Key management method and device, equipment and medium

Abstract

The invention discloses a key management method and device, equipment and a medium, and relates to the technical field of information security, and the method comprises the steps that a chameleon-Shrubs authentication tree comprises a chameleon Shrubs tree and a Shrubs node authentication tree, and a multi-time signature public key of the chameleon-Shrubs authentication tree is kept unchanged; the topmost node of the Shrubs node authentication tree is a verification root node obtained based on the Shrubs nodes of each layer in the chameleon Shrubs tree; writing the primary signature public key into a target empty node in a previous chameleon Shrubs tree, and determining a target Shrubs node of the target empty node; determining an updated random number of the target Shrubs node, so as to update the structure of a previous chameleon-Shrubs authentication tree to obtain a current chameleon-Shrubs authentication tree; and verifying a message signature pair obtained based on an authentication path from the target null node to the verification root node by using the multi-signature public key. And the key management overhead is reduced.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a key management method, device, equipment and medium. Background Art

[0002] A one-time signature is a special digital signature. Its basic idea is to use a one-way function to sign a message. Compared with the public key signature based on the trapdoor function, the generation and verification of a one-time signature is more efficient. However, a one-time signature will expose part of the private key during the signing process. Therefore, in order to ensure the security of the signature, each pair of keys can only be used once. Therefore, if different keys are generated for different messages, it will cause an excessive key management burden.

[0003] In order to reduce the space complexity of the one-time signature scheme and solve the problem of complex key management, one is an improved scheme based on the Merkle tree, but it is necessary to pre-calculate all the one-time signature key pairs, and the authentication path is long, which leads to large key management overhead; another scheme is to combine the chameleon hash function with the Merkle tree to construct a chameleon authentication tree (CAT), and combine the chameleon authentication tree with the one-time signature scheme, but when adding a leaf node, it is necessary to traverse the entire path from the root node to the leaf node, and then generate the missing nodes and sibling nodes in the path, and then use the real leaf node to update from bottom to top until the chameleon hash node, the authentication path is still long, and the update operation overhead is also relatively large.

[0004] From the above, it can be seen that how to reduce the overhead of key management is a problem to be solved in this field. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a key management method, device, equipment and medium to reduce the overhead of key management. The specific scheme is as follows:

[0006] In a first aspect, the present application discloses a key management method, comprising:

[0007] Signing the message to be signed using the private key in the one-time signing key pair to obtain a first digital signature;

[0008] Obtain a previous Chameleon-Shrubs authentication tree including a previous Chameleon Shrubs tree and a Shrubs node authentication tree; wherein the topmost node of the Shrubs node authentication tree is a verification root node obtained based on the Shrubs nodes of each layer in the previous Chameleon Shrubs tree;

[0009] Determine a target empty node from the previous Chameleon Shrubs tree, write the public key in the primary signature key pair into the target empty node, and determine a target Shrubs node corresponding to the target empty node in the previous Chameleon Shrubs tree;

[0010] Determine an updated random number of the target Shrubs node using a trapdoor key of a chameleon hash function and an updated message value of the target Shrubs node, and use the updated random number to update the structure of the previous Chameleon-Shrubs authentication tree to obtain a current Chameleon-Shrubs authentication tree, keeping the multi-signature public key of the previous Chameleon-Shrubs authentication tree consistent with the multi-signature public key of the current Chameleon-Shrubs authentication tree;

[0011] A message signature pair is obtained based on the authentication path from the target empty node to the verification root node generated according to the current Chameleon-Shrubs authentication tree, the first digital signature, the public key in the one-time signature key pair, and the message to be signed, so as to verify the message signature pair using the multiple-signature public key to obtain a verification result.

[0012] Optionally, obtain an initial Chameleon-Shrubs certified tree, including:

[0013] Generate a trapdoor key and a hash key of the Chameleon hash function using preset security parameters;

[0014] Constructing an initial chameleon Shrubs tree based on a preset depth, and initializing the leftmost node of each layer in the initial chameleon Shrubs tree using the hash key to obtain each chameleon hash node, and determining each chameleon hash node as a Shrubs node corresponding to each layer in the initial chameleon Shrubs tree;

[0015] The Shrubs nodes corresponding to each layer in the initial Chameleon Shrubs tree are taken as leaf nodes, and a Shrubs node authentication tree is constructed; wherein the topmost node of the Shrubs node authentication tree is a verification root node obtained based on each Shrubs node in the initial Chameleon Shrubs tree;

[0016] An initial Chameleon-Shrubs authentication tree is obtained based on each Shrubs node in the initial Chameleon-Shrubs tree, the Shrubs node authentication tree, the value of the initialized counter, and the initialized tree capacity.

[0017] Optionally, the key management method further includes:

[0018] The initial Chameleon-Shrubs authentication tree and the trapdoor key are used to form a multi-signature private key of the initial Chameleon-Shrubs authentication tree, and the root node of the initial Chameleon-Shrubs authentication tree and the hash key are used to form a multi-signature public key of the initial Chameleon-Shrubs authentication tree, and the multi-signature public key of the initial Chameleon-Shrubs authentication tree is stored in a verification root node; wherein the multi-signature public key of the initial Chameleon-Shrubs authentication tree corresponds to the public key in each one-time signature key pair stored in the initial Chameleon Shrubs tree.

[0019] Optionally, determining a target empty node from the previous Chameleon Shrubs tree includes:

[0020] Determine whether the value of the previous counter is equal to the initialized tree capacity, if the value of the previous counter is not equal to the initialized tree capacity, determine the target empty node from the previous Chameleon Shrubs tree;

[0021] Correspondingly, after determining the updated random number of the target Shrubs node by using the trapdoor key of the chameleon hash function and the updated message value of the target Shrubs node, the method further includes:

[0022] The value of the previous counter is increased to obtain the value of the current counter.

