key building blocks of cryptographic systems. Specifically, anonymity, verifiability, and traceability are three distinct characteristics. Anonymity helps ensure the privacy of the source, verifiability helps determine the legitimacy of the source, and traceability helps locate the identity in case of any dispute. These characteristics make group signatures an important tool in a range of applications, including e-voting, e-commerce, reliable computing, and connected vehicles.

[0003] Since Shor and Peter proposed a quantum algorithm that can solve the discrete logarithm problem in only polynomial time, traditional public key cryptography has faced severe challenges in security. Therefore, the field of cryptography has transitioned to the post-quantum era, and researchers have explored four main directions of post-quantum public key cryptography. Among these directions, lattice-based cryptography is very attractive because its specific algebraic structure is relatively compact and highly parallelizable, and its security is based on the worst-case hardness assumption. Therefore, as one of the most important cryptographic primitives, group signatures from lattices have attracted great interest. In 2010, Gordan et al. first proposed lattice group signatures. However, compared with methods based on bilinear pairing, this method incurs a lot of computational costs and results in larger parameters and signatures.

[0004] In general group signature schemes, all users are predetermined and the system generates keys for each user in the setup phase. However, fully dynamic support for flexible joining and revocation is a key feature of group signatures, especially in practical application scenarios. Typically, dynamic joining is achieved by deferring key generation to the joining phase, while reserving some space in the setup phase. According to the information we have, the revocation methods for grid-based group signatures mainly include Verifier-Local Revoc ation (VLR) and dynamic accumulators. In VLR, the group manager only needs to add the user to be revoked to a list, and then maintain the list to keep a record of revoked users. However, this method imposes an additional burden on users because they have to prove that they are not on the list. On the other hand, dynamic accumulators facilitate joining and revocation by changing the composition of the group (removing or adding members). Currently, there is a scheme and its variants that create dynamic accumulators through Merkle trees (or binary trees), where each departure is represented as a user. When a user is replaced by another user, the parent node and sibling nodes of the corresponding leaf need to be recursively updated. However, due to the cumbersome operation and the inefficiency of Zero-Knowledge Proof (ZKP), they generate relatively cumbersome overhead. A more efficient full-dynamic solution needs further research. Summary of the invention

[0005] In order to solve the technical problem that the fully dynamic group signature based on the grid currently has efficiency defects in dynamic implementation, the embodiment of the present invention provides a fully dynamic group signature method and device through the range membership grid. The technical solution is as follows:

[0006] In one aspect, a fully dynamic group signature method through a range membership grid is provided, the method being implemented by a fully dynamic group signature device, the method comprising:

[0007] S1. Design a zero-knowledge proof method based on commitment protocol.

[0008] S2. According to the zero-knowledge proof method based on the commitment protocol, a dynamic group to be signed is constructed; wherein users in the dynamic group to be signed are allowed to dynamically join and revoke.

[0009] S3. Design a fully dynamic group signature method via a range membership grid.

[0010] S4. According to the fully dynamic group signature method through the range membership grid, the dynamic group to be signed is signed to obtain a dynamic group signature result.

[0011] Optionally, in S2, a dynamic group to be signed is constructed according to a zero-knowledge proof method based on a commitment protocol, including:

[0012] S21. Assign a unique number to each user i as an identity.

[0013] S22, set an interval [α j ,β j ] represents a group j, and n groups constitute the dynamic group to be signed.

[0014] S23. Let j=1.

[0015] S24. Prove whether user i satisfies i≥α through non-interactive form of zero-knowledge proof j and i≤β j .

[0016] If so, user i is a member of group j.

[0017] If not, user i is not a member of group j.

[0018] S25. Determine whether j is less than or equal to n.

[0019] If yes, set j=j+1 and go to step S24.

[0020] If not, output the dynamic group to be signed.

[0021] Optionally, the step of constructing a dynamic group to be signed in S2 further includes:

[0022] When any user in the dynamic group to be signed is revoked, the identity corresponding to the revoked user is deleted from the interval to which the revoked user belongs.

[0023] Optionally, S3 is designed to implement a fully dynamic group signing approach over a range membership grid, including:

[0024] Based on the commitment scheme, a fully dynamic group signature method over a range membership grid is designed.

[0025] Among them, the commitment plan includes:

[0026] Generate the first public parameter and the second common parameter in, represents the n×m matrix space of polynomial rings modulo q1, It represents the l×m matrix space of the polynomial ring modulo q2, where q1 and q2 represent prime numbers.

[0027] According to the first common parameter A1 and the second common parameter A2, the sampling Submit Information As shown in the following formula (1):

[0028]

[0029] Where Com(m;r) represents the commitment to message m, and c1 and c2 represent the upper and lower components of the commitment.

[0030] Generate valid switches c1, c2∈ according to the first common parameter A1, the second common parameter A2 and the information m As shown in the following formula (2):

[0031]

[0032] In the formula, represents a polynomial ring, Represents an m-dimensional polynomial ring vector.

[0033] Optionally, the design in S3 uses a fully dynamic group signing approach over a range membership grid, also including:

[0034] Based on the verifiable encryption scheme, a fully dynamic group signature method over a range membership grid is designed.

[0035] Among them, verifiable encryption schemes include:

[0036] Random Sampling and Calculate y=as+e and output the private key and public key (s, (a, y)).

[0037] Assume that a message r to be encrypted is a random element of the commitment c = Com(i, r), randomly sampled and Calculate h = p(ar + e1) and k = p(yr + e2) + r, so that and constitute as well as Generate knowledge that proves π, so that Bx = θ, and output the ciphertext (h, k, π).

[0038] Where a∈Z, Z represents a set of integers, represents the polynomial ring modulo Q, s represents the private key, e represents the noise, Representing 3D Vector space, S1={r∈R|||r|| ∞ ≤1}, s represents the private key, e1 represents the noise 1, Represents 2D Vector space, e2 represents noise 2, p represents prime number, y, y2, y3 represent private key components, r represents random number, c1 represents commitment component, and θ represents intermediate value.

