A threshold ring signature method, device, equipment and storage medium

Abstract

The application discloses a threshold ring signature method and device, equipment and storage medium, and relates to the technical field of information security, which comprises the following steps: generating first signature part parameters corresponding to each signature ring member based on first random numbers corresponding to the signature ring members, and generating second signature part parameters corresponding to each non-signature ring member and first signature verification parameters based on second random numbers corresponding to the non-signature ring members; obtaining third random numbers corresponding to each signature ring member, generating verification parameter hash values corresponding to each signature ring member based on the third random numbers, the first signature part parameters and the first signature verification parameters; determining a corresponding target polynomial by using a preset interpolation method and the verification parameter hash values, and determining third signature part parameters corresponding to each signature ring member, so as to constitute a corresponding threshold ring signature based on the first signature part parameters, the second signature part parameters, the third signature part parameters and the target polynomial. In this way, a deniable ring signature value can be generated.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a threshold ring signature method, apparatus, device, and storage medium. Background Technology

[0002] Ring signatures are a cryptographic technique that can conceal the signer's identity. After a ring member generates a signature, the verifier only knows that the signature comes from the ring, but not who the real signer is. Ring signatures are widely used in privacy protection scenarios where identity privacy is a requirement. Currently available solutions primarily use the SM2 signature algorithm (an elliptic curve public-key cryptography algorithm) to design unilateral ring signature mechanisms, threshold ring signature mechanisms, and unilateral repudiable ring signature mechanisms. These solutions do not consider the design of threshold repudiable ring signatures; that is, existing SM2-based repudiable ring signatures do not possess the characteristics of threshold cryptography, cannot be jointly generated by multiple parties to generate a repudiable ring signature value, and are unsuitable for distributed cryptographic applications. Summary of the Invention

[0003] In view of this, the purpose of this invention is to provide a threshold ring signature method, apparatus, device, and storage medium capable of generating a repudiable ring signature value. The specific solution is as follows:

[0004] Firstly, this application discloses a threshold ring signature method, including:

[0005] The first signature part parameters corresponding to each signature ring member are generated based on the first random number corresponding to each signature ring member, and the second signature part parameters and the first signature verification parameters corresponding to each non-signature ring member are generated based on the second random number corresponding to each non-signature ring member.

[0006] Obtain the third random number corresponding to each signature ring member, and generate a verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature part parameters, and the first signature verification parameters;

[0007] The target polynomial is determined by using a preset interpolation method and the hash value of the verification parameter, and the third signature part parameter corresponding to each signature ring member is determined based on the target polynomial, so as to construct the corresponding threshold ring signature based on the first signature part parameter, the second signature part parameter, the third signature part parameter and the target polynomial.

[0008] Optionally, the step of generating the first signature portion parameters corresponding to each signature ring member based on the first random number corresponding to each signature ring member, and generating the second signature portion parameters and the first signature verification parameters corresponding to each non-signature ring member based on the second random number corresponding to each non-signature ring member, includes:

[0009] The first random number corresponding to each signature ring member is input into the first preset cryptographic hash function to obtain the first target hash value, and the first signature part parameters corresponding to each signature ring member are determined based on the first target hash value and the preset private key;

[0010] Obtain the second random number corresponding to each non-signature ring member, and determine the second signature part parameters based on the first sub-random number in the second random number and the first target hash value;

[0011] The first signature verification sub-parameter in the first signature verification parameter is determined based on the preset base point, the second and third sub-random numbers in the second random number, and the preset public key corresponding to each non-signature ring member;

[0012] The second signature verification sub-parameter in the first signature verification parameter is determined based on the second sub-random number, the third sub-random number, the first target hash value, and the second signature part parameter.

[0013] Optionally, obtaining the third random number corresponding to each signature ring member, and generating a verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature part parameters, and the first signature verification parameters, includes:

[0014] Obtain the third random number corresponding to each signature ring member, and determine the second signature verification parameter based on the third random number and the preset base point;

[0015] The third signature verification parameter is determined based on the third random number and the first target hash value, and the verification parameter hash value corresponding to each signature ring member is determined based on the first signature part parameter, the second signature part parameter, the first signature verification parameter, the second signature verification parameter and the third signature verification parameter.