[0023] Optionally, determining a target Shrubs node corresponding to the target empty node in the previous Chameleon Shrubs tree includes:

[0024] If the target empty node is a Shrubs node of the layer, the target empty node is determined to be a target Shrubs node corresponding to the target empty node in the previous Chameleon Shrubs tree, and the public key in the one-time signature key pair stored in the target Shrubs node is determined as the updated message value of the target Shrubs node;

[0025] If the target empty node is not a Shrubs node of the layer, then based on the target empty node, trace back upward in the previous Chameleon Shrubs tree to determine the target Shrubs node corresponding to the target empty node and the traceback node passed when tracing back upward, determine the hash value of the traceback node, and use the hash value of the traceback node to determine the updated message value of the target Shrubs node;

[0026] Accordingly, the method of determining the updated random number of the target Shrubs node by using the trapdoor key of the chameleon hash function and the updated message value of the target Shrubs node includes:

[0027] The updated random number of the target Shrubs node is determined using the trapdoor key of the chameleon hash function, the updated message value of the target Shrubs node, the initial message value of the target Shrubs node, and the initial random number, and the index of the public key in the one-time signature key pair is set to the value of the previous counter.

[0028] Optionally, the acquiring a message signature pair based on the authentication path from the target empty node to the verification root node generated according to the current Chameleon-Shrubs authentication tree, the first digital signature, the public key in the one-time signature key pair, and the message to be signed includes:

[0029] Generate an authentication path from the target empty node to the verification root node according to the current Chameleon-Shrubs authentication tree, and generate a second digital signature using the authentication path and the index;

[0030] The target digital signature is obtained using the first digital signature, the second digital signature and the public key in the one-time signature key pair to obtain a message signature pair including the target digital signature and the message to be signed.

[0031] Optionally, the verifying the message signature pair using the multiple-signature public key to obtain a verification result includes:

[0032] The first digital signature and the message to be signed in the message signature pair are verified using the public key in the one-time signature key pair to obtain a first type of verification result. If the first type of verification result indicates that the verification is passed, the target digital signature in the message signature pair is verified using the multiple-time signature public key to obtain a second type of verification result.

[0033] In a second aspect, the present application discloses a key management device, comprising:

[0034] A digital signature module, used to sign the message to be signed using the private key in the primary signature key pair to obtain a first digital signature;

[0035] An authentication tree acquisition module, used to acquire a previous Chameleon-Shrubs authentication tree including a previous Chameleon Shrubs tree and a Shrubs node authentication tree; wherein the topmost node of the Shrubs node authentication tree is a verification root node acquired based on the Shrubs nodes of each layer in the previous Chameleon Shrubs tree;

[0036] A node determination module, used to determine a target empty node from the previous Chameleon Shrubs tree, write the public key in the primary signature key pair into the target empty node, and determine a target Shrubs node corresponding to the target empty node in the previous Chameleon Shrubs tree;

[0037] A structure update module, used to determine the updated random number of the target Shrubs node using the trapdoor key of the Chameleon hash function and the updated message value of the target Shrubs node, and to update the structure of the previous Chameleon-Shrubs authentication tree using the updated random number to obtain the current Chameleon-Shrubs authentication tree, and to keep the multi-signature public key of the previous Chameleon-Shrubs authentication tree consistent with the multi-signature public key of the current Chameleon-Shrubs authentication tree;

[0038] A signature verification module is used to obtain a message signature pair based on the authentication path from the target empty node to the verification root node generated according to the current Chameleon-Shrubs authentication tree, the first digital signature, the public key in the one-time signature key pair, and the message to be signed, so as to verify the message signature pair using the multiple-signature public key to obtain a verification result.

[0039] In a third aspect, the present application discloses an electronic device, comprising:

[0040] Memory, used to store computer programs;

[0041] The processor is used to execute the computer program to implement the steps of the key management method disclosed above.

[0042] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the aforementioned disclosed key management method are implemented.

[0043] The beneficial effects of the present application are as follows: the present application uses the private key in the one-time signature key pair to sign the message to be signed to obtain a first digital signature; obtains a previous chameleon-Shrubs authentication tree including a previous chameleon Shrubs tree and a Shrubs node authentication tree; wherein the topmost node of the Shrubs node authentication tree is a verification root node obtained based on the Shrubs nodes of each layer in the previous chameleon Shrubs tree; determines a target empty node from the previous chameleon Shrubs tree, and writes the public key in the one-time signature key pair into the target empty node, determines a target Shrubs node in the previous chameleon Shrubs tree corresponding to the target empty node; uses the trapdoor key of the chameleon hash function and the target S The updated random number of the target Shrubs node is determined based on the updated message value of the Shrubs node, and the structure of the previous Chameleon-Shrubs authentication tree is updated using the updated random number to obtain the current Chameleon-Shrubs authentication tree, keeping the multiple-signature public key of the previous Chameleon-Shrubs authentication tree consistent with the multiple-signature public key of the current Chameleon-Shrubs authentication tree; based on the authentication path from the target empty node to the verification root node generated according to the current Chameleon-Shrubs authentication tree, the first digital signature, the public key in the one-time signature key pair, and the message to be signed, a message signature pair is obtained, so as to verify the message signature pair using the multiple-signature public key to obtain a verification result.

[0044] It can be seen that the chameleon-Shrubs authentication tree of the present application includes a chameleon Shrubs tree and a Shrubs node authentication tree, and there are Shrubs nodes in each layer of the chameleon Shrubs tree. The topmost node of the Shrubs node authentication tree is a verification root node obtained based on the Shrubs nodes of each layer in the chameleon Shrubs tree, so that the chameleon-Shrubs authentication tree has collision resistance. After writing the public key in a signature key pair into the target empty node, when determining the target Shrubs node corresponding to the target empty node in the previous chameleon Shrubs tree, its average tracing path can be reduced. While keeping the hash value of the Shrubs node unchanged, the trapdoor key of the chameleon hash function and the updated message value of the target Shrubs node are used to determine the update of the target Shrubs node. After the random number, because of the anti-collision property of the Chameleon-Shrubs authentication tree, only the message value and the random number need to be updated, that is, the updated message value and the updated random number of the target Shrubs node are determined, so that the hash value of the target Shrubs node does not need to be changed, and then the multi-signature public key of the previous Chameleon-Shrubs authentication tree can still be consistent with the multi-signature public key of the current Chameleon-Shrubs authentication tree. That is to say, when adding a new one-time signature public key to the Chameleon Shrubs tree in the Chameleon-Shrubs authentication tree, only the message value and the random number of the target Shrubs node need to be updated, so that the multi-signature public key can also be used to verify the newly added one-time signature public key, and the average authentication path is reduced, and the overhead of the Chameleon-Shrubs authentication tree for managing the one-time signature public key is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0046] Figure 1 A specific Shrubs tree initialization state diagram disclosed in this application;