[0039] Optionally, the dynamic group signature result in S4 includes:

[0040] The signature signed by any user in the dynamic group signature result can be verified and opened as a valid signature with an overwhelming probability.

[0041] Optionally, a fully dynamic group signature method through a scope membership grid includes a group signature protocol establishment GSetup algorithm, a join algorithm, a signature Sign algorithm, a group signature verification GVerify algorithm, a group signature opening GOpen algorithm and a revocation Revoke algorithm.

[0042] The GSetup algorithm includes: outputting the public key gpk, the group master key gmsk, the opening key osk and the identity mapping list L according to the security parameters, the maximum number of identity ranges and the minimum number of identity ranges. id .

[0043] Join algorithm, including: updating the identity mapping list L according to the identity, public key and authority key id And output the relative key sk i .

[0044] Sign algorithm, including: according to the relative key sk i and information M, generate the user signature Π in the dynamic group s .

[0045] GVerify algorithm, including: based on the public key gpk, signature Π s and information M, get signature Π s Whether the judgment result is valid.

[0046] GOpen algorithm, including: according to the opening key osk, signature Π s and information M, output group identifier j or ⊥.

[0047] The Revoke algorithm includes: according to the user identity and the public key gpk, the group management agency revokes the user i and updates the public key to gpk'.

[0048] On the other hand, a fully dynamic group signature device through a range membership grid is provided, and the device is applied to a fully dynamic group signature method through a range membership grid, and the device includes:

[0049] The first design module is used to design a zero-knowledge proof method based on the commitment protocol.

[0050] The group construction module is used to construct a dynamic group to be signed according to a zero-knowledge proof method based on a commitment protocol; wherein users in the dynamic group to be signed are allowed to dynamically join and revoke.

[0051] The second design module is used to design a fully dynamic group signature method through a range membership grid.

[0052] The output module is used to sign the dynamic group to be signed according to the full dynamic group signature method through the range membership grid to obtain the dynamic group signature result.

[0053] On the other hand, a fully dynamic group signature device is provided, the fully dynamic group signature device comprising: a processor; a memory, the memory storing computer-readable instructions, and when the computer-readable instructions are executed by the processor, any one of the above-mentioned fully dynamic group signature methods through a range membership grid is implemented.

[0054] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction is stored in the storage medium, and the at least one instruction is loaded and executed by a processor to implement any one of the above-mentioned fully dynamic group signature methods through a range membership grid.

[0055] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0056] In the embodiment of the present invention, a new type of group signature with dynamic joining and revocation functions is proposed from the grid using zero-knowledge proof of range membership. Firstly, a zero-knowledge proof of inequality and interval relations based on a more efficient commitment scheme is proposed. Using this protocol and flexible interval changes, full dynamics is achieved in the revocation instance mainly by removing identities from the interval. Subsequently, a series of games are used to provide security proofs for anonymity and traceability. Efficiency analysis shows that the fully dynamic group signature proposed by the present invention is superior to the existing fully dynamic version in terms of overhead, especially in practical application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0058] Figure 1is a flow chart of a fully dynamic group signature method through a range membership grid provided by an embodiment of the present invention;

[0059] Figure 2 is a key and signature cost diagram provided by an embodiment of the present invention;

[0060] Figure 3 It is a block diagram of a fully dynamic group signature device through a range membership grid provided by an embodiment of the present invention;

[0061] Figure 4 It is a structural schematic diagram of a fully dynamic group signature device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0062] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0063] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0064] In the embodiments of the present invention, "image" and "picture" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same. "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same.

[0065] In the embodiments of the present invention, sometimes a subscript such as W1 may be written as a non-subscript such as W1. When the difference is not emphasized, the meanings to be expressed are the same.

[0066] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0067] The embodiment of the present invention provides a fully dynamic group signature method through a range membership grid, which can be implemented by a fully dynamic group signature device, which can be a terminal or a server. Figure 1 The process flow of the method for fully dynamic group signature through a range membership grid shown in FIG. 1 may include the following steps:

[0068] S1. Design a zero-knowledge proof method based on commitment protocol.

[0069] In a feasible implementation, some basic symbols, challenge space, hardness assumption, discrete Gaussian distribution, rejection sampling and some basic schemes used in the method of the present invention are first outlined, such as the introduction of commitment scheme (BDL-CS), which hides and binds by computational means; verifiable encryption (LN-VE) scheme, which aims to establish the "open" feature in the FDGS-RM of the present invention.

[0070] 1) Notation: Consider an integer q, let Represents the set of integers modulo q. Symbol represents a random and uniform sample x in the set S, represents a sample from the distribution D.

[0071] The present invention is used and Represents a polynomial ring He Shang Huan where d is a power of 2. Unless otherwise stated, (or ) are represented by lowercase letters, otherwise (or ) are represented by bold lowercase letters, (or ) are represented by capital letters. The present invention regards the norm of a∈Z as ||a||=|a|, and (or ) is considered as for (or ) on the vector and matrix, the norms are respectively given by and Finally, the present invention will S μ is defined as the set of all ring elements whose infinity norm is less than μ, that is

[0072] 2) Reversibility of Challenges: The challenge space is defined as: express Spaces other than 0 mean All elements in are reversible. It provides a property that is omitted here in general cyclocytomics.

[0073] 3) Hardness assumptions: The three hardness assumptions that FDGS-RM relies on are as follows:

[0074] Definition 1 (M-SIS). M-SIS q,m,n,βThe problem can be stated as follows: Given a random sampling matrix The goal is to find a Let Ax=0modq and 0<||a||≤β.

[0075] Definition 2 (Decision-making M-LWE). Decision Making in M-LWE q,m,n The problem can be stated as follows: Randomly select definition For sample The distribution of The purpose is to distinguish m samples and uniform distribution The relationship between.

[0076] Definition 3 (NTRU). Ring The NTRUq,r problem in can be expressed as follows: Definition is the distribution h = f / g, where And g in is reversible, otherwise resample g. The purpose is to make The h in Evenly distributed.