[0016] Optionally, determining the third signature portion parameters corresponding to each signature ring member based on the target polynomial includes:

[0017] The parameters of the third signature portion corresponding to each signature ring member are determined based on the polynomial share of the target polynomial and the preset private key.

[0018] Optionally, the method further includes:

[0019] Obtain the threshold ring signature to be verified; the threshold ring signature to be verified includes partial parameters of the signature to be verified, verification parameters of the signature to be verified, and a polynomial to be verified.

[0020] Determine the control parameters of the polynomial to be verified with zero as the independent variable;

[0021] The second parameter is determined based on the first parameter of the polynomial to be verified, which is the corresponding sequence number of each signature ring member, and the public key set of each signature ring member. The third parameter is determined based on the signature verification parameter to be verified and the preset base point. Then, the fourth parameter is determined based on the sum of the second parameter and the third parameter.

[0022] The fifth parameter is determined based on the first target hash value and the signature verification parameter to be verified, and the sixth parameter is determined using the first parameter and the partial parameters of the signature to be verified. Then, the seventh parameter is determined based on the sum of the fifth parameter and the sixth parameter.

[0023] The public key set of each signature ring member, the first random number, the parameters of the signature to be verified, the fourth parameter, and the seventh parameter are input into the second preset cryptographic hash function to obtain the second target hash value;

[0024] Determine whether the comparison parameter is equal to the second target hash value. If they are equal, the ring signature verification is successful.

[0025] Optionally, the method further includes:

[0026] The first prover determines the first evidence parameter by using the second preset cryptographic hash function, the preset base point, and the preset public key corresponding to the first prover, and generates the second evidence parameter by using the first evidence parameter and the target private key corresponding to the first prover.

[0027] The first verifier uses the second preset cryptographic hash function, the preset public key corresponding to the first prover, and the signature parameters to determine the corresponding confirmation parameters, and then determines whether the confirmation parameters are equal to the second evidence parameters.

[0028] If the confirmation parameter is equal to the second evidence parameter, then the first certifier is confirmed as a member of the signature ring.

[0029] Optionally, the method further includes:

[0030] The target random number is determined from a preset data range by a second verifier;

[0031] Challenge parameters are determined based on the target random number, the first target hash value, the preset base point, and the preset public key corresponding to the second verifier, and an equation to be verified is generated based on the challenge parameters;

[0032] The second verifier uses an exhaustive method to determine a verification random number from the equation to be verified, and generates an evidence judgment equation based on the verification random number, so that the second verifier can determine whether the evidence judgment equation is true.

[0033] If the aforementioned evidence judgment equation holds true, then the second prover is confirmed to be a non-signature ring member.

[0034] Secondly, this application discloses a threshold ring signature device, comprising:

[0035] The first parameter generation module is used to generate first signature part parameters corresponding to each signature ring member based on the first random number corresponding to each signature ring member, and to generate second signature part parameters and first signature verification parameters corresponding to each non-signature ring member based on the second random number corresponding to each non-signature ring member.

[0036] The second parameter generation module is used to obtain the third random number corresponding to each signature ring member, and generate the verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature part parameter and the first signature verification parameter.

[0037] The signature generation module is used to determine the corresponding target polynomial using a preset interpolation method and the parameter hash value, and to determine the third signature part parameters corresponding to each signature ring member based on the target polynomial, so as to construct the corresponding threshold ring signature based on the first signature part parameters, the second signature part parameters, the third signature part parameters and the target polynomial.

[0038] Thirdly, this application discloses an electronic device, including:

[0039] Memory, used to store computer programs;

[0040] A processor for executing the computer program to implement the aforementioned threshold ring signature method.

[0041] Fourthly, this application discloses a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the aforementioned threshold ring signature method.

