Threshold ring signature method and device, equipment and storage medium

Abstract

The invention discloses a threshold ring signature method and device, equipment and a storage medium, and relates to the technical field of information security, and the method comprises the steps: generating a first signature part parameter corresponding to each signature ring member based on a first random number corresponding to each signature ring member, generating a second signature part parameter and a first signature verification parameter corresponding to each non-signature ring member based on the second random number corresponding to each non-signature ring member; acquiring a third random number corresponding to each signature ring member, and generating a verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature partial parameter and the first signature verification parameter; and determining a corresponding target polynomial by using a preset interpolation method and the verification parameter hash value, and determining a third signature part parameter corresponding to each signature ring member, so as to form a corresponding threshold ring signature based on the first signature part parameter, the second signature part parameter, the third signature part parameter and the target polynomial. In this way, a deniable ring signature value can be generated.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a threshold ring signature method, device, equipment and storage medium. Background Art

[0002] Ring signature is a cryptographic technology that can hide the identity of the signer. After the ring members generate the signature, the verifier only knows that the signature comes from this ring, but does not know who the real signer is. Ring signatures are widely used in privacy protection scenarios where identity privacy is required. Among the existing related schemes, the unilateral ring signature mechanism, threshold ring signature mechanism and unilateral deniable ring signature mechanism are mainly designed based on the SM2 signature algorithm (an elliptic curve public key cryptography algorithm). These schemes do not take into account the design of threshold deniable ring signatures, that is, the existing deniable ring signatures based on SM2 do not have the characteristics of threshold cryptography, and multiple parties cannot jointly generate a deniable ring signature value, which is not suitable for distributed cryptographic application scenarios. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide a threshold ring signature method, device, equipment and storage medium, which can generate a deniable ring signature value. The specific scheme is as follows:

[0004] In a first aspect, the present application discloses a threshold ring signature method, including:

[0005] Generate a first signature part parameter corresponding to each signature ring member based on a first random number corresponding to each signature ring member, and generate a second signature part parameter and a first signature verification parameter corresponding to each non-signature ring member based on a second random number corresponding to each non-signature ring member;

[0006] Obtaining a third random number corresponding to each signature ring member, and generating a verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature partial parameter, and the first signature verification parameter;

[0007] A corresponding target polynomial is determined by using a preset interpolation method and the verification parameter hash value, and a third signature partial parameter corresponding to each signature ring member is determined based on the target polynomial, so as to form a corresponding threshold ring signature based on the first signature partial parameter, the second signature partial parameter, the third signature partial parameter and the target polynomial.

[0008] Optionally, the generating, based on the first random number corresponding to each signature ring member, the first signature partial parameter corresponding to each signature ring member, and generating, based on the second random number corresponding to each non-signature ring member, the second signature partial parameter and the first signature verification parameter corresponding to each non-signature ring member, includes:

[0009] Inputting a first random number corresponding to each signature ring member into a first preset cryptographic hash function to obtain a first target hash value, and determining a first signature part parameter corresponding to each signature ring member based on the first target hash value and a preset private key;

[0010] Obtain a second random number corresponding to each non-signature ring member, and determine a second signature partial parameter based on a first sub-random number in the second random number and the first target hash value;

[0011] Determine a first signature verification sub-parameter in the first signature verification parameter based on a preset base point, a second sub-random number and a third sub-random number in the second random number, and a preset public key corresponding to each non-signature ring member;

[0012] A second signature verification sub-parameter in the first signature verification parameter is determined based on the second sub-random number, the third sub-random number, the first target hash value, and the second signature partial parameter.

[0013] Optionally, the obtaining a third random number corresponding to each signature ring member, and generating a verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature partial parameter, and the first signature verification parameter, includes:

[0014] Obtaining a third random number corresponding to each signature ring member, and determining a second signature verification parameter based on the third random number and the preset base point;

[0015] A third signature verification parameter is determined based on the third random number and the first target hash value, and verification parameter hash values ​​corresponding to each signature ring member are determined based on the first signature partial parameter, the second signature partial parameter, the first signature verification parameter, the second signature verification parameter and the third signature verification parameter.