[0047] Figure 2 A specific leaf node adding process diagram disclosed in this application;

[0048] Figure 3 A specific corresponding relationship diagram disclosed in this application;

[0049] Figure 4 A flowchart of a key management method disclosed in this application;

[0050] Figure 5 A schematic diagram of a specific Chameleon Shrubs tree disclosed in this application;

[0051] Figure 6 A schematic diagram of a specific Shrubs node authentication tree disclosed in this application;

[0052] Figure 7 A specific public key writing schematic diagram disclosed in this application;

[0053] Figure 8 A schematic diagram of a specific Shrubs node authentication tree disclosed in this application;

[0054] Fig. 9 A schematic diagram of the structure of a key management device disclosed in this application;

[0055] Fig.10 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0057] A one-time signature is a special digital signature. Its basic idea is to use a one-way function to sign a message. Compared with the public key signature based on the trapdoor function, the generation and verification of a one-time signature is more efficient. However, a one-time signature will expose part of the private key during the signing process. Therefore, in order to ensure the security of the signature, each pair of keys can only be used once. Therefore, if different keys are generated for different messages, it will cause an excessive key management burden.

[0058] In order to reduce the space complexity of the one-time signature scheme and solve the problem of complex key management, one is an improved scheme based on the Merkle tree, but it is necessary to pre-calculate all the one-time signature key pairs, and the authentication path is long, which leads to large key management overhead; another scheme is to combine the chameleon hash function with the Merkle tree to construct a chameleon authentication tree (CAT), and combine the chameleon authentication tree with the one-time signature scheme, but when adding a leaf node, it is necessary to traverse the entire path from the root node to the leaf node, and then generate the missing nodes and sibling nodes in the path, and then use the real leaf node to update from bottom to top until the chameleon hash node, the authentication path is still long, and the update operation overhead is also relatively large.

[0059] To this end, the present application provides a key management solution to reduce the overhead of key management.

[0060] To facilitate understanding, the chameleon hash function and Shrubs tree involved in the key management scheme are first introduced.

[0061] The Chameleon hash function family includes three algorithms , the definition is as follows:

[0062] 1.1) The key generation function is: , enter security parameters , output hash key and trapdoor key ;

[0063] 1.2) Chameleon hash function is: , enter the hash key information Random Numbers , outputs a hash value with a fixed length ,in, , The message range and random number range are preset;

[0064] 1.3) The random number update function is: , enter the trapdoor key ,information Random Numbers Output , and satisfy ,

[0065] Based on the above, a secure chameleon hash function must satisfy the following two properties:

[0066] 1.1) Anti-collision: The adversary cannot obtain a given message without knowing the trapdoor key TK. , random number , output random number satisfy The probability of is negligible, that is, by updating the message and the random number, the same hash value can be obtained, that is, the hash value can be kept unchanged;

[0067] 1.2) Semantic security: for any message , hash value and The probability distribution of is computationally indistinguishable. In particular, for a randomly chosen , cannot be obtained from the hash value Get any information about information.

[0068] Furthermore, the Shrubs tree is a variant of the Merkle tree and has the following characteristics:

[0069] 2.1) Use a series of Shrubs nodes to "represent" the entire tree: Unlike the Merkle tree, the Shrubs tree does not use only one root node to "represent" the entire tree, but selects a node (called a Shrubs node) at each level to "represent" the entire tree. Assuming there is a Shrubs tree with a depth of D, D Shrubs nodes are required as subtree root nodes. These subtree roots can represent a complete Merkle tree (uniqueness) and can cover all the added leaf nodes. Among them, the Shrub node is the root of the rightmost complete subtree of the layer, that is, the Shrub node is the left neighbor node of the rightmost node of the layer.

[0070] 2.2) Storage update when adding a leaf node is O(1): When adding a leaf node, the hash value is calculated upward until the subtree root closest to the leaf node, and then the subtree root node is updated to the Shrub node of the layer. In this way, each time a leaf node is added, only one Shrubs node needs to be updated.

[0071] 2.3) Shorter certification path: To prove whether a leaf node is on the Shrubs tree, it is only necessary to provide the certification path of the subtree closest to the leaf node.

[0072] Below, take a Shrubs tree with depth D=4 as an example:

[0073] For example Figure 1 A specific Shrubs tree initialization state diagram shown in FIG. uses an empty node to initialize the Shrubs node. Figure 1 The green nodes in the figure are initialized Shrubs nodes, a total of 4, and the remaining gray nodes are empty nodes, that is, they do not exist in the initialized state.

[0074] For example Figure 2 A specific leaf node adding process diagram is shown in the figure. A total of 8 leaf nodes are added. Each time a leaf node is added, a subtree root node (Shrubs node) closest to the leaf node is updated. As leaf nodes are added, Figure 2The empty leaf nodes in medium gray gradually turn black, while the purple ones are the corresponding and updated Shrubs nodes, the green ones are the unupdated Shrubs nodes, and the orange lines are the traceback paths, that is, the traceback paths from the leaf nodes to the Shrubs nodes. Specifically, if the left leaf node is added, the added position is the subtree root, which can be updated; if the right leaf node is added, it is traced back to the left node, and then the Shrubs node is updated.