[0042] As can be seen, in this application, a first signature portion parameter corresponding to each signature ring member is generated based on a first random number corresponding to each signature ring member, and a second signature portion parameter and a first signature verification parameter are generated based on a second random number corresponding to each non-signature ring member; a third random number corresponding to each signature ring member is obtained, and a verification parameter hash value corresponding to each signature ring member is generated based on the third random number, the first signature portion parameter, and the first signature verification parameter; a target polynomial is determined using a preset interpolation method and the parameter hash value, and a third signature portion parameter corresponding to each signature ring member is determined based on the target polynomial, so that a corresponding threshold ring signature is constructed based on the first signature portion parameter, the second signature portion parameter, the third signature portion parameter, and the target polynomial. That is, by considering the signature parameters and verification parameters corresponding to each signature ring member and each non-signature ring member to generate the corresponding threshold ring signature, participants in the ring signature generation can prove their participation in the generation through a proof algorithm, while participants who did not participate in the generation can deny their participation through a denial algorithm, and thus the identity of each signature ring member and each non-signature ring member is verified through the verification parameters. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0044] Figure 1 Here is a flowchart of a threshold ring signature method disclosed in this application;

[0045] Figure 2 This application discloses a specific threshold ring signature confirmation method flowchart;

[0046] Figure 3 Here is a flowchart of a specific threshold ring signature denial method disclosed in this application.

[0047] Figure 4 This is a schematic diagram of a threshold ring signature device disclosed in this application;

[0048] Figure 5 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0049] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0050] Threshold cryptography can provide distributed cryptographic mechanisms, transforming unilateral signature or decryption operations into multi-party scenarios, and can be used for access control of critical cryptographic operations. Threshold ring signature schemes threshold the ring signature, requiring a certain number of ring members to jointly generate a ring signature. Currently, there are SM2-based ring signature schemes and repudiable ring signature designs, but research is still insufficient. This application will specifically introduce a method for multi-party joint generation of a repudiable ring signature value.

[0051] See Figure 1 As shown in the figure, this application discloses a threshold ring signature method, including:

[0052] Step S11: Generate the first signature part parameters corresponding to each signature ring member based on the first random number corresponding to each signature ring member, and generate the second signature part parameters and the first signature verification parameters corresponding to each non-signature ring member based on the second random number corresponding to each non-signature ring member.

[0053] First, in this application, the relevant symbols are defined as follows: In the SM2 standard, G is the base point of the elliptic curve group E, N is the order of the base point, H1:{0,1}*→[1,N-1] is the cryptographic hash function, and in this application, it is the second preset cryptographic hash function, Z A For the identifiable identifier of the user. Let H2:{0,1}*→E be a cryptographic hash function, and the image set be an elliptic curve group, which is the first preset cryptographic hash function in this application. Before performing ring signature, the ring members first generate their respective public-private key pairs using the SM2 standard algorithm. Let L={P1,…,P… n} represents the set of SM2 public keys for ring members, I Let L be the set of t signers who actually participated in generating the signature, |I|=t. Without loss of generality, let I={1,2,…,t}. Let the set of members who did not participate in generating the signature be... For ∀i I, whose SM2 private key is d i In threshold-repudiable ring signatures, it is assumed that a combiner role exists to aggregate the data generated by all participants and output the final signature. In practical applications, the combiner role can be undertaken by a single participant or a specific component. Each participant first generates its own public-private key pair according to the SM2 standard algorithm, and then performs the following operations.

[0054] In this embodiment, the first random number corresponding to each signature ring member is input into the first preset cryptographic hash function to obtain the first target hash value, and the first signature part parameters corresponding to each signature ring member are determined based on the first target hash value and the preset private key. That is, firstly, each signature ring member i I, select the first random number r i [1, N-1], then r i The random number is sent to the combiner, where 1 ≤ i ≤ t. The combiner calculates the hash multiple value W = H2(m||r1||⋯||r) t ), disclosed W. The hash multiplier value mentioned here is the first target hash value, because the specific hash value space is an elliptic curve multiplier, which is simplified to the hash multiplier value in this application. Then, participant i I. Calculate and publish the first signature portion parameter S i =d i W, 1≤i≤t.