[0016] Optionally, the determining, based on the target polynomial, the third signature partial parameters corresponding to each signature ring member includes:

[0017] The third signature partial parameter corresponding to each signature ring member is determined based on the polynomial share of the target polynomial and the preset private key.

[0018] Optionally, the method further includes:

[0019] Obtaining a threshold ring signature to be verified; the threshold ring signature to be verified includes a signature part parameter to be verified, a signature verification parameter to be verified, and a polynomial to be verified;

[0020] Determine a control parameter of the polynomial to be verified with zero as an independent variable;

[0021] Determine a second parameter based on a first parameter of the polynomial to be verified with the serial numbers corresponding to the signature ring members as independent variables and the set of public keys of the signature ring members, determine a third parameter based on the signature verification parameter to be verified and the preset base point, and then determine a fourth parameter based on the sum of the second parameter and the third parameter;

[0022] Determine a fifth parameter based on the first target hash value and the verification parameter of the signature to be verified, determine a sixth parameter using the first parameter and the partial parameter of the signature to be verified, and then determine a seventh parameter based on the sum of the fifth parameter and the sixth parameter;

[0023] Inputting the public key set of each signature ring member, the first random number, the signature part parameter to be verified, the fourth parameter and the seventh parameter into a second preset cryptographic hash function to obtain a second target hash value;

[0024] It is determined whether the comparison parameter is equal to the second target hash value. If they are equal, the ring signature verification is successful.

[0025] Optionally, the method further includes:

[0026] The first prover determines a first evidence parameter by using a second preset cryptographic hash function, the preset base point, and a preset public key corresponding to the first prover, and generates a second evidence parameter by using the first evidence parameter and a target private key corresponding to the first prover;

[0027] Determine, by the first verifier, a corresponding confirmation parameter using the second preset cryptographic hash function, a preset public key corresponding to the first prover, and a signature parameter, and determine whether the confirmation parameter is equal to the second evidence parameter;

[0028] If the confirmation parameter is equal to the second evidence parameter, the first prover is confirmed to be a member of the signature ring.

[0029] Optionally, the method further includes:

[0030] Determine a target random number from a preset data interval by a second verifier;

[0031] Determine a challenge parameter based on the target random number, the first target hash value, the preset base point, and a preset public key corresponding to the second verifier, and generate an equation to be verified based on the challenge parameter;

[0032] The second prover determines a verification random number from the equation to be verified by an exhaustive method, and generates an evidence judgment equation based on the verification random number, so that the second verifier judges whether the evidence judgment equation is established;

[0033] If the evidence judgment equation holds true, it is confirmed that the second prover is a non-signature ring member.

[0034] In a second aspect, the present application discloses a threshold ring signature device, comprising:

[0035] A first parameter generation module, configured to generate, by the first signature part, a first signature part parameter corresponding to each signature ring member based on a first random number corresponding to each signature ring member, and to generate, by the first signature part, a second signature part parameter corresponding to each non-signature ring member and a first signature verification parameter based on a second random number corresponding to each non-signature ring member;

[0036] A second parameter generation module is used to obtain a third random number corresponding to each signature ring member, and generate a verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature partial parameter and the first signature verification parameter;

[0037] a signature generation module, configured to determine a corresponding target polynomial by using a preset interpolation method and the parameter hash value, and determine a third signature partial parameter corresponding to each signature ring member based on the target polynomial, so as to construct a corresponding threshold ring signature based on the first signature partial parameter, the second signature partial parameter, the third signature partial parameter and the target polynomial.

[0038] In a third aspect, the present application discloses an electronic device, including:

[0039] Memory, used to store computer programs;

[0040] A processor is used to execute the computer program to implement the aforementioned threshold ring signature method.

[0041] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program, which implements the aforementioned threshold ring signature method when executed by a processor.