[0075] For example Figure 3 The specific correspondence diagram shown in Figure 1 represents the correspondence relationship of updating Shrubs nodes in the process of adding leaf nodes to the Shrubs tree. It can be seen that the left node of each layer will be updated once and only once. Therefore, the average update path length AvePathLen is:

[0076] ;

[0077] For the certification path, we only need to find the certification path of the Shrubs node closest to the leaf node. Therefore, if the certification path of the leaf node is given immediately after it is added, the average certification path length is Because the verification root node (Shrubs node) is not included in the authentication path, it is one less than the traditional update path.

[0078] Specifically, Table 1 gives the comparison between Shrubs tree and Merkle tree. It can be seen that Shrubs tree has obvious advantages in terms of update overhead and authentication path. However, it should be noted that Shrubs tree requires D subtree root nodes to represent the entire tree, while Merkle tree only requires 1 root node.

[0079] Table 1

[0080]

[0081] See also Figure 4 As shown, the embodiment of the present application discloses a key management method, including:

[0082] Step S11: Use the private key in the one-time signature key pair to sign the message to be signed to obtain a first digital signature.

[0083] make For a one-time signature scheme, first use the one-time signature key pair to generate the algorithm Generate a one-time signing key pair: ,in, is the private key in a signature key pair. is the public key in a signature key pair, Represents the security parameter, and then uses Sign the message m to be signed and obtain the first digital signature , the formula is .

[0084] Step S12: obtaining a previous Chameleon-Shrubs authentication tree including a previous Chameleon Shrubs tree and a Shrubs node authentication tree; wherein the topmost node of the Shrubs node authentication tree is a verification root node obtained based on the Shrubs nodes of each layer in the previous Chameleon Shrubs tree.

[0085] In this embodiment, obtaining an initial chameleon-Shrubs authentication tree includes: using preset security parameters to generate a trapdoor key and a hash key of a chameleon hash function; constructing an initial chameleon Shrubs tree based on a preset depth, and using the hash key to initialize the leftmost node of each layer in the initial chameleon Shrubs tree to obtain each chameleon hash node, and determining each chameleon hash node as a Shrubs node corresponding to each layer in the initial chameleon Shrubs tree; using the Shrubs nodes corresponding to each layer in the initial chameleon Shrubs tree as leaf nodes, and constructing a Shrubs node authentication tree; wherein the topmost node of the Shrubs node authentication tree is a verification root node obtained based on each Shrubs node in the initial chameleon Shrubs tree; and obtaining the initial chameleon-Shrubs authentication tree based on each Shrubs node in the initial chameleon Shrubs tree, the Shrubs node authentication tree, the value of the initialized counter, and the initialized tree capacity.

[0086] Chameleon Shrubs Tree (CST) introduces chameleon hash nodes into the Shrubs tree, so that the final number of verification root nodes is only 1. The specific construction is as follows:

[0087] 1) For example Figure 5 A specific Chameleon Shrubs tree schematic diagram is shown, firstly, D Chameleon hash nodes are generated as Shrubs nodes, and a Chameleon Shrubs tree is obtained, so that the value in the Shrubs node is no longer a common hash value, but a Chameleon hash value, and a Chameleon Shrubs tree is obtained;

[0088] 2) For example Figure 6A specific Shrubs node authentication tree diagram is shown in FIG. D Shrubs nodes are used as leaf nodes to construct a Shrubs node authentication tree (SNAT). The root node of the tree is then used as the verification root node of CSAT, so that the number of final verification root nodes is reduced from D to 1. In this way, the authentication path will increase. ;

[0089] Therefore, the Chameleon-Shrubs Authentication Tree (CSAT) is composed of a Chameleon Shrubs Tree (CST) and a Shrubs Node Authentication Tree (SNAT). ,Right now , multiple signature private key , multiple signature public key , that is, input security parameters And the depth of the tree D, output the public key of the Chameleon Shrubs authentication tree and the private key of the Chameleon Shrubs authentication tree , the process of obtaining the initial Chameleon-Shrubs certification tree is as follows:

[0090] 1) Generate a public and private key pair for the Chameleon hash function ;

[0091] 2) Initialize D chameleon hash nodes as Shrubs nodes, that is ,in, ; Randomly select a message from a pre-set message range , select a random number from a pre-set random number range ;

[0092] 3) Take D Shrubs nodes as leaf nodes and build a tree with the same height as The relevant Shrubs node Merkle tree (SNMT), the root node is denoted as root;

[0093] 4) Initialize the database storing data to empty DB←NULL;

[0094] 5) Set the initialization counter value n to 0, and the initialization tree capacity to ;

[0095] 6) Add the Shrubs node, SNMT,n,capaticy to the CSAT structure, i.e. Thus, the initial Chameleon-Shrubs authentication tree is obtained, and the root node root is the verification root node of the Shrubs node authentication tree.

[0096] This embodiment also includes: using the initial Chameleon-Shrubs authentication tree and the trapdoor key to form a multiple-signature private key of the initial Chameleon-Shrubs tree, and using the root node of the initial Chameleon-Shrubs authentication tree and the hash key to form a multiple-signature public key of the initial Chameleon-Shrubs authentication tree, and storing the multiple-signature public key of the initial Chameleon-Shrubs authentication tree in the verification root node; wherein the multiple-signature public key of the initial Chameleon-Shrubs authentication tree corresponds to the public key in each one-time signature key pair stored in the initial Chameleon Shrubs tree. After obtaining the initial Chameleon-Shrubs authentication tree, the multiple-signature private key of the initial Chameleon-Shrubs tree is generated using the initial Chameleon-Shrubs authentication tree and the trapdoor key, that is, , and then use the root node and hash key of the initial Chameleon-Shrubs authentication tree to generate the multiple signature public key of the initial Chameleon-Shrubs authentication tree, that is, , in this way, the public and private key pairs of the Chameleon-Shrubs authentication tree can be generated It should be noted that the multi-signature public key of the initial Chameleon-Shrubs authentication tree corresponds to the public key in each one-time signature key pair stored in the initial Chameleon Shrubs tree. That is to say, the multi-signature public key in this embodiment can be used multiple times and can correspond to different one-time signature public keys.