[0055] In this embodiment, a second random number corresponding to each non-signature ring member is obtained, and a second signature portion parameter is determined based on a first sub-random number in the second random number and the first target hash value; a first signature verification sub-parameter in the first signature verification parameter is determined based on a preset base point, the second and third sub-random numbers in the second random number, and the preset public key corresponding to each non-signature ring member; a second signature verification sub-parameter in the first signature verification parameter is determined based on the second sub-random number, the third sub-random number, the first target hash value, and the second signature portion parameter. That is, for j The combiner selects a random number s. j , t j α j [1, N-1], calculate the parameters S of the second signature part. j =α j W, first signature verification parameter Q j =s j G+t j P j The second signature verification parameter Y j =s j W+t j S j .

[0056] Step S12: Obtain the third random number corresponding to each signature ring member, and generate the verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature part parameter and the first signature verification parameter.

[0057] In this embodiment, a third random number corresponding to each signature ring member is obtained, and a second signature verification parameter is determined based on the third random number and the preset base point; a third signature verification parameter is determined based on the third random number and the first target hash value, and a verification parameter hash value corresponding to each signature ring member is determined based on the first signature part parameter, the second signature part parameter, the first signature verification parameter, the second signature verification parameter, and the third signature verification parameter. Specifically, the combiner performs the following steps for each signature ring member i: I, select a random number k i [1, N-1], calculate the second signature verification parameter Q. i =k i G, third signature verification parameter Y i =k i W, calculate the validation parameter hash value t0=H1(L,t,r1,⋯,r t ,S1,⋯,S n ,Q1,⋯,Q n ,Y1,⋯,Y n ).

[0058] Step S13: Determine the corresponding target polynomial using a preset interpolation method and the verification parameter hash value, and determine the third signature part parameters corresponding to each signature ring member based on the target polynomial, so as to construct the corresponding threshold ring signature based on the first signature part parameters, the second signature part parameters, the third signature part parameters and the target polynomial.

[0059] In this embodiment, firstly, the combiner is configured with f(0) = t0, f(j) = tj, j For the interpolation point values, an interpolation method is used to obtain a target polynomial f(x) of degree nt, and f(x) is made public. Then, based on the polynomial share of the target polynomial and the preset private key, the parameters of the third signature portion corresponding to each signature ring member are determined. Specifically, for i I, Participant i calculates the polynomial share t i =f(i), calculate the signature part parameter s i =k i -t i d i For each signature ring member i I; Each signature ring member i will s i The signature is sent to the combiner, and finally, the combiner outputs the signature. =(r1,r2,⋯,r t ,S1,⋯,S n ,s1,⋯,s n ,f).

[0060] This embodiment further includes: obtaining a threshold ring signature to be verified; the threshold ring signature to be verified includes a signature part parameter to be verified, a signature verification parameter to be verified, and a polynomial to be verified; determining a reference parameter for the polynomial to be verified with zero as the independent variable; determining a second parameter based on a first parameter of the polynomial to be verified with the corresponding sequence number of each signature ring member as the independent variable and the public key set of each signature ring member, and determining a third parameter based on the signature verification parameter to be verified and the preset base point, and then determining a fourth parameter based on the sum of the second parameter and the third parameter; determining a fifth parameter based on the first target hash value and the signature verification parameter to be verified, and determining a sixth parameter using the first parameter and the signature part parameter to be verified, and then determining a seventh parameter based on the sum of the fifth parameter and the sixth parameter; inputting the public key set of each signature ring member, the first random number, the signature part parameter to be verified, the fourth parameter, and the seventh parameter into a second preset cryptographic hash function to obtain a second target hash value; determining whether the reference parameter is equal to the second target hash value, and if they are equal, the ring signature verification passes. Specifically, first, the signature verifier calculates the hash multiplier value W = H2(m||r1||⋯||r) of the first random number. Then, it verifies whether the following equation holds true:

[0061] f(0) = H1(L,t,r1,⋯,r) t ,S1,⋯,S n ,s1G+f(1)P1,⋯,s n G+f(n)P n ,s1W+f(1)S1,⋯,s n W+f(n)S n );

[0062] If the above equation is true, then the signature verification is successful.