[0042] It can be seen that in the present application, the first signature part parameter corresponding to each signature ring member is generated based on the first random number corresponding to each signature ring member, and the second signature part parameter and the first signature verification parameter corresponding to each non-signature ring member are generated based on the second random number corresponding to each non-signature ring member; the third random number corresponding to each signature ring member is obtained, and the verification parameter hash value corresponding to each signature ring member is generated based on the third random number, the first signature part parameter and the first signature verification parameter; the corresponding target polynomial is determined by using the preset interpolation method and the parameter hash value, and the third signature part parameter corresponding to each signature ring member is determined based on the target polynomial, so as to form a corresponding threshold ring signature based on the first signature part parameter, the second signature part parameter, the third signature part parameter and the target polynomial. That is, by considering the signature parameters and verification parameters corresponding to each signature ring member and each non-signature ring member to generate the corresponding threshold ring signature, the participants participating in the generation of the ring signature can prove that they participated in the generation through the proof algorithm, and the participants who did not participate in the generation can deny their participation through the denial algorithm, and then the identities of each signature ring member and each non-signature ring member are verified through the verification parameters. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0044] Figure 1 A flow chart of a threshold ring signature method disclosed in this application;

[0045] Figure 2 A flow chart of a specific threshold ring signature confirmation method disclosed in this application;

[0046] Figure 3 A specific flow chart of the threshold ring signature denial method disclosed in this application

[0047] Figure 4 This is a schematic diagram of the structure of a threshold ring signature device disclosed in this application;

[0048] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0050] Threshold cryptography can provide a distributed cryptographic mechanism, transforming a single-party signature or decryption operation into a multi-party scenario, which can be used for permission control of key cryptographic operations. The threshold ring signature scheme thresholds the ring signature so that a certain number of ring members can be combined to generate a ring signature. Currently, there are ring signature schemes and deniable ring signature designs based on SM2, but the research is not sufficient. This application will specifically introduce a method for multiple parties to jointly generate a deniable ring signature value.

[0051] See also Figure 1 As shown, the embodiment of the present application discloses a threshold ring signature method, including:

[0052] Step S11: generating a first signature partial parameter corresponding to each signature ring member based on a first random number corresponding to each signature ring member, and generating a second signature partial parameter and a first signature verification parameter corresponding to each non-signature ring member based on a second random number corresponding to each non-signature ring member.

[0053] First, in this application, the relevant symbols are agreed upon as follows: in the SM2 standard, G is the base point of the elliptic curve group E, N is the order of the base point, H1:{0,1}*→[1,N-1] is the cryptographic hash function, which is the second preset cryptographic hash function in this application, and Z A is a distinguishable identifier of the user. Let H2:{0,1}*→E be a cryptographic hash function, the image set is the elliptic curve group, and in this application it is the first preset cryptographic hash function. Before performing the ring signature, the ring members first use the SM2 standard algorithm to generate their own public and private key pairs. Let L={P1,…,P n} is the public key set of ring member SM2, I L is the set of t signers who actually participate in generating the signature, |I|=t, without loss of generality, let I={1,2,…,t}. Let the set of members who do not participate in generating the signature be . For ∀i I, whose SM2 private key is d i In the threshold deniable ring signature, it is assumed that there is a combiner role responsible for aggregating the data generated by each participant and outputting the final signature. In practical applications, the combiner can be undertaken by a certain participant or a specific component. Each participant first generates their own public and private key pairs according to the SM2 standard algorithm, and then performs the following operations.

[0054] In this embodiment, the first random number corresponding to each signature ring member is input into the first preset cryptographic hash function to obtain a first target hash value, and the first signature part parameter corresponding to each signature ring member is determined based on the first target hash value and the preset private key. I, select the first random number r i [1,N-1], then r i Sent to the combiner, 1≤i≤t, the combiner calculates the random number hash value W=H2(m||r1||⋯||r t ), and W is disclosed. The hash value here is the first target hash value, because the specific hash value space is an elliptic curve multiplication point, which is simplified to the hash value in this application. Then, the participant i I, calculate and publish the first signature part parameter S i =d i W, 1≤i≤t.