[0077] 4) Discrete Gaussian distribution and rejection sampling: The discrete Gaussian distribution function over integers with center and standard deviation σ is: in

[0078] According to the tail bound centered at 0, it can be concluded that for With overwhelming probability, it closes to σ, that is, for The following conditions hold: And if Available

[0079] In addition, sampling is rejected in the ZPK protocol of the present invention to prevent information leakage. A key theorem can be expressed as follows:

[0080] Theorem 1: Assume The 2-norm of is less than h, and O is the probability distribution of S. Rejection sampling Rej(z=y+a,a,σ), where and σ≥11||a||, returns to 1 within 1 / 3 of the power of 2-100. When it returns to 1, the distribution of z is The statistical distance is 2 -100 .

[0081] S2. Construct a dynamic group to be signed according to the zero-knowledge proof method based on the commitment protocol, where the users in the dynamic group to be signed are allowed to dynamically join and revoke.

[0082] In a feasible implementation manner, this step presents a new ZKP, that is, the switch of the commitment c satisfies the inequality relationship between integers. Intuitively, the equality relationship (such as a < d) can be transformed into the equation a + b = d and b > 0. To prove the interval relationship (such as a ∈ (α, β)), it is necessary to prove a > α and a < β. The "strictly less than" relationship in can be proved through the equation f1 - f2 = α - 1. Based on the knowledge proof of these inequality relationships, a zero-knowledge protocol for range membership can be constructed by conducting two inequality relationship proofs.

[0083] Optionally, the above step S2 may include the following steps S21 - S25:

[0084] S21. Assign a unique number to each user i as the identity.

[0085] S22. Set an interval [α j , β j to represent a group j, and n groups form the dynamic group to be signed.

[0086] S23. Let j = 1.

[0087] S24. Prove whether the user i satisfies i ≥ α j and i ≤ β j through the non-interactive form of zero-knowledge proof.

[0088] If satisfied, the user i is a member of group j.

[0089] If not satisfied, the user i is not a member of group j.

[0090] S25. Judge whether j is less than or equal to n.

[0091] If so, let j = j + 1, and go to execute step S24.

[0092] If not, output the dynamic group to be signed.

[0093] In a feasible implementation manner, the present invention assigns a unique number to each user as the identity, and an interval (such as [α1, β1]) represents a group.

[0094] It only needs to prove, through the non - interactive form of ZKP, that a user i satisfies i≥α1 and i≤β1, where the output of the Hash taking messages and other parameters as input is regarded as a challenge set. Then, it is convinced that it belongs to this interval (i.e., also belongs to this group). When revoking a user, simply delete the corresponding number from the interval, leaving one or two new intervals (if these intervals are all too short to guarantee minimum privacy). Otherwise, all users within the new intervals need to re - assign identities and new keys are generated for them. To implement the above idea, the present invention first proposes a new ZKP based on an efficient commitment protocol to prove interval membership, and designs a fully dynamic group signature from the grid through a more efficient ZKP protocol.

[0095] The present invention proposes a fully dynamic group signature from the grid, where variable intervals can be constructed through flexible membership ranges. In most cases, revocation only needs to delete identities from the interval, so that the grid - based group signature can be fully dynamic, and due to the adoption of a more effective commitment scheme, the overhead is lower.

[0096] Specifically, the present invention shows a new ZKP, that is, the opening of the commitment c satisfies the inequality relationship between integers. Intuitively, the inequality relationship (such as a < d) can be transformed into the equation a + b = d and b>0, which can be proved by the ZKP of linear relationship. However, there is a small change here, that is, d is no longer required as a secret. The present invention can also obtain the proof of interval relationship and the proof of range membership relationship based on the inequality relationship. To prove the interval relationship (such as a∈(α,β)), it is necessary to prove a>α and a < β.

[0097] The present invention assumes that the boundaries of the inequality are public, which is consistent with the upcoming group signature construction, and the confidential version may have other applications. Suppose the target inequality is f1>α, which can be transformed into proving the equation f1 - f2 = α - 1, where is secret, is the public bound. The proof procedure is shown as follows.

[0098] Commit: For i∈[1,2], generate a set of common parameters where and To commit the message Randomly sample and calculate:

[0099] Prove: The prover randomly samples and such that:

[0100] Then send w to the verifier 1,1 、w 2,1 and w2. After receiving the verifier, random sampling And return. The verifier calculates: z1=sr1+y1,z2=sr2+y2,Rej((z1,z2),(sr1,sr2),σ).

[0101] Then z1 and z2 are sent to the validator. Finally, the validator checks:

[0102] If all checks are positive, then the prover has successfully proved that the secret he / she possesses is less than α.

[0103] Theorem 2: Let and and i∈[1,2]. Defined as A subset of where all elements are reversible. Then, the protocol ∑Ineq, which is proved to be an inequality relation, has the following properties:

[0104] Correctness: Unless the validator decides to give up, the probability of the validator successfully passing the verification is overwhelming, and the probability of his / her giving up is at most

[0105] Zero-knowledge for honest verifiers: Simulating non-stop interactions between honest verifiers and provers yields a distribution that is statistically indistinguishable from reality.

[0106] Special rationality: By analyzing the two acceptance records, the knowledge extractor can obtain the commitment c when i∈[1,2] i Effective opening Make and The equation holds.

[0107] Proof: Here, we only give the proofs of the last two properties, since the first property is almost the same as

[10] .

[0108] Honest-Verifier Zero-Knowledge: By utilizing the FiatShamir heuristic, ∑Ineq can be transformed into a non-interactive proof in practical applications. Therefore, the present invention only considers the case where the prover does not propose an abortion, and proves that the protocol is zero-knowledge.

[0109] First, due to the discrete Gaussian distribution, ||z1||≤B1′ and ||z2||≤B2′ obviously hold. 1,1 ,w 2,1,w2 is completely determined by ((A1,A2),(z1,z2),(c1,c2),s), so (w 1,1 ,w 2,1 ,w2,S,z1,z2) distribution is statistically close to the actual situation, with a statistical distance of 2 -100 . Therefore, this property must be proved.