[0063] In this embodiment, as Figure 2 As shown, the first prover determines the first evidence parameters using a second preset cryptographic hash function, a preset base point, and the preset public key corresponding to the first prover, and then generates the second evidence parameters using the first evidence parameters and the target private key corresponding to the first prover. The first verifier determines the corresponding confirmation parameters using the second preset cryptographic hash function, the preset public key corresponding to the first prover, and the signature parameters, and then checks whether the confirmation parameters are equal to the second evidence parameters. If the confirmation parameters are equal to the second evidence parameters, then the first prover is confirmed as a member of the signature ring. Specifically, the signer confirmation algorithm is performed by the prover (participant P in the threshold ring signature generation process). i The process takes place between P and the validator (denoted as V). i P needs to prove to V that he / she participated in the generation of the threshold ring signature.i Calculate the first evidence parameter K=H1(P) i ||1)W+(H1(P i ||2)+H1(P i ||3))G,Second evidence parameter L=d i K, and sends (K, L) to verifier V. Verifier V calculates the equation L = H1(P i ||1)Si+(H1(P i ||2)+H1(P i ||3))P i Whether it holds true or not; if it holds true, then P can be confirmed. i Participated in the generation of threshold ring signatures.

[0064] In this embodiment, as Figure 3 As shown, a target random number is determined from a preset data range by a second verifier. Challenge parameters are determined based on the target random number, the first target hash value, the preset base point, and the preset public key corresponding to the second verifier, and an equation to be verified is generated based on these parameters. A verification random number is determined from the equation to be verified by a second prover using an exhaustive method, and an evidence judgment equation is generated based on this verification random number so that the second verifier can determine whether the evidence judgment equation is true. If the evidence judgment equation is true, the second prover is confirmed as a non-signature ring member. It should be noted that the non-signer denial algorithm is performed by the prover (participant P who did not participate in the threshold ring signing). j The interaction occurs between the prover (V) and the verifier (V), with z being a probability-related parameter agreed upon by both parties. In a single authentication interaction, the prover has a probability of 1 / z of deceiving the verifier. This probability can be reduced by increasing the value of z and the number of interactions. For example, setting z = 1024 and having 5 interactions can reduce the probability of deception to less than 2. -50 Specifically, the verifier V calculates the hash multiple value W=H2(m||r1||⋯||r) of the first random number. t Select a random number a. [1,z], calculate the first challenge parameter C1=aW+H1(P j ||3)G, Second challenge parameter C2=aS j +H1(P i ||3)P j Send C1 and C2 to the prover P. j Then the prover P j Exhaustive search for random numbers a The values ​​of [1, z] make the equation d j C1-C2=a(d j WS j The evidence is established; the prover will use the evidence value t = H1(a, H1(P)). j||4)) Send to verifier V. Verifier V calculates t=H1(a,H1(P) j ||4)) Is it true? If it is true, then the prover P is considered to be true. j It did not participate in the generation of the threshold ring signature.

[0065] As can be seen, in this embodiment, the first signature part parameters corresponding to each signature ring member are generated based on the first random number corresponding to each signature ring member, and the second signature part parameters and the first signature verification parameter corresponding to each non-signature ring member are generated based on the second random number corresponding to each non-signature ring member; the third random number corresponding to each signature ring member is obtained, and the verification parameter hash value corresponding to each signature ring member is generated based on the third random number, the first signature part parameters, and the first signature verification parameter; the corresponding target polynomial is determined using a preset interpolation method and the parameter hash value, and the third signature part parameters corresponding to each signature ring member are determined based on the target polynomial, so that the corresponding threshold ring signature is constructed based on the first signature part parameters, the second signature part parameters, the third signature part parameters, and the target polynomial. That is, by considering the signature parameters and verification parameters corresponding to each signature ring member and each non-signature ring member to generate the corresponding threshold ring signature, participants in the ring signature generation can prove their participation in the generation through a proof algorithm, while participants who did not participate in the generation can deny their participation through a denial algorithm, and thus the identity of each signature ring member and each non-signature ring member is verified through the verification parameters.