[0055] In this embodiment, a second random number corresponding to each non-signature ring member is obtained, and a second signature part parameter is determined based on a first sub-random number in the second random number and the first target hash value; a first signature verification sub-parameter in the first signature verification parameter is determined based on a preset base point, a second sub-random number and a third sub-random number in the second random number, and a preset public key corresponding to each non-signature ring member; and a second signature verification sub-parameter in the first signature verification parameter is determined based on the second sub-random number, the third sub-random number, the first target hash value, and the second signature part parameter. That is, for j , the combiner selects a random number s j , t j , α j [1,N-1], calculate the second signature parameter S j =α j W, first signature verification parameter Q j =s j G+t j P j , the second signature verification parameter Y j =s j W+t j S j .

[0056] Step S12: Obtain a third random number corresponding to each signature ring member, and generate a verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature partial parameter and the first signature verification parameter.

[0057] In this embodiment, a third random number corresponding to each signature ring member is obtained, and a second signature verification parameter is determined based on the third random number and the preset base point; a third signature verification parameter is determined based on the third random number and the first target hash value, and a verification parameter hash value corresponding to each signature ring member is determined based on the first signature part parameter, the second signature part parameter, the first signature verification parameter, the second signature verification parameter and the third signature verification parameter. Specifically, the combiner generates a verification parameter hash value corresponding to each signature ring member i I, select a random number k i [1,N-1], calculate the second signature verification parameter Q i =k i G, the third signature verification parameter Y i =k i W, calculate the verification parameter hash value t0=H1(L,t,r1,⋯,r t ,S1,⋯,S n ,Q1,⋯,Q n ,Y1,⋯,Y n ).

[0058] Step S13: Determine a corresponding target polynomial using a preset interpolation method and the verification parameter hash value, and determine the third signature partial parameter corresponding to each signature ring member based on the target polynomial, so as to construct a corresponding threshold ring signature based on the first signature partial parameter, the second signature partial parameter, the third signature partial parameter and the target polynomial.

[0059] In this embodiment, first, the combiner uses f(0)=t0, f(j)=tj, j is the interpolation point value, and the target polynomial f(x) of degree nt is obtained by interpolation method, and f(x) is made public. Then, the third signature part parameters corresponding to each signature ring member are determined based on the polynomial share of the target polynomial and the preset private key. Specifically, for i I, participant i calculates the polynomial share t i =f(i), calculate the signature part parameter s i =k i -t i d i , for each signature ring member i I; each signature ring member i will s i Send it to the combiner, and finally, the combiner outputs the signature =(r1,r2,⋯,r t ,S1,⋯,S n ,s1,⋯,s n ,f).

[0060] In this embodiment, the method further includes: obtaining a threshold ring signature to be verified; the threshold ring signature to be verified includes a signature part parameter to be verified, a signature verification parameter to be verified, and a polynomial to be verified; determining a comparison parameter of the polynomial to be verified with zero as an independent variable; determining a second parameter based on a first parameter of the polynomial to be verified with the corresponding sequence number of each signature ring member as an independent variable and a public key set of each signature ring member, determining a third parameter based on the signature verification parameter to be verified and the preset base point, and then determining a fourth parameter based on the sum of the second parameter and the third parameter; determining a fifth parameter based on the first target hash value and the signature verification parameter to be verified, determining a sixth parameter using the first parameter and the signature part parameter to be verified, and then determining a seventh parameter based on the sum of the fifth parameter and the sixth parameter; inputting the public key set of each signature ring member, the first random number, the signature part parameter to be verified, the fourth parameter, and the seventh parameter into a second preset cryptographic hash function to obtain a second target hash value; judging whether the comparison parameter is equal to the second target hash value, if they are equal, the ring signature verification is passed. Specifically, first, the signature verifier calculates the hash value W=H2(m||r1||⋯||r) of the first random number. Then, the following equation is verified:

[0061] f(0)=H1(L,t,r1,⋯,r t ,S1,⋯,S n ,s1G+f(1)P1,⋯,s n G+f(n)P n ,s1W+f(1)S1,⋯,s n W+f(n)S n );

[0062] If the above equation holds true, the signature verification succeeds.