[0110] Special Soundness: In the case of two receiving records ((w 1,1 ,w 2,1 ),w2,s,(z1,z2)) and ((w 1,1 ,w 2,1 ),w2,s′,(z1,z2)), where s≠s′. Therefore, by verification, we can get:

[0111]

[0112] and

[0113] Extractors can extract information and So that (z1-z1′, ) and (z2-z2′, ) becomes a valid opening for commitments c1 and c2, and Established. By the difference of the equation, we can get:

[0114] Then, set and make and because exist is reversible, by substituting, we get: This means that the extractor has extracted knowledge and Thus we get: where ||z1||≤B1′,||z2||≤B2′, and

[0115] So far, the present invention has been proved by the equation f1-f2=α-1 Similarly, other kinds of inequality relations can be proved in a similar way. Based on the knowledge proof of these inequality relations, a zero-knowledge protocol for range membership can be constructed by proving two inequality relations. For example, since the present invention intends to prove the range membership a∈(X,Y], the present invention only needs to prove the inequalities a>X and a≤Y.

[0116] S3. Design a fully dynamic group signature method via a range membership grid.

[0117] Optionally, the present invention introduces a commitment scheme (BDL-CS) to hide and bind by computation. This variant version modifies the modulus of the top and bottom with different prime numbers q1 and q2, so that q2 can meet the hardness of other parts of the protocol, as follows:

[0118] CKeyGen(m,n,l): Generate the first common parameter and the second common parameter in, represents the n×m matrix space of polynomial rings modulo q1, It represents the l×m matrix space of the polynomial ring modulo q2, where q1 and q2 represent prime numbers.

[0119] For example: in in

[0120] Commit(m): uniformly sample a Submit a message Where Com(m;r) represents the commitment to message m, and c1 and c2 represent the upper and lower components of the commitment.

[0121] Open(Com(m,r)): Valid switch By Message A random element and a composition: In the formula, represents a polynomial ring, Represents an m-dimensional polynomial ring vector.

[0122] The condition is

[0123] Furthermore, the present invention proposes a verifiable encryption (LN-VE) scheme, which aims to establish an "open" feature in the FDGS-RM of the present invention. Verifiable encryption can not only encrypt messages, but also support encryption verification. Compared with traditional encryption schemes, verifiable encryption adds a "verification" algorithm:

[0124] PKESetup(λ): randomly sample a and Calculate y=as+e and output the private key and public key (s, (a, y)).

[0125] Enc((a,y),r,c1): Assume that a message r to be encrypted is a random element of the commitment c = Com(i,r). First, randomly sample and Calculate h = p(ar + e1) and k = p(yr + e2) + r, so that and Then, form as well as Finally, generate the knowledge to prove π so that Bx = θ and output the ciphertext (h, k, π).

[0126] CiVerify((h,k,π),c1): To verify encryption, we only need to verify the proof π. As before, we generate B and θ and output the result Verify(π,B,θ), where a∈Z, Z represents the set of integers, represents the polynomial ring modulo Q, s represents the private key, e represents the noise, Representing 3D Vector space, S1={r∈R|||r|| ∞ ≤1}, s represents the private key, e1 represents the noise 1, Represents 2D Vector space, e2 represents noise 2, p represents prime number, y, y2, y3 represent private key components, r represents random number, c1 represents commitment component, θ has no practical meaning and is just an intermediate value.

[0127] Dec((h,k,π),s): If the precondition CiVerify(π,B,θ)=1 holds, the ciphertext can be decrypted.

[0128] In a feasible implementation, the syntax, security mode and scheme construction of FDGS-RM. FDGS-RM consists of six algorithms, namely GSetup, Join, Sign, GVerify, GOpen and Revoke. To ensure correctness, it is required that any signature signed by a legitimate group of users can be verified and opened as a valid signature with an overwhelming probability, and the group signature needs to meet anonymity and traceability.

[0129] The security proof of FDGS-RM includes anonymity and traceability, which is given according to the security model. Assume a PPT adversary participates in a security game with a security parameter λ. Define The advantage is Destruction of BDL-CS and The hidden property of has the advantage of destroying the IND-CPA of the previous LN-VE scheme.

[0130] S4. According to the fully dynamic group signature method through the range membership grid, the dynamic group to be signed is signed to obtain a dynamic group signature result.

[0131] Optionally, the dynamic group signature result in S4 includes:

[0132] The signature signed by any user in the dynamic group signature result can be verified and opened as a valid signature with an overwhelming probability.

[0133] In a feasible implementation, a fully dynamic group signature method through a range membership grid includes a group signature protocol establishment GSetup algorithm, a Join algorithm, a Sign algorithm, a group signature verification GVerify algorithm, a group signature opening GOpen algorithm and a Revoke algorithm.

[0134] To ensure correctness, a signature signed by any legitimate group of users is required s can be verified and opened as valid signatures with overwhelming probability, namely:

[0135] Pr[GOpen(osk,M,Sign(sk i ,M))]≈1.

[0136] Group signatures need to satisfy anonymity and traceability. The security model and the precise definitions of the two properties are as follows:

[0137] 1) Anonymity: Proof of anonymity can be viewed as a game in which the challenger and opponents Conduct simulated interactions. from Randomly select one of the two provided identities and generate a signature corresponding to the selected identity. The source is determined by the signature. Here are the specific details of the model:

[0138] Setup: Call GSetup(λ,η,N) and send the public key gpk to

[0139] Query: In this phase, you are allowed to Conduct damage, signature, open and revocation inquiries.

[0140] In the damage query of user i, Call Join(i,gpk,gmsk) to generate the key sk i And sk i Return to In the signature query of message M, Call Sign(sk i ,M) to generate the signature Π s , and Π s Return to In Π s In the open query of Call GOpen(osk,M,Π s ) and transmit the result to In a revocation query for a user with group ID i, Calling Revoke(i) removes i from the relevant interval and updates gpk.