[0066] refer to Figure 4 The present application also discloses a threshold ring signature device, comprising:

[0067] The first parameter generation module 11 is used to generate first signature part parameters corresponding to each signature ring member based on the first random number corresponding to each signature ring member, and to generate second signature part parameters and first signature verification parameters corresponding to each non-signature ring member based on the second random number corresponding to each non-signature ring member.

[0068] The second parameter generation module 12 is used to obtain the third random number corresponding to each signature ring member, and generate the verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature part parameter and the first signature verification parameter.

[0069] The signature generation module 13 is used to determine the corresponding target polynomial using a preset interpolation method and the parameter hash value, and to determine the third signature part parameters corresponding to each signature ring member based on the target polynomial, so as to construct the corresponding threshold ring signature based on the first signature part parameters, the second signature part parameters, the third signature part parameters and the target polynomial.

[0070] As can be seen, in this embodiment, by taking into account the signature parameters and verification parameters corresponding to each signature ring member and each non-signature ring member, the corresponding threshold ring signature is generated. Participants in the ring signature generation can prove their participation in the generation through a proof algorithm, while participants who did not participate in the generation can deny their participation through a denial algorithm. In turn, the identity of each signature ring member and each non-signature ring member is verified through the verification parameters.

[0071] In some specific embodiments, the first parameter generation module 11 may specifically include:

[0072] The first parameter determination unit is used to input the first random number corresponding to each signature ring member into the first preset cryptographic hash function to obtain the first target hash value, and determine the first signature part parameters corresponding to each signature ring member based on the first target hash value and the preset private key;

[0073] The second parameter determination unit is used to obtain the second random number corresponding to each non-signature ring member, and determine the second signature part parameters based on the first sub-random number in the second random number and the first target hash value.

[0074] The first verification parameter determination unit is used to determine the first signature verification sub-parameter in the first signature verification parameter based on a preset base point, the second sub-random number and the third sub-random number in the second random number, and the preset public key corresponding to each non-signature ring member;

[0075] The second verification parameter determination unit is used to determine the second signature verification sub-parameter in the first signature verification parameters based on the second sub-random number, the third sub-random number, the first target hash value, and the second signature part parameter.

[0076] In some specific embodiments, the second parameter generation module 12 may specifically include:

[0077] The third verification parameter determination unit is used to obtain the third random number corresponding to each signature ring member, and determine the second signature verification parameter based on the third random number and the preset base point;

[0078] The first hash value determination unit is used to determine the third signature verification parameter based on the third random number and the first target hash value, and to determine the verification parameter hash value corresponding to each signature ring member based on the first signature part parameter, the second signature part parameter, the first signature verification parameter, the second signature verification parameter and the third signature verification parameter.

[0079] In some specific embodiments, the signature generation module 13 can be used to determine the third signature part parameters corresponding to each signature ring member based on the polynomial share of the target polynomial and the preset private key.

[0080] In some specific embodiments, the threshold ring signature device may further include:

[0081] The first unverified signature acquisition module is used to acquire the unverified threshold ring signature; the unverified threshold ring signature includes unverified signature partial parameters, unverified signature verification parameters, and unverified polynomial;

[0082] The reference parameter determination module is used to determine the reference parameters of the polynomial to be verified with zero as the independent variable;

[0083] The first target parameter determination module is used to determine a second parameter based on the first parameter of the polynomial to be verified with the corresponding sequence number of each signature ring member as the independent variable and the public key set of each signature ring member, and to determine a third parameter based on the signature verification parameter to be verified and the preset base point, and then to determine a fourth parameter based on the sum of the second parameter and the third parameter.