[0063] In this embodiment, Figure 2 As shown, the first prover uses the second preset cryptographic hash function, the preset base point, and the preset public key corresponding to the first prover to determine the first evidence parameter, and uses the first evidence parameter and the target private key corresponding to the first prover to generate the second evidence parameter. The first verifier uses the second preset cryptographic hash function, the preset public key corresponding to the first prover, and the signature parameter to determine the corresponding confirmation parameter, and judge whether the confirmation parameter is equal to the second evidence parameter. If the confirmation parameter is equal to the second evidence parameter, the first prover is confirmed to be a member of the signature ring. Specifically, the signer confirmation algorithm is performed by the prover (participant P participating in the generation of the threshold ring signature) i ) and the verifier (denoted as V), P i It is necessary to prove to V that it participated in the generation of the threshold ring signature.i Calculate the first evidence parameter K=H1(P i ||1)W+(H1(P i ||2)+H1(P i ||3))G, the second evidence parameter L=d i K, and sends (K, L) to the verifier V. The verifier V calculates the equation L=H1(P i ||1)Si+(H1(P i ||2)+H1(P i ||3))P i Is it true? If true, then P can be confirmed i Participated in the generation of threshold ring signatures.

[0064] In this embodiment, Figure 3 As shown, the target random number is determined from the preset data interval by the second verifier. The challenge parameter is determined based on the target random number, the first target hash value, the preset base point and the preset public key corresponding to the second verifier, and the equation to be verified is generated based on the challenge parameter. The second prover determines the verification random number from the equation to be verified by exhaustive method, and generates an evidence judgment equation based on the verification random number, so that the second verifier can judge whether the evidence judgment equation is established. If the evidence judgment equation is established, it is confirmed that the second prover is a non-signature ring member. It should be noted that the non-signer denial algorithm is performed by the prover (participant P who did not participate in the threshold ring signature) j ) and the verifier (denoted as V), let z be the probability-related parameter agreed upon by both parties. In a single interactive authentication, the prover has a probability of 1 / z to deceive the verifier, and the probability of deception can be reduced by increasing the size of z and the number of interactions. For example, z=1024 and the number of interactions can be set to make the probability of deception less than 2 -50 Specifically, the verifier V calculates the hash value of the first random number W=H2(m||r1||⋯||r t ), select a random number a [1,z], calculate the first challenge parameter C1=aW+H1(P j ||3)G, the second challenge parameter C2=aS j +H1(P i ||3)P j , send C1, C2 to the prover P j Then the prover P j Exhaustive random number a The value of [1,z] makes the equation d j C1-C2=a(d j WS j ) is established; the prover sets the evidence value t=H1(a,H1(P j||4)) is sent to the verifier V. The verifier V calculates t=H1(a,H1(P j ||4)) is true? If true, then it is considered that the prover P j Not involved in the generation of the threshold ring signature.

[0065] It can be seen that in this embodiment, the first signature part parameter corresponding to each signature ring member is generated based on the first random number corresponding to each signature ring member, and the second signature part parameter and the first signature verification parameter corresponding to each non-signature ring member are generated based on the second random number corresponding to each non-signature ring member; the third random number corresponding to each signature ring member is obtained, and the verification parameter hash value corresponding to each signature ring member is generated based on the third random number, the first signature part parameter and the first signature verification parameter; the corresponding target polynomial is determined by using the preset interpolation method and the parameter hash value, and the third signature part parameter corresponding to each signature ring member is determined based on the target polynomial, so as to form a corresponding threshold ring signature based on the first signature part parameter, the second signature part parameter, the third signature part parameter and the target polynomial. That is, by considering the signature parameters and verification parameters corresponding to each signature ring member and each non-signature ring member to generate the corresponding threshold ring signature, the participants participating in the generation of the ring signature can prove that they participated in the generation through the proof algorithm, and the participants who did not participate in the generation can deny their participation through the denial algorithm, and then the identities of each signature ring member and each non-signature ring member are verified through the verification parameters.