[0141] Challenge: Choose a new message M*, two identities i0 and i1, and send these choices to After receiving, randomly select i b , b∈[0,1] and generate a vector with sk ib Signature and return it.

[0142] Output: The query can still be executed, but the object cannot be i0 or i1. Finally, Output b' as the guess for b.

[0143] If b'=b, then Winning the game, advantage is defined as

[0144] Definition 4 (Anonymity). If AdvA Anon(λ)≤negl(λ) for any PPT adversary A, then the group signature satisfies anonymity.

[0145] 2) Traceability: Traceability proof can be seen as a game, where the challenger and opponents Also simulate interaction in it. If A legal signature can be forged, but the result of GOpen(·) is ⊥, then Win the game. Here are the details of the model:

[0146] Setup: Let I be the set of all legal intervals, and S C and S S are the identity and signature set to be queried in the connection and symbol, respectively. C calls GSetup(λ,η,N) to initialize the protocol and returns the public key gpk and the master key gmsk to

[0147] Query: In this phase, you are allowed to Perform damage, sign, open and revoke queries. Same as the previous game, so I will omit it here.

[0148] Furthermore, the specific structure of FDGS-RM is:

[0149] In the structure proposed by the present invention, focus on the ring and membership intervals (initial range is [α0,β0].), unless otherwise stated. As mentioned earlier, FDGS-RM consists of six algorithms described below.

[0150] GSetup(λ,η,N)→(gpk,gmsk,osk): randomly select an interval As the initial member range, let η≤β0-α0≤N. Generate the public parameters of the commitment in Random draw And calculate Generate the opened public key and secret key ((a, y), s) ← PKESetup(λ), after random sampling, output gmsk = R to the group authority, output osk = s to the opener, and public gpk = (A, a, b, u, [α0, β0], (α, y)). To generate a key for the user, the identity id needs to be mapped to the range [α0, β0] to create a group identity i. Then generate a key based on the group identity i. Therefore, it will form a list L id , records the mapping from identifier to group identifier.

[0151] Join(id,gpk,gmsk)→(sk i ): If there is an unused number, generate a group identifier i∈[α0,β0]. Otherwise, create a new interval [α1,β1] with the same restrictions, where every number is unused, and choose an i∈[α1,β1] as the group identifier. Finally, add the mapping to L id , and append the new interval (if created) to gpk. Random Sampling make and Output key A valid group signature requires the user to convince the verifier that the user owns the key s i , to satisfy And his / her group identity i∈[α j ,β j ]. In order to circumvent the exposure of his / her identity, the identity is submitted and integrated into the equation.

[0152] Sign(sk i ,M)→(Π s ): Calculate the commitment c = Com(i,r), c′ = Com(δi,r′), c - =Com(d - ,r - ), in d - =i-α j And d + =β j -i. Generate the ciphertext (h,k,π4) of the random element r through Enc((a,y),r,c1). Calculate and prove π1, prove that information i, i' is opened from commitment c, c', so that i'=δi; calculate and prove π2, prove that information i is opened from c, so that i∈[α j ,β j ]; and compute a proof π3 that proves that knowledge of s' enables v T s′=u is realized. Then the signature Π is formed s =(c,c′,c - ,c + ,π1,π2,π3,π4,(h,k),[α j ,β j ]) and output. Proofs π1,π2,π3,π4 can be transformed into non-interactive versions using the Fiat-Shamir heuristic, and all of these proofs can use the same challenge.

[0153] GVerify(gpk,M,Π s)→(1∨0): recovery Verify that π1, π2, π3, π4 and output 1 are valid, otherwise 0. To open a signature, the opener needs to perform a decryption operation to extract the ciphertext and The signer's group identity is thus calculated.

[0154] GOpen(osk,M,Π s )→(id∨L): If i′∈L id , then output the corresponding user identity id, otherwise output ⊥. The authority only needs to delete the target identity from the relevant interval and form one or two new intervals when revocation is involved. If the number of any interval is less than η, the group manager must choose a new interval in which no elements have been used and regenerate a new key for each user in the previous interval.

[0155] Revoke(i)→(gpk′): Assume that the target i∈[α j ,β j ] and current gpk=(A,a,b,u,[α0,β0],...,[α j |,β j ],...,[α t ,β t ],(a,y)). If Size([α j ,i])≥η∧Size([i,β j ])≥η. Delete i and output a new public key gpk′=(A,a,b,u,[α0,β0],...,[α j′ |,β j′ ],[α j′+1 |,β j′+1 ],...,[α t ,β t ],(a,y)), where β j′ =i-1and α j′+1 =i+1. If one (or two) of the new empty intervals does not meet the same constraints, the mechanism will randomly select a new empty interval In this interval, none of these identities will be used. Remap these identities in the previous interval and regenerate keys for them. Finally, output the new public key:

[0156] gpk′=(a,a,b,u,[α0,β0],...,[α k′ |,β k′ ],[α j′+1 |,β j′+1],...,[α t ,β t ],(a,y)) and update L id If there is no space to select a new interval, then reset the system.

[0157] The following theorem demonstrates the correctness of FDGS-RM.

[0158] Theorem 3: set up as well as The settings of other parameters are as described above. Then the correctness of FDGS-RM holds.

[0159] Secure Proof of Anonymity and Traceability:

[0160] The security proof of FDGS-RM, including anonymity and traceability, is given based on the mentioned security model.

[0161] Assume a PPT opponent participates in a security game with a security parameter λ. Define The advantage is Destruction of BDL-CS and The hidden property of has the advantage of destroying the IND-CPA of the previous LN-VE scheme.

[0162] Security Proof of Anonymity:

[0163] Theorem 4: If and can be ignored, then of The anonymity advantage over FDGS-RM is also negligible.

[0164] Proof: Security proof is considered A series of games G0,...,G6 between them, where G0 is the same as the actual situation.