[0084] The second target parameter determination module is used to determine a fifth parameter based on the first target hash value and the signature verification parameter to be verified, and to determine a sixth parameter using the first parameter and the partial parameters of the signature to be verified, and then to determine a seventh parameter based on the sum of the fifth parameter and the sixth parameter;

[0085] The hash value determination module is used to input the public key set of each signature ring member, the first random number, the parameters of the signature part to be verified, the fourth parameter and the seventh parameter into the second preset cryptographic hash function to obtain the second target hash value;

[0086] The first signature verification determination module is used to determine whether the comparison parameter is equal to the second target hash value. If they are equal, the ring signature verification is successful.

[0087] In some specific embodiments, the threshold ring signature device may further include:

[0088] The evidence parameter determination module is used to determine the first evidence parameter by the first prover using the second preset cryptographic hash function, the preset base point, and the preset public key corresponding to the first prover, and to generate the second evidence parameter using the first evidence parameter and the target private key corresponding to the first prover.

[0089] The evidence parameter comparison module is used to determine the corresponding confirmation parameter by the first verifier using the second preset cryptographic hash function, the preset public key corresponding to the first prover, and the signature parameter, and to determine whether the confirmation parameter is equal to the second evidence parameter;

[0090] The second signature verification and determination module is used to confirm that the first prover is a member of the signature ring if the confirmation parameter is equal to the second evidence parameter.

[0091] In some specific embodiments, the threshold ring signature device may further include:

[0092] The target random number determination module is used to determine a target random number from a preset data range by a second verifier.

[0093] The equation to be verified generation module is used to determine challenge parameters based on the target random number, the first target hash value, the preset base point and the preset public key corresponding to the second verifier, and generate an equation to be verified based on the challenge parameters;

[0094] The equation verification module is used to determine a verification random number from the equation to be verified by a second verifier using an exhaustive method, and to generate an evidence judgment equation based on the verification random number, so that the second verifier can determine whether the evidence judgment equation is true.

[0095] The third signature verification and determination module is used to confirm that the second prover is a non-signature ring member if the evidence judgment equation is true.

[0096] Furthermore, embodiments of this application also disclose an electronic device, Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0097] Figure 5 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the threshold ring signature method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0098] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0099] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0100] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the threshold ring signature method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0101] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned threshold ring signature method. The specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0102] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0103] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0104] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0105] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0106] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A threshold ring signature method, characterized in that, include: The first signature part parameters corresponding to each signature ring member are generated based on the first random number corresponding to each signature ring member, and the second signature part parameters and the first signature verification parameters corresponding to each non-signature ring member are generated based on the second random number corresponding to each non-signature ring member. Obtain the third random number corresponding to each signature ring member, and generate a verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature part parameters, and the first signature verification parameters; The target polynomial is determined by using a preset interpolation method and the hash value of the verification parameter, and the third signature part parameter corresponding to each signature ring member is determined based on the target polynomial, so as to construct the corresponding threshold ring signature based on the first signature part parameter, the second signature part parameter, the third signature part parameter and the target polynomial.

2. The threshold ring signature method according to claim 1, characterized in that, The process of generating the first signature portion parameters corresponding to each signature ring member based on the first random number corresponding to each signature ring member, and generating the second signature portion parameters and the first signature verification parameters corresponding to each non-signature ring member based on the second random number corresponding to each non-signature ring member, includes: The first random number corresponding to each signature ring member is input into the first preset cryptographic hash function to obtain the first target hash value, and the first signature part parameters corresponding to each signature ring member are determined based on the first target hash value and the preset private key; Obtain the second random number corresponding to each non-signature ring member, and determine the second signature part parameters based on the first sub-random number in the second random number and the first target hash value; The first signature verification sub-parameter in the first signature verification parameter is determined based on the preset base point, the second and third sub-random numbers in the second random number, and the preset public key corresponding to each non-signature ring member; The second signature verification sub-parameter in the first signature verification parameter is determined based on the second sub-random number, the third sub-random number, the first target hash value, and the second signature part parameter.