[0066] refer to Figure 4 The embodiment of the present application also discloses a threshold ring signature device, including:

[0067] A first parameter generating module 11 is configured to generate, by the first signature part, a first signature part parameter corresponding to each signature ring member based on a first random number corresponding to each signature ring member, and to generate, by the first signature part, a second signature part parameter corresponding to each non-signature ring member and a first signature verification parameter based on a second random number corresponding to each non-signature ring member;

[0068] A second parameter generating module 12 is used to obtain a third random number corresponding to each signature ring member, and generate a verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature partial parameter and the first signature verification parameter;

[0069] The signature generation module 13 is used to determine the corresponding target polynomial by using a preset interpolation method and the parameter hash value, and determine the third signature part parameter corresponding to each signature ring member based on the target polynomial, so as to form a corresponding threshold ring signature based on the first signature part parameter, the second signature part parameter, the third signature part parameter and the target polynomial.

[0070] It can be seen that in this embodiment, by considering the signature parameters and verification parameters corresponding to each signature ring member and each non-signature ring member to generate the corresponding threshold ring signature, the participants participating in the generation of the ring signature can prove their participation in the generation through the proof algorithm, while the participants who did not participate in the generation can deny their participation through the denial algorithm, and then the identities of each signature ring member and each non-signature ring member are verified through the verification parameters.

[0071] In some specific embodiments, the first parameter generating module 11 may specifically include:

[0072] a first partial parameter determination unit, configured to input a first random number corresponding to each signature ring member into a first preset cryptographic hash function to obtain a first target hash value, and determine a first signature partial parameter corresponding to each signature ring member based on the first target hash value and a preset private key;

[0073] a second part parameter determination unit, configured to obtain a second random number corresponding to each non-signature ring member, and determine a second signature part parameter based on a first sub-random number in the second random number and the first target hash value;

[0074] A first verification parameter determination unit, configured to determine a first signature verification sub-parameter in a first signature verification parameter based on a preset base point, a second sub-random number and a third sub-random number in the second random number, and a preset public key corresponding to each non-signature ring member;

[0075] A second verification parameter determination unit is used to determine a second signature verification sub-parameter in the first signature verification parameter based on the second sub-random number, the third sub-random number, the first target hash value and the second signature partial parameter.

[0076] In some specific embodiments, the second parameter generating module 12 may specifically include:

[0077] a third verification parameter determination unit, configured to obtain a third random number corresponding to each signature ring member, and determine a second signature verification parameter based on the third random number and the preset base point;

[0078] a first hash value determining unit, configured to determine a third signature verification parameter based on the third random number and the first target hash value, and determine the verification parameter hash values ​​corresponding to the signature ring members based on the first signature partial parameter, the second signature partial parameter, the first signature verification parameter, the second signature verification parameter, and the third signature verification parameter.

[0079] In some specific embodiments, the signature generation module 13 may be specifically configured to determine the third signature partial parameters corresponding to each signature ring member based on the polynomial share of the target polynomial and the preset private key.

[0080] In some specific embodiments, the threshold ring signature device may further include:

[0081] A first signature acquisition module to be verified is used to obtain a threshold ring signature to be verified; the threshold ring signature to be verified includes a signature part parameter to be verified, a signature verification parameter to be verified, and a polynomial to be verified;

[0082] A control parameter determination module, used to determine the control parameter of the polynomial to be verified with zero as an independent variable;

[0083] a first target parameter determination module, configured to determine a second parameter based on a first parameter of the polynomial to be verified with the serial numbers corresponding to the signature ring members as independent variables and the set of public keys of the signature ring members, determine a third parameter based on the signature verification parameter to be verified and the preset base point, and then determine a fourth parameter based on the sum of the second parameter and the third parameter;

[0084] a second target parameter determination module, configured to determine a fifth parameter based on the first target hash value and the to-be-verified signature verification parameter, determine a sixth parameter using the first parameter and the to-be-verified signature partial parameter, and then determine a seventh parameter based on the sum of the fifth parameter and the sixth parameter;

[0085] a hash value determination module, configured to input the public key set of each signature ring member, the first random number, the signature part parameter to be verified, the fourth parameter and the seventh parameter into a second preset cryptographic hash function to obtain a second target hash value;

[0086] The first signature verification determination module is used to determine whether the comparison parameter is equal to the second target hash value. If they are equal, the ring signature verification is passed.