[0097] It is understandable that after obtaining the initial Chameleon-Shrubs authentication tree, if the public key in a signature key pair needs to be written into the initial Chameleon-Shrubs authentication tree, the initial Chameleon-Shrubs authentication tree will be used as the previous Chameleon-Shrubs authentication tree, and the initial Chameleon Shrubs tree and the Shrubs node authentication tree will be used as the previous Chameleon Shrubs tree and the Shrubs node authentication tree respectively.

[0098] Step S13: determining a target empty node from the previous Chameleon Shrubs tree, and writing the public key in the one-time signature key pair into the target empty node, and determining a target Shrubs node corresponding to the target empty node in the previous Chameleon Shrubs tree.

[0099] In this embodiment, the target empty node is determined from the previous Chameleon Shrubs tree, including: judging whether the value of the previous counter is equal to the tree capacity after the initialization, and if the value of the previous counter is not equal to the tree capacity after the initialization, then the target empty node is determined from the previous Chameleon Shrubs tree. First, it is determined whether n==capacity is established, that is, whether the tree capacity of the previous Chameleon Shrubs tree is full, that is, whether there are still empty leaf nodes in the previous Chameleon Shrubs tree for storing the one-time signature public key. If it is established, it indicates that there are no empty leaf nodes, so the public key writing process is exited. If it is not established, it indicates that there are empty leaf nodes for storing the one-time signature public key, and then the target empty node is determined from the previous Chameleon Shrubs tree, and the target empty node is the right neighbor empty leaf node of the leaf node that has stored the public key in each leaf node.

[0100] In this embodiment, determining the target Shrubs node corresponding to the target empty node in the previous chameleon Shrubs tree includes: if the target empty node is a Shrubs node of the layer, determining the target empty node as the target Shrubs node corresponding to the target empty node in the previous chameleon Shrubs tree, and determining the public key in the one-time signature key pair stored in the target Shrubs node as the updated message value of the target Shrubs node; if the target empty node is not a Shrubs node of the layer, tracing back upward in the previous chameleon Shrubs tree based on the target empty node to determine the target Shrubs node corresponding to the target empty node and the tracing nodes passed when tracing back upward, determining the hash value of the tracing node, and using the hash value of the tracing node to determine the updated message value of the target Shrubs node.

[0101] In a specific case of determining a target Shrubs node, if the target empty node is a Shrubs node of the same layer, that is, if the target empty node itself is a Shrubs node, there is no need to trace back to the Shrubs node. The target empty node can be directly determined as the target Shrubs node corresponding to the target empty node in the previous Chameleon Shrubs tree, and the public key in the one-time signature key pair stored in the target Shrubs node is determined as the updated message value of the target Shrubs node. .

[0102] In the second specific case of determining the target Shrubs node, if the target empty node is not the Shrubs node of the layer, then based on the target empty node, trace back in the previous Chameleon Shrubs tree to determine the target Shrubs node corresponding to the target empty node and the traceback node passed when tracing back, determine the hash value of the traceback node, and use the hash value of the traceback node to determine the updated message value of the target Shrubs node ,For example Figure 7 A specific public key writing schematic diagram is shown, the previous Chameleon Shrubs tree has a depth of 4 and nodes 6, 10, 12 and 14 are Shrubs nodes of the layer, where node 7 is the target empty node. Since node 7 is not the Shrubs node of the layer, it is necessary to trace back upward to determine the target Shrubs node corresponding to the target empty node. It can be understood that node 14 is the target Shrubs node corresponding to the target empty node 7. The traced nodes passed through during the traceback are nodes 11 and 13, and the updated message value of node 14 is Need to use traceability node 13 The hash value of can be determined, that is .

[0103] Step S14: Determine the updated random number of the target Shrubs node using the trapdoor key of the Chameleon hash function and the updated message value of the target Shrubs node, and use the updated random number to update the structure of the previous Chameleon-Shrubs authentication tree to obtain the current Chameleon-Shrubs authentication tree, keeping the multi-signature public key of the previous Chameleon-Shrubs authentication tree consistent with the multi-signature public key of the current Chameleon-Shrubs authentication tree.

[0104] In this embodiment, the updated random number of the target Shrubs node is determined by using the trapdoor key of the chameleon hash function and the updated message value of the target Shrubs node, including: using the trapdoor key of the chameleon hash function, the updated message value of the target Shrubs node, the initial message value of the target Shrubs node, and the initial random number to determine the updated random number of the target Shrubs node, and setting the index of the public key in the one-time signature key pair to the value of the previous counter.

[0105] It is understandable that the update function based on the random number It can be seen that the updated random number of node 14 can use the trapdoor key of the chameleon hash function , the updated message value of the target Shrubs node 14 , the initial message value of the target Shrubs node 14 , initial random number To determine, ,Right now , so that the multi-signature public key of the previous Chameleon-Shrubs authentication tree can be kept consistent with the multi-signature public key of the current Chameleon-Shrubs authentication tree. After the random number is updated, the index of the public key in the signature key pair is set to the value of the previous counter, that is, the index of data in the tree is set , add the public key data to the database DB.

[0106] In this embodiment, after determining the updated random number of the target Shrubs node using the trapdoor key of the Chameleon hash function and the updated message value of the target Shrubs node, it also includes: increasing the value of the previous counter to obtain the value of the current counter. Because the counter can represent the current capacity of the tree, that is, the number of one-time signature public keys currently stored in the Chameleon Shrubs tree, when adding a one-time signature public key again, it is necessary to increase the previous counter by 1, that is, if it is the first time to add a public key, then .

[0107] Use the updated random number to update the structure of the previous Chameleon-Shrubs authentication tree to obtain the current Chameleon-Shrubs authentication tree The update content specifically includes the random numbers of leaf nodes, intermediate hash nodes, and chameleon hash nodes, and then uses the current chameleon-Shrubs authentication tree Update the multi-signature private key of the Chameleon-Shrubs authentication tree , specifically .