[0165] Game G0: In this game, Run GSetup(λ,η,N) to generate gpk and provide it to Granted permission to perform damage, sign, open, and revoke queries. Once Deciding to enter the challenge phase, it will select an information M that has never been queried. * and two identities i 0， i1∈[N]. Randomly select b∈{0,1} and then execute Generate signature have:

[0166] Game G1: Except when Query hour, Returning to the simulation results of zero knowledge in the inequality proof, game G1 is almost the same as G0. Therefore, game G1 is statistically indistinguishable from the previous game, that is,

[0167] Game G2: Game G2 is almost the same as G1, the only difference is that Query , c is replaced by a commitment to 0. Due to the hidden nature of BDL-CS, G2 is no different from the previous game, i.e.

[0168] Game G3: Game G3 is almost the same as G2, with the following differences: Query , c' is replaced by a commitment to 0, i.e.

[0169] Game G4 and G5: G4 and G5 are similar to G2 and G3, but Query When, promise c - and c + Which in turn are replaced by a commitment to 0.

[0170] Game G6: Game G6 is almost the same as G5, the difference is Query , the ciphertext (h,K) is replaced by the encryption of 0. Therefore, due to the IND-CPA property of LN-VE, game G6 is indistinguishable from G5, i.e.,

[0171] Then you can get The advantage gap between G6 and G0:

[0172]

[0173] Since the signature generated by game G6 is independent of identity i b ,so The advantage of outputting b'=b is 1 / 2. and can be ignored, so in actual scenarios, There is only a negligible advantage over anonymity, proving Theorem 4.

[0174] Safety proof of traceability:

[0175] Next, we prove traceability. and They are Solving NTRU q,r and M-LWE q,1,s The advantage of difficult questions, yes Advantages of solving M-SIS difficulty problems. The advantage in the tracing game is recorded as

[0176] Theorem 5: Let h q for and The upper bound of the hash query submitted. If and The advantage of can be ignored, then Advantages of traceability for FDGS-RM It can also be ignored.

[0177] Proof: As before, the present invention uses a series of games G0,...,G5 in and Traceability is proven between them, and G0 is the same as the actual scenario.

[0178] Game G0: In this game, Initialize the protocol faithfully and Return key sk i , i∈S and key gmsk, where S is a subset of I, we have:

[0179] Game G1: Game G1 is almost identical to G0, except that Set to [0 1f / g], where Due to the NTRU hardness assumption, game G1 is indistinguishable from G0, i.e.

[0180] Game G2: Game G2 is almost the same as G1, the difference is b T from Random sampling in . You cannot use the GPV trapdoor to generate keys because b T ≠a T R. On the contrary, Random sampling via NTRU trapdoor and generate make According to the M-LWE difficulty hypothesis, game G2 is indistinguishable from the previous one, i.e.

[0181] Game G3: In this game, b T B *T =b T -i*g T Replaced by

[0182] Game G4: Game G4 is almost the same as G3, the difference is b *T By a T Ri*q is replaced. Due to the M-LWE hardness assumption, G4 is no different from the previous game, i.e.

[0183] Game G5: right Sampling is performed and replaced with [0 1a2] Other things remain unchanged, then As before, you can use [a T |b T +(ii*)g T ]'s GPV trapdoor generates keys. Due to the NTRU difficulty assumption, G5 is no different from the previous game, i.e.

[0184] Game G6: In this game, You will get an M-SIS problem instance And is required to output ||z||≤B S , so that a *T z=0. Different from G5, set up and While other things remain unchanged,

[0185] Query: When a signature is requested for information M with identity i, Will faithfully execute the signature algorithm and return the generated signature to When the identity is required to be i≠i * When the user performs damage, Will use the relevant secret key sk i Answer, otherwise abort. When a user with group i identity is requested to be revoked, i is removed from the corresponding member range and gpk is updated.

[0186] Forgery: Finally, For message M * Output a fake symbol Π f =(c,c′,c - ,c + ,π,(h,k)). By operating two different challenges, Can extract knowledge The probability is at least Available,

[0187]

[0188] According to the bifurcation theorem, in

[0189] Then Ciphertext Decryption is performed, and according to the soundness of LN-VE, the integer is obtained with overwhelming probability This means that the forged signature opening will yield Instead of ⊥, the probability that the open signature is the identity i* is 1 / N due to the random and uniform distribution of identities. In this case, we have:

[0190]

[0191] Multiply the third term by Substituting the first two terms, we get:

[0192] if Never perform a corruption query on identity i*, then it will not abort. After obtaining the forged signature, You can sample one Make set up as well as equal The probability of is negligible. Get the solution of M-SIS: And get the boundary of the solution:

[0193]

[0194] if can win the traceability game with a non-negligible advantage ε, then With non-negligible probability Solving the M-SIS difficulty problem contradicts the assumption. Therefore, In game G6, traceability is only violated by a negligible margin, which is different from the actual scenario due to

[0195] Efficiency evaluation of FDGS-RM: Compare the overhead of each stage with other similar schemes, and introduce the specific size of keys and signatures when d = 1024. First, the size of public key, secret key, opening key and signature is roughly compared with the current similar schemes. In FDGS-RM, the overhead of keys and signatures is Therefore, except for the PLS scheme, the commitment and ZKP schemes adopted in the present invention are more efficient, so the FDGS-RM of the present invention has lower overhead regardless of the size of the key and signature.

[0196] First, the sizes of the public key, secret key, unlock key, and signature are roughly compared with current similar schemes. Here, λ represents the security parameter and N represents the upper limit of the number of users. Figure 2 As shown, in the FDGS-RM of the present invention, the overhead of the key and the signature are

[0197] Therefore, in addition to the PLS scheme, FDGS-RM has lower overhead regardless of the size of the key and signature due to the higher efficiency of the commitment and ZKP schemes adopted by the present invention. In addition, the scheme is fully dynamic and supports dynamic joining and revocation (dynamic schemes only support one of the two). However, due to the interval revocation mechanism, if λ is not too large, joining and revoking will hardly generate additional overhead. In addition, compared with these dynamic schemes, FDGS-RM has the smallest overhead in terms of keys and signatures.