[0087] In some specific embodiments, the threshold ring signature device may further include:

[0088] an evidence parameter determination module, configured to determine a first evidence parameter by a first prover using a second preset cryptographic hash function, the preset base point, and a preset public key corresponding to the first prover, and to generate a second evidence parameter using the first evidence parameter and a target private key corresponding to the first prover;

[0089] an evidence parameter comparison module, configured to determine a corresponding confirmation parameter by the first verifier using the second preset cryptographic hash function, a preset public key corresponding to the first prover, and a signature parameter, and determine whether the confirmation parameter is equal to the second evidence parameter;

[0090] The second signature verification determination module is configured to confirm that the first prover is a member of the signature ring if the confirmation parameter is equal to the second evidence parameter.

[0091] In some specific embodiments, the threshold ring signature device may further include:

[0092] A target random number determination module, used to determine a target random number from a preset data interval by a second verifier;

[0093] a module for generating an equation to be verified, configured to determine a challenge parameter based on the target random number, the first target hash value, the preset base point, and a preset public key corresponding to the second verifier, and to generate an equation to be verified based on the challenge parameter;

[0094] an equation verification module, configured to determine a verification random number from the equation to be verified by a second prover using an exhaustive method, and generate an evidence judgment equation based on the verification random number, so that the second verifier can judge whether the evidence judgment equation is established;

[0095] The third signature verification determination module is used to confirm that the second prover is a non-signature ring member if the evidence judgment equation is established.

[0096] Furthermore, the present application also discloses an electronic device. Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0097] Figure 5 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the threshold ring signature method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0098] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0099] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0100] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the threshold ring signature method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0101] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the threshold ring signature method disclosed above is implemented. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the above embodiments, and no further description will be given here.

[0102] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0103] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0104] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0105] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0106] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A threshold ring signature method, characterized in that: include: Generate a first signature part parameter corresponding to each signature ring member based on a first random number corresponding to each signature ring member, and generate a second signature part parameter and a first signature verification parameter corresponding to each non-signature ring member based on a second random number corresponding to each non-signature ring member; Obtaining a third random number corresponding to each signature ring member, and generating a verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature partial parameter, and the first signature verification parameter; A corresponding target polynomial is determined by using a preset interpolation method and the verification parameter hash value, and a third signature partial parameter corresponding to each signature ring member is determined based on the target polynomial, so as to form a corresponding threshold ring signature based on the first signature partial parameter, the second signature partial parameter, the third signature partial parameter and the target polynomial.

2. The threshold ring signature method according to claim 1, characterized in that: The generating the first signature part parameter corresponding to each signature ring member based on the first random number corresponding to each signature ring member, and generating the second signature part parameter and the first signature verification parameter corresponding to each non-signature ring member based on the second random number corresponding to each non-signature ring member, includes: Inputting a first random number corresponding to each signature ring member into a first preset cryptographic hash function to obtain a first target hash value, and determining a first signature part parameter corresponding to each signature ring member based on the first target hash value and a preset private key; Obtain a second random number corresponding to each non-signature ring member, and determine a second signature partial parameter based on a first sub-random number in the second random number and the first target hash value; Determine a first signature verification sub-parameter in the first signature verification parameter based on a preset base point, a second sub-random number and a third sub-random number in the second random number, and a preset public key corresponding to each non-signature ring member; A second signature verification sub-parameter in the first signature verification parameter is determined based on the second sub-random number, the third sub-random number, the first target hash value, and the second signature partial parameter.