[0108] Step S15: Obtain a message signature pair based on the authentication path from the target empty node to the verification root node generated according to the current Chameleon-Shrubs authentication tree, the first digital signature, the public key in the one-time signature key pair, and the message to be signed, so as to verify the message signature pair using the multiple-signature public key to obtain a verification result.

[0109] In this embodiment, the method of obtaining a message signature pair based on the authentication path from the target empty node to the verification root node generated according to the current Chameleon-Shrubs authentication tree, the first digital signature, the public key in the one-time signature key pair, and the message to be signed includes: generating an authentication path from the target empty node to the verification root node according to the current Chameleon-Shrubs authentication tree, and generating a second digital signature using the authentication path and the index; obtaining a target digital signature using the first digital signature, the second digital signature, and the public key in the one-time signature key pair, so as to obtain a message signature pair including the target digital signature and the message to be signed. Generate a certification path from the target empty node to the verification root node , it can be seen that the public key in the signature key pair is Add to Chameleon-Shrubs authentication tree, and finally output index , updated multi-signature key And the certification path ,Right now ,

[0110] For example Figure 8 A specific Shrubs node authentication tree diagram is shown in FIG. 1 . The authentication path from the target empty node 7 to the verification root node first includes the path from the target empty node 7 to the target Shrubs node 14, and then from the node 14 to the verification root node 17. Therefore, the authentication path is , output the index of the data, the updated multi-signature private key, and the authentication path . Further, using the certification path and index Generate a second digital signature ,Right now ; This can be completed , that is, using the first digital signature , Second digital signature and the public key in a signing key pair Get the target digital signature ,Right now , to get the target digital signature and the message to be signed The message signature pair .

[0111] In this embodiment, the verification of the message signature pair using the multiple-signature public key to obtain the verification result includes: using the public key in the one-time signature key pair to verify the first digital signature in the message signature pair and the message to be signed to obtain a first type of verification result; if the first type of verification result indicates that the verification is passed, then using the multiple-signature public key to verify the target digital signature in the message signature pair to obtain a second type of verification result. In the process of verifying the message signature pair using the multiple-signature public key to obtain the verification result ( ), which is mainly divided into two categories of verification. First, the public key in the signature key pair is used The first digital signature in a message signature pair Verify, 0 / 1 ; Secondly, run the CSAT verification algorithm and use the multiple signature public key to verify the target digital signature in the message signature pair to obtain the second type of verification result, that is, ,verify Is this the first in the current Chameleon-Shrubs authentication tree? If both of the above verifications are passed, the output is 1, otherwise it is 0. Further, the verification algorithm of CSAT is as follows:

[0112] 1) Verify the first Whether the element is a public key in a signature key pair ;

[0113] 2) If yes, use and Calculate the verification root node hash value , determine the calculated hash value Is it equal to ; Figure 7 and Figure 8 Taking the target empty node 7 as an example, the authentication path is First, use the public key in the signature key pair to calculate Calculate , then calculate the hash value of Chameleon Hash Node 14 ,Right now , reuse Calculate the verification root node hash value ,determination Is it equal to If they are equal, the verification is passed, that is, the output is 1. If they are not equal, it means that the verification fails, that is, the output is 0.

[0114] It can be seen that the chameleon-Shrubs authentication tree of the present application includes a chameleon Shrubs tree and a Shrubs node authentication tree, and there are Shrubs nodes in each layer of the chameleon Shrubs tree. The topmost node of the Shrubs node authentication tree is a verification root node obtained based on the Shrubs nodes of each layer in the chameleon Shrubs tree, so that the chameleon-Shrubs authentication tree has collision resistance. After writing the public key in a signature key pair into the target empty node, when determining the target Shrubs node corresponding to the target empty node in the previous chameleon Shrubs tree, its average tracing path can be reduced. While keeping the hash value of the Shrubs node unchanged, the trapdoor key of the chameleon hash function and the updated message value of the target Shrubs node are used to determine the update of the target Shrubs node. After the random number, because of the anti-collision property of the Chameleon-Shrubs authentication tree, only the message value and the random number need to be updated, that is, the updated message value and the updated random number of the target Shrubs node are determined, so that the hash value of the target Shrubs node does not need to be changed, and then the multi-signature public key of the previous Chameleon-Shrubs authentication tree can still be consistent with the multi-signature public key of the current Chameleon-Shrubs authentication tree. That is to say, when adding a new one-time signature public key to the Chameleon Shrubs tree in the Chameleon-Shrubs authentication tree, only the message value and the random number of the target Shrubs node need to be updated, so that the multi-signature public key can also be used to verify the newly added one-time signature public key, and the average authentication path is reduced, and the overhead of the Chameleon-Shrubs authentication tree for managing the one-time signature public key is reduced.

[0115] The Chameleon Shrubs authentication tree includes a Chameleon Shrubs tree and a Shrubs node authentication tree. Specifically, the Shrubs nodes in the Shrubs tree are replaced with Chameleon hash nodes to obtain a Chameleon Shrubs tree, and then these Chameleon hash nodes are used as leaf nodes to construct a Shrubs node authentication tree. Finally, the Chameleon Shrubs authentication tree consists of a Chameleon Shrubs tree and a Shrubs node authentication tree, and the root node of the Shrubs node authentication tree is used as the verification root node of the Chameleon Shrubs authentication tree; the Chameleon Shrubs authentication tree is used to dynamically and boundedly manage the one-time signature key, and the public key of the one-time signature is used as a leaf node. When the tree scale is determined, leaf nodes can be dynamically added. The comparison between the Chameleon Shrubs authentication tree and the Chameleon authentication tree is shown in Table 2:

[0116] Table 2

[0117]

[0118] According to Table 2, CSAT and CAT are comparable in terms of the number of verification root nodes, capacity, average update path length, and the number of chameleon hash collisions calculated during each update. Chameleon hash nodes are generated, while CSAT only needs to generate D chameleon hash nodes, so the cost of CSAT generating the entire tree will be smaller; in addition, the average authentication path length of CSAT is only logarithmically related to the depth, while CAT is linearly related, so CSAT has an absolute advantage in authentication path length. Therefore, this embodiment optimizes the authentication path of the leaf node, so that the average authentication path length is only logarithmically related to the depth of the tree, rather than a linear growth relationship; further, when adding a leaf node, there is no need to "generate first and then update", so the cost of generating the entire tree is smaller, and the update cost is only, and the average update path length is close to 2.