[0198] The present invention also analyzes the estimated size of the key and signature. Set the ring dimension d = 4096, the commitment module q1 = 2 30 ,q2=2 80 , commitment line dimension n = 1, information dimension in commitment l = 1, verifiable plaintext module p = 2 27 , the verifiable ciphertext module Q = 2 60 , challenge space 1-norm constraint κ = 26, GPV backdoor standard deviation v = 2 49 , NTRU backdoor standard deviation r = 2 42 Such a parameter setting results in a root Hermite factor of δ0 = 1.0036 and ensures a post-quantum space hardness of at least 93 bits.

[0199] The public key consists of 3 polynomials of module q1, 8 polynomials of module q2 and 4 polynomials of module Q, so the size is: 3d log q1+8d log q2+4d log Q≈485KB.

[0200] The secret key consists of 4 polynomials with deviation v and 2 polynomials with deviation r, so the size is: 4d log(12v)+2d log(12r)≈150KB.

[0201] The open key contains only a polynomial vector with 3 rows, so the size is: 3d log Q = 90KB.

[0202] As for the signature, it consists of 4 commitments, 4 zero-knowledge proofs and a verifiable ciphertext, so the size is:

[0203] 4dlog(q1)+4dlog(q2)≈220KB,

[0204] 4dlogQ≈120KB,

[0205] 21dlog(12σ)+4dlog(12σ1)+2dlog(12σ2)≈420KB.

[0206] Therefore, the specific sizes of the public key, secret key, unlock key and signature are 485KB, 150KB, 90KB and 760KB respectively.

[0207] In the embodiment of the present invention, a new type of group signature with dynamic joining and revocation functions is proposed from the grid using zero-knowledge proof of range membership. Firstly, a zero-knowledge proof of inequality and interval relations based on a more efficient commitment scheme is proposed. Using this protocol and flexible interval changes, full dynamics is achieved in the revocation instance mainly by removing identities from the interval. Subsequently, a series of games are used to provide security proofs for anonymity and traceability. Efficiency analysis shows that the fully dynamic group signature proposed by the present invention is superior to the existing fully dynamic version in terms of overhead, especially in practical application scenarios.

[0208] Figure 3 1 is a block diagram of a fully dynamic group signature device through a range membership grid according to an exemplary embodiment, wherein the device is used for a fully dynamic group signature method through a range membership grid. Figure 3 The device includes a first design module 310, a group construction module 320, a second design module 330 and an output module 340. Wherein:

[0209] The first design module 310 is used to design a zero-knowledge proof method based on a commitment protocol.

[0210] The group construction module 320 is used to construct a dynamic group to be signed according to a zero-knowledge proof method based on a commitment protocol; wherein users in the dynamic group to be signed are allowed to dynamically join and revoke.

[0211] The second design module 330 is used to design a fully dynamic group signature method through a range membership grid.

[0212] The output module 340 is used to sign the dynamic group to be signed according to the full dynamic group signature method through the range membership grid to obtain a dynamic group signature result.

[0213] In the embodiment of the present invention, a new type of group signature with dynamic joining and revocation functions is proposed from the grid using zero-knowledge proof of range membership. Firstly, a zero-knowledge proof of inequality and interval relations based on a more efficient commitment scheme is proposed. Using this protocol and flexible interval changes, full dynamics is achieved in the revocation instance mainly by removing identities from the interval. Subsequently, a series of games are used to provide security proofs for anonymity and traceability. Efficiency analysis shows that the fully dynamic group signature proposed by the present invention is superior to the existing fully dynamic version in terms of overhead, especially in practical application scenarios.

[0214] Figure 4 is a schematic diagram of the structure of a fully dynamic group signature device provided by an embodiment of the present invention, such as Figure 4 As shown, the fully dynamic group signature device may include the above Figure 3 A fully dynamic group signature apparatus through a range membership grid is shown. Optionally, the fully dynamic group signature apparatus 410 may include a first processor 2001 .

[0215] Optionally, the fully dynamic group signature device 410 may further include a memory 2002 and a transceiver 2003 .

[0216] The first processor 2001, the memory 2002 and the transceiver 2003 may be connected via a communication bus.

[0217] Combine the following Figure 4 The components of the fully dynamic group signature device 410 are specifically introduced as follows:

[0218] The first processor 2001 is the control center of the fully dynamic group signature device 410, and may be a processor or a general term for multiple processing elements. For example, the first processor 2001 is one or more central processing units (CPUs), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention, such as one or more microprocessors (digital signal processors, DSPs), or one or more field programmable gate arrays (FPGAs).

[0219] Optionally, the first processor 2001 may perform various functions of the fully dynamic group signature device 410 by running or executing a software program stored in the memory 2002 and calling data stored in the memory 2002 .

[0220] In a specific implementation, as an embodiment, the first processor 2001 may include one or more CPUs, such as Figure 4 CPU0 and CPU1 are shown in FIG.

[0221] In a specific implementation, as an embodiment, the fully dynamic group signature device 410 may also include multiple processors, such as Figure 4 The first processor 2001 and the second processor 2004 are shown in FIG. Each of these processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here can refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0222] The memory 2002 is used to store the software program for executing the solution of the present invention, and is controlled to be executed by the first processor 2001. The specific implementation method can refer to the above method embodiment, which will not be repeated here.

[0223] Optionally, the memory 2002 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 2002 may be integrated with the first processor 2001, or may exist independently, and may be accessed through the interface circuit ( Figure 4 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0224] The transceiver 2003 is used to communicate with a network device or a terminal device.

[0225] Optionally, the transceiver 2003 may include a receiver and a transmitter ( Figure 4 The receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0226] Optionally, the transceiver 2003 may be integrated with the first processor 2001, or may exist independently and communicate with the first processor 2001 through the interface circuit ( Figure 4 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0227] It should be noted that Figure 4 The structure of the fully dynamic group signature device 410 shown in the figure does not constitute a limitation on the router, and the actual knowledge structure recognition device may include more or less components than those shown in the figure, or combine certain components, or arrange the components differently.