3. The threshold ring signature method according to claim 2, characterized in that: The obtaining of the third random number corresponding to each signature ring member, and generating the verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature partial parameter and the first signature verification parameter, includes: Obtaining a third random number corresponding to each signature ring member, and determining a second signature verification parameter based on the third random number and the preset base point; A third signature verification parameter is determined based on the third random number and the first target hash value, and verification parameter hash values ​​corresponding to each signature ring member are determined based on the first signature partial parameter, the second signature partial parameter, the first signature verification parameter, the second signature verification parameter and the third signature verification parameter.

4. The threshold ring signature method according to claim 3, characterized in that: The determining, based on the target polynomial, the third signature partial parameters corresponding to each signature ring member includes: The third signature partial parameter corresponding to each signature ring member is determined based on the polynomial share of the target polynomial and the preset private key.

5. The threshold ring signature method according to claim 4, characterized in that: Also includes: Get the threshold ring signature to be verified; The threshold ring signature to be verified includes a signature part parameter to be verified, a signature verification parameter to be verified, and a polynomial to be verified; Determine a control parameter of the polynomial to be verified with zero as an independent variable; Determine a second parameter based on a first parameter of the polynomial to be verified with the serial numbers corresponding to the signature ring members as independent variables and the set of public keys of the signature ring members, determine a third parameter based on the signature verification parameter to be verified and the preset base point, and then determine a fourth parameter based on the sum of the second parameter and the third parameter; Determine a fifth parameter based on the first target hash value and the verification parameter of the signature to be verified, determine a sixth parameter using the first parameter and the partial parameter of the signature to be verified, and then determine a seventh parameter based on the sum of the fifth parameter and the sixth parameter; Inputting the public key set of each signature ring member, the first random number, the signature part parameter to be verified, the fourth parameter and the seventh parameter into a second preset cryptographic hash function to obtain a second target hash value; It is determined whether the comparison parameter is equal to the second target hash value. If they are equal, the ring signature verification is successful.

6. The threshold ring signature method according to claim 4, characterized in that: Also includes: The first prover determines a first evidence parameter by using a second preset cryptographic hash function, the preset base point, and a preset public key corresponding to the first prover, and generates a second evidence parameter by using the first evidence parameter and a target private key corresponding to the first prover; Determine, by the first verifier, a corresponding confirmation parameter using the second preset cryptographic hash function, a preset public key corresponding to the first prover, and a signature parameter, and determine whether the confirmation parameter is equal to the second evidence parameter; If the confirmation parameter is equal to the second evidence parameter, the first prover is confirmed to be a member of the signature ring.

7. The threshold ring signature method according to claim 4, characterized in that: Also includes: Determine a target random number from a preset data interval by a second verifier; Determine a challenge parameter based on the target random number, the first target hash value, the preset base point, and a preset public key corresponding to the second verifier, and generate an equation to be verified based on the challenge parameter; The second prover determines a verification random number from the equation to be verified by an exhaustive method, and generates an evidence judgment equation based on the verification random number, so that the second verifier judges whether the evidence judgment equation is established; If the evidence judgment equation holds true, it is confirmed that the second prover is a non-signature ring member.

8. A threshold ring signature device, characterized in that: include: A first parameter generation module, configured to generate, by the first signature part, a first signature part parameter corresponding to each signature ring member based on a first random number corresponding to each signature ring member, and to generate, by the first signature part, a second signature part parameter corresponding to each non-signature ring member and a first signature verification parameter based on a second random number corresponding to each non-signature ring member; A second parameter generation module is used to obtain a third random number corresponding to each signature ring member, and generate a verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature partial parameter and the first signature verification parameter; a signature generation module, configured to determine a corresponding target polynomial by using a preset interpolation method and the parameter hash value, and determine a third signature partial parameter corresponding to each signature ring member based on the target polynomial, so as to construct a corresponding threshold ring signature based on the first signature partial parameter, the second signature partial parameter, the third signature partial parameter and the target polynomial.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the threshold ring signature method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, which, when executed by a processor, implements the threshold ring signature method according to any one of claims 1 to 7.

Images