[0119] See also Fig. 9 As shown, the embodiment of the present application discloses a key management device, including:

[0120] A digital signature module 11, configured to sign a message to be signed using a private key in a primary signature key pair to obtain a first digital signature;

[0121] The authentication tree acquisition module 12 is used to acquire a previous Chameleon-Shrubs authentication tree including a previous Chameleon Shrubs tree and a Shrubs node authentication tree; wherein the topmost node of the Shrubs node authentication tree is a verification root node acquired based on the Shrubs nodes of each layer in the previous Chameleon Shrubs tree;

[0122] A node determination module 13 is used to determine a target empty node from the previous Chameleon Shrubs tree, write the public key in the primary signature key pair into the target empty node, and determine a target Shrubs node corresponding to the target empty node in the previous Chameleon Shrubs tree;

[0123] A structure updating module 14 is used to determine the updated random number of the target Shrubs node using the trapdoor key of the chameleon hash function and the updated message value of the target Shrubs node, and to update the structure of the previous Chameleon-Shrubs authentication tree using the updated random number to obtain the current Chameleon-Shrubs authentication tree, and to keep the multiple signature public key of the previous Chameleon-Shrubs authentication tree consistent with the multiple signature public key of the current Chameleon-Shrubs authentication tree;

[0124] The signature verification module 15 is used to obtain a message signature pair based on the authentication path from the target empty node to the verification root node generated according to the current Chameleon-Shrubs authentication tree, the first digital signature, the public key in the one-time signature key pair, and the message to be signed, so as to verify the message signature pair using the multiple-signature public key to obtain a verification result.

[0125] It can be seen that the chameleon-Shrubs authentication tree of the present application includes a chameleon Shrubs tree and a Shrubs node authentication tree, and there are Shrubs nodes in each layer of the chameleon Shrubs tree. The topmost node of the Shrubs node authentication tree is a verification root node obtained based on the Shrubs nodes of each layer in the chameleon Shrubs tree, so that the chameleon-Shrubs authentication tree has collision resistance. After writing the public key in a signature key pair into the target empty node, when determining the target Shrubs node corresponding to the target empty node in the previous chameleon Shrubs tree, its average tracing path can be reduced. While keeping the hash value of the Shrubs node unchanged, the trapdoor key of the chameleon hash function and the updated message value of the target Shrubs node are used to determine the update of the target Shrubs node. After the random number, because of the anti-collision property of the Chameleon-Shrubs authentication tree, only the message value and the random number need to be updated, that is, the updated message value and the updated random number of the target Shrubs node are determined, so that the hash value of the target Shrubs node does not need to be changed, and then the multi-signature public key of the previous Chameleon-Shrubs authentication tree can still be consistent with the multi-signature public key of the current Chameleon-Shrubs authentication tree. That is to say, when adding a new one-time signature public key to the Chameleon Shrubs tree in the Chameleon-Shrubs authentication tree, only the message value and the random number of the target Shrubs node need to be updated, so that the multi-signature public key can also be used to verify the newly added one-time signature public key, and the average authentication path is reduced, and the overhead of the Chameleon-Shrubs authentication tree for managing the one-time signature public key is reduced.

[0126] Furthermore, an embodiment of the present application also provides an electronic device. Fig.10 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be considered as any limitation on the scope of use of the present application.

[0127] Fig.10A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Specifically, it may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the key management method performed by the electronic device disclosed in any of the aforementioned embodiments.

[0128] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device; the communication interface 24 can create a data transmission channel between the electronic device and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0129] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0130] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon include an operating system 221, a computer program 222 and data 223, etc. The storage method can be temporary storage or permanent storage.

[0131] Among them, the operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device to realize the operation and processing of the massive data 223 in the memory 22 by the processor 21, which can be Windows, Unix, Linux, etc. In addition to including a computer program that can be used to complete the key management method performed by the electronic device disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks. In addition to data transmitted from an external device received by the electronic device, the data 223 can also include data collected by its own input and output interface 25.

[0132] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed key management method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0133] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0134] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. The steps of the method or algorithm described in conjunction with the embodiments disclosed herein can be implemented directly with hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory (RAM), memory, read-only memory (ROM), electrically programmable EPROM (Erasable Programmable Read Only Memory), electrically erasable programmable EEPROM (Electrically Erasable Programmable read only memory), register, hard disk, removable disk, CD-ROM (Compact Disc Read-Only Memory), or any other form of storage medium known in the technical field.

[0135] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0136] The key management method, device, equipment and medium provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A key management method, characterized in that: include: Signing the message to be signed using the private key in the one-time signing key pair to obtain a first digital signature; Obtain a previous Chameleon-Shrubs authentication tree including a previous Chameleon Shrubs tree and a Shrubs node authentication tree; wherein the topmost node of the Shrubs node authentication tree is a verification root node obtained based on the Shrubs nodes of each layer in the previous Chameleon Shrubs tree; Determine a target empty node from the previous Chameleon Shrubs tree, write the public key in the primary signature key pair into the target empty node, and determine a target Shrubs node corresponding to the target empty node in the previous Chameleon Shrubs tree; Determine an updated random number of the target Shrubs node using a trapdoor key of a chameleon hash function and an updated message value of the target Shrubs node, and use the updated random number to update the structure of the previous Chameleon-Shrubs authentication tree to obtain a current Chameleon-Shrubs authentication tree, keeping the multi-signature public key of the previous Chameleon-Shrubs authentication tree consistent with the multi-signature public key of the current Chameleon-Shrubs authentication tree; A message signature pair is obtained based on the authentication path from the target empty node to the verification root node generated according to the current Chameleon-Shrubs authentication tree, the first digital signature, the public key in the one-time signature key pair, and the message to be signed, so as to verify the message signature pair using the multiple-signature public key to obtain a verification result.