3. The threshold ring signature method according to claim 2, characterized in that, The step of obtaining the third random number corresponding to each signature ring member, and generating a verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature part parameters, and the first signature verification parameters, includes: Obtain the third random number corresponding to each signature ring member, and determine the second signature verification parameter based on the third random number and the preset base point; The third signature verification parameter is determined based on the third random number and the first target hash value, and the verification parameter hash value corresponding to each signature ring member is determined based on the first signature part parameter, the second signature part parameter, the first signature verification parameter, the second signature verification parameter and the third signature verification parameter.

4. The threshold ring signature method according to claim 3, characterized in that, The step of determining the third signature portion parameters corresponding to each signature ring member based on the target polynomial includes: The parameters of the third signature portion corresponding to each signature ring member are determined based on the polynomial share of the target polynomial and the preset private key.

5. The threshold ring signature method according to claim 4, characterized in that, Also includes: Obtain the signature of the threshold ring to be verified; The threshold ring signature to be verified includes partial parameters of the signature to be verified, verification parameters of the signature to be verified, and a polynomial to be verified. Determine the control parameters of the polynomial to be verified with zero as the independent variable; The second parameter is determined based on the first parameter of the polynomial to be verified, which is the corresponding sequence number of each signature ring member, and the public key set of each signature ring member. The third parameter is determined based on the signature verification parameter to be verified and the preset base point. Then, the fourth parameter is determined based on the sum of the second parameter and the third parameter. The fifth parameter is determined based on the first target hash value and the signature verification parameter to be verified, and the sixth parameter is determined using the first parameter and the partial parameters of the signature to be verified. Then, the seventh parameter is determined based on the sum of the fifth parameter and the sixth parameter. The public key set of each signature ring member, the first random number, the parameters of the signature to be verified, the fourth parameter, and the seventh parameter are input into the second preset cryptographic hash function to obtain the second target hash value; Determine whether the comparison parameter is equal to the second target hash value. If they are equal, the ring signature verification is successful.

6. The threshold ring signature method according to claim 4, characterized in that, Also includes: The first prover determines the first evidence parameter by using the second preset cryptographic hash function, the preset base point, and the preset public key corresponding to the first prover, and generates the second evidence parameter by using the first evidence parameter and the target private key corresponding to the first prover. The first verifier uses the second preset cryptographic hash function, the preset public key corresponding to the first prover, and the signature parameters to determine the corresponding confirmation parameters, and then determines whether the confirmation parameters are equal to the second evidence parameters. If the confirmation parameter is equal to the second evidence parameter, then the first certifier is confirmed as a member of the signature ring.

7. The threshold ring signature method according to claim 4, characterized in that, Also includes: The target random number is determined from a preset data range by a second verifier; Challenge parameters are determined based on the target random number, the first target hash value, the preset base point, and the preset public key corresponding to the second verifier, and an equation to be verified is generated based on the challenge parameters; The second verifier uses an exhaustive method to determine a verification random number from the equation to be verified, and generates an evidence judgment equation based on the verification random number, so that the second verifier can determine whether the evidence judgment equation is true. If the aforementioned evidence judgment equation holds true, then the second prover is confirmed to be a non-signature ring member.

8. A threshold ring signature device, characterized in that, include: The first parameter generation module is used to generate first signature part parameters corresponding to each signature ring member based on the first random number corresponding to each signature ring member, and to generate second signature part parameters and first signature verification parameters corresponding to each non-signature ring member based on the second random number corresponding to each non-signature ring member. The second parameter generation module is used to obtain the third random number corresponding to each signature ring member, and generate the verification parameter hash value corresponding to each signature ring member based on the third random number, the first signature part parameter and the first signature verification parameter. The signature generation module is used to determine the corresponding target polynomial using a preset interpolation method and the parameter hash value, and to determine the third signature part parameters corresponding to each signature ring member based on the target polynomial, so as to construct the corresponding threshold ring signature based on the first signature part parameters, the second signature part parameters, the third signature part parameters and the target polynomial.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the threshold ring signature method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store a computer program, which, when executed by a processor, implements the threshold ring signature method as described in any one of claims 1 to 7.

Images