[0228] In addition, the technical effects of the fully dynamic group signature device 410 can refer to the technical effects of the fully dynamic group signature method through the range membership grid described in the above method embodiment, which will not be repeated here.

[0229] It should be understood that the first processor 2001 in the embodiment of the present invention may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0230] It should also be understood that the memory in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0231] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0232] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0233] In the present invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0234] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0235] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0236] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described equipment, devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0237] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0238] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0239] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0240] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0241] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A fully dynamic group signature method via a range membership grid, characterized in that The method comprises: S1. Design a zero-knowledge proof method based on commitment protocol; S2. According to the zero-knowledge proof method based on the commitment protocol, a dynamic group to be signed is constructed; wherein users in the dynamic group to be signed are allowed to dynamically join and revoke; S3,design a fully dynamic group signature method through a range membership grid; S4. According to the fully dynamic group signature method through the range membership grid, the dynamic group to be signed is signed to obtain a dynamic group signature result.

2. The method of fully dynamic group signature through a range membership grid according to claim 1, characterized in that: The step S2 of constructing a dynamic group to be signed according to the zero-knowledge proof method based on the commitment protocol includes: S21. Assign a unique number to each user i as an identity; S22, set an interval [α j ,β j ] represents a group j, and n groups constitute the dynamic group to be signed; S23, let j=1; S24. Prove whether user i satisfies i≥α through non-interactive form of zero-knowledge proof j and i≤β j ; If it is satisfied, user i is a member of group j; If not, user i is not a member of group j; S25, judging whether j is less than or equal to n; If yes, set j=j+1 and go to step S24; If not, output the dynamic group to be signed.

3. The method of fully dynamic group signature through a range membership grid according to claim 2, characterized in that: The step of constructing a dynamic group to be signed in S2 further includes: When any user in the dynamic group to be signed is revoked, the identity corresponding to the revoked user is deleted from the interval to which the revoked user belongs.

4. The method of fully dynamic group signature via a range membership grid according to claim 1, characterized in that: The S3 design adopts a fully dynamic group signature approach for scoped membership meshes, including: Based on the commitment scheme, a fully dynamic group signature method is designed through a range membership grid; The commitment plan includes: Generate the first public parameter and the second common parameter in, represents the n×m matrix space of polynomial rings modulo q1, represents the l×m matrix space of polynomial ring modulo q2, q1 and q2 represent prime numbers; According to the first common parameter A1 and the second common parameter A2, sampling Submit Information As shown in the following formula (1): Where Com(m;r) represents the commitment to message m, c1, c2 represent the upper and lower components of the commitment; Generate a valid switch according to the first common parameter A1, the second common parameter A2 and the information m As shown in the following formula (2): In the formula, represents a polynomial ring, Represents an m-dimensional polynomial ring vector.

5. The method of fully dynamic group signature via a range membership grid according to claim 4, characterized in that: The S3 design is a fully dynamic group signature approach through a range membership grid, also including: Based on the verifiable encryption scheme, a fully dynamic group signature method is designed through the range membership grid; The verifiable encryption scheme includes: Random Sampling and Calculate y=as+e and output the private key and public key (s, (a, y)); Assume that a message r to be encrypted is a random element of the commitment c = Com(i, r), randomly sampled and Calculate h = p(ar + e1) and k = p(yr + e2) + r, so that and constitute as well as Generate knowledge to prove π, so that Bx = θ, and output the ciphertext (h, k, π); Where a∈Z, Z represents a set of integers, represents the polynomial ring modulo Q, s represents the private key, e represents the noise, Representing 3D Vector space, S1={r∈R|||r|| ∞ ≤1}, s represents the private key, e1 represents the noise 1, Represents 2D Vector space, e2 represents noise 2, p represents prime number, y, y2, y3 represent private key components, r represents random number, c1 represents commitment component, and θ represents intermediate value.

6. The method of fully dynamic group signature via a range membership grid according to claim 1, characterized in that: The dynamic group signature result in S4 includes: The signature signed by any user in the dynamic group signature result can be verified and opened as a valid signature with an overwhelming probability.

7. The method of fully dynamic group signature via a range membership grid according to claim 1, characterized in that: The fully dynamic group signature method through the range membership grid includes a group signature protocol establishment GSetup algorithm, a Join algorithm, a Sign algorithm, a group signature verification GVerify algorithm, a group signature opening GOpen algorithm and a Revoke algorithm; The GSetup algorithm includes: outputting a public key gpk, a group master key gmsk, an opening key osk and an identity mapping list L according to security parameters, a maximum number of identity ranges and a minimum number of identity ranges. id ; The Join algorithm includes: updating the identity mapping list L according to the identity, public key and authority key id And output the relative key sk i ; The Sign algorithm includes: according to the relative key sk i and information M, generate the user signature Π in the dynamic group s ; The GVerify algorithm includes: according to the public key gpk, signature Π s and information M, get signature Π s Whether the judgment result is effective; The GOpen algorithm includes: according to the opening key osk, the signature UI s Sum information M, output group identifier j or ⊥; The Revoke algorithm includes: according to the user identity and the public key gpk, the group management agency revokes the user i and updates the public key to gpk'.

8. A fully dynamic group signature device through a range membership grid, the fully dynamic group signature device through a range membership grid is used to implement the fully dynamic group signature method through a range membership grid as claimed in any one of claims 1 to 7, characterized in that: The device comprises: The first design module is used to design a zero-knowledge proof method based on a commitment protocol; A group construction module, used to construct a dynamic group to be signed according to the zero-knowledge proof method based on the commitment protocol; wherein users in the dynamic group to be signed are allowed to dynamically join and revoke; A second design module for designing a fully dynamic group signature method through a range membership grid; The output module is used to sign the dynamic group to be signed according to the fully dynamic group signature method through the range membership grid to obtain a dynamic group signature result.

9. A fully dynamic group signature device, characterized in that: The fully dynamic group signature device comprises: processor; A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by the processor, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program codes, which can be called by a processor to execute the method according to any one of claims 1 to 7.

Images