2. The key management method according to claim 1, characterized in that: Get your initial Chameleon-Shrubs certified tree, including: Generate a trapdoor key and a hash key of the Chameleon hash function using preset security parameters; Constructing an initial chameleon Shrubs tree based on a preset depth, and initializing the leftmost node of each layer in the initial chameleon Shrubs tree using the hash key to obtain each chameleon hash node, and determining each chameleon hash node as a Shrubs node corresponding to each layer in the initial chameleon Shrubs tree; The Shrubs nodes corresponding to each layer in the initial Chameleon Shrubs tree are taken as leaf nodes, and a Shrubs node authentication tree is constructed; wherein the topmost node of the Shrubs node authentication tree is a verification root node obtained based on each Shrubs node in the initial Chameleon Shrubs tree; An initial Chameleon-Shrubs authentication tree is obtained based on each Shrubs node in the initial Chameleon-Shrubs tree, the Shrubs node authentication tree, the value of the initialized counter, and the initialized tree capacity.

3. The key management method according to claim 2, characterized in that: Also includes: The initial Chameleon-Shrubs authentication tree and the trapdoor key are used to form a multi-signature private key of the initial Chameleon-Shrubs authentication tree, and the root node of the initial Chameleon-Shrubs authentication tree and the hash key are used to form a multi-signature public key of the initial Chameleon-Shrubs authentication tree, and the multi-signature public key of the initial Chameleon-Shrubs authentication tree is stored in a verification root node; wherein the multi-signature public key of the initial Chameleon-Shrubs authentication tree corresponds to the public key in each one-time signature key pair stored in the initial Chameleon Shrubs tree.

4. The key management method according to claim 2, characterized in that: Determining a target empty node from the previous Chameleon Shrubs tree includes: Determine whether the value of the previous counter is equal to the initialized tree capacity, if the value of the previous counter is not equal to the initialized tree capacity, determine the target empty node from the previous Chameleon Shrubs tree; Correspondingly, after determining the updated random number of the target Shrubs node by using the trapdoor key of the chameleon hash function and the updated message value of the target Shrubs node, the method further includes: The value of the previous counter is increased to obtain the value of the current counter.

5. The key management method according to claim 4, characterized in that: The determining of the target Shrubs node corresponding to the target empty node in the previous Chameleon Shrubs tree includes: If the target empty node is a Shrubs node of the layer, the target empty node is determined to be a target Shrubs node corresponding to the target empty node in the previous Chameleon Shrubs tree, and the public key in the one-time signature key pair stored in the target Shrubs node is determined as the updated message value of the target Shrubs node; If the target empty node is not a Shrubs node of the layer, then based on the target empty node, trace back upward in the previous Chameleon Shrubs tree to determine the target Shrubs node corresponding to the target empty node and the traceback node passed when tracing back upward, determine the hash value of the traceback node, and use the hash value of the traceback node to determine the updated message value of the target Shrubs node; Accordingly, the method of determining the updated random number of the target Shrubs node by using the trapdoor key of the chameleon hash function and the updated message value of the target Shrubs node includes: The updated random number of the target Shrubs node is determined using the trapdoor key of the chameleon hash function, the updated message value of the target Shrubs node, the initial message value of the target Shrubs node, and the initial random number, and the index of the public key in the one-time signature key pair is set to the value of the previous counter.

6. The key management method according to claim 5, characterized in that: The method of obtaining a message signature pair based on the authentication path from the target empty node to the verification root node generated according to the current Chameleon-Shrubs authentication tree, the first digital signature, the public key in the one-time signature key pair, and the message to be signed includes: Generate an authentication path from the target empty node to the verification root node according to the current Chameleon-Shrubs authentication tree, and generate a second digital signature using the authentication path and the index; The target digital signature is obtained using the first digital signature, the second digital signature and the public key in the one-time signature key pair to obtain a message signature pair including the target digital signature and the message to be signed.

7. The key management method according to claim 6, characterized in that: The verifying the message signature pair using the multiple signature public key to obtain a verification result includes: The first digital signature and the message to be signed in the message signature pair are verified using the public key in the one-time signature key pair to obtain a first type of verification result. If the first type of verification result indicates that the verification is passed, the target digital signature in the message signature pair is verified using the multiple-time signature public key to obtain a second type of verification result.

8. A key management device, characterized in that: include: A digital signature module, used to sign the message to be signed using the private key in the primary signature key pair to obtain a first digital signature; An authentication tree acquisition module, used to acquire a previous Chameleon-Shrubs authentication tree including a previous Chameleon Shrubs tree and a Shrubs node authentication tree; wherein the topmost node of the Shrubs node authentication tree is a verification root node acquired based on the Shrubs nodes of each layer in the previous Chameleon Shrubs tree; A node determination module, used to determine a target empty node from the previous Chameleon Shrubs tree, write the public key in the primary signature key pair into the target empty node, and determine a target Shrubs node corresponding to the target empty node in the previous Chameleon Shrubs tree; A structure update module, used to determine the updated random number of the target Shrubs node using the trapdoor key of the Chameleon hash function and the updated message value of the target Shrubs node, and to update the structure of the previous Chameleon-Shrubs authentication tree using the updated random number to obtain the current Chameleon-Shrubs authentication tree, and to keep the multi-signature public key of the previous Chameleon-Shrubs authentication tree consistent with the multi-signature public key of the current Chameleon-Shrubs authentication tree; A signature verification module is used to obtain a message signature pair based on the authentication path from the target empty node to the verification root node generated according to the current Chameleon-Shrubs authentication tree, the first digital signature, the public key in the one-time signature key pair, and the message to be signed, so as to verify the message signature pair using the multiple-signature public key to obtain a verification result.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the steps of the key management method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program; wherein, when the computer program is executed by a processor, the steps of the key management method according to any one of claims 1 to 7 are implemented.

Images