Efficient signature method and system based on SM9 algorithm

Abstract

The invention provides an efficient signature method and system based on an SM9 algorithm. The method comprises the following steps: acquiring attributes of to-be-signed data; according to the attribute of the to-be-signed data, generating an exclusive parameter set adaptive to the signature task based on an SM9 algorithm; the exclusive parameter set comprises core operation parameters matched with the attributes; splitting the main private key to obtain a plurality of sub private keys with different key levels; the key level of each sub private key is dynamically set according to the risk hidden danger of the signature task; based on sub-private keys of different key levels, respectively performing weighted signature operation on the core operation parameters in the exclusive parameter set to generate a plurality of signature semi-finished products with key level weight marks; and integrating all the signed semi-finished products to obtain a signed finished product so as to sign the to-be-signed data. According to the method and the device, differentiated digital signatures are generated according to different to-be-signed data, so that the safety, the efficiency and the adaptability of the digital signatures are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to an efficient signature method and system based on an SM9 algorithm. Background Art

[0002] In the digital information age, the security and authenticity of data are becoming increasingly important. Digital signatures, as one of the key technologies to ensure data security, are widely used in many fields.

[0003] Existing digital signature algorithms usually use fixed parameter sets, which are difficult to flexibly adjust according to different data attributes and signature task requirements, resulting in the inability to give full play to the advantages of the algorithm when processing complex and diverse data. At the same time, the use of the master private key is single, and no differentiated treatment is performed based on the risks and hidden dangers of the signature task, making it difficult to achieve the optimal balance between the security and efficiency of the signature in different scenarios. Summary of the invention

[0004] The main purpose of the present invention is to provide an efficient signature method and system based on the SM9 algorithm, aiming to overcome the defect that the current digital signature has no differentiated processing resulting in low signature security.

[0005] To achieve the above object, the present invention provides an efficient signature method based on the SM9 algorithm, comprising the following steps: Get the attributes of the data to be signed; According to the attributes of the data to be signed, a dedicated parameter set adapted to this signature task is generated based on the SM9 algorithm; the dedicated parameter set includes core operation parameters adapted to the attributes; The master private key is split to obtain multiple sub-private keys with different key levels. The key level of each sub-private key is dynamically set according to the risk of this signing task. Based on the sub-private keys of different key levels, weighted signature operations are performed on the core operation parameters in the exclusive parameter set to generate multiple signature semi-finished products with key level weight imprints; Integrate all the semi-finished signatures to obtain the finished signatures to sign the data to be signed.

[0006] Furthermore, the attributes of the data to be signed include data type, data length, and key elements in the data.

[0007] Furthermore, according to the attributes of the data to be signed, a dedicated parameter set adapted to this signature task is generated based on the SM9 algorithm, including: Analyze the attributes of the data to be signed, identify the sensitivity of the data to be signed, and mark it; Based on the mark, the corresponding basic parameter template in the SM9 algorithm is retrieved; In combination with the data length of the data to be signed, the hash function parameters in the basic parameter template are adjusted; Based on the adjusted parameter template, the current system timestamp information is integrated, the random number generation parameters in the parameter template are calibrated, and an exclusive parameter set adapted to this signature task is generated.

[0008] Furthermore, the master private key is split into multiple sub-private keys with different key levels, including: Analyze the risk level of the data to be signed; Determine the number of splits of the master private key and the key level of the sub-private key according to the risk level of the data to be signed; Based on the number of splits, the master private key is split using the Shamir secret sharing algorithm to obtain a corresponding number of sub-private keys; Each sub-private key is marked with the corresponding key level information, and different storage strategies are configured for sub-private keys of different key levels; among them, the sub-private keys of the highest key level are stored in a secure storage device with multiple encryption and physical isolation, and integrity verification and backup are performed regularly.

[0009] Furthermore, based on the sub-private keys of different key levels, weighted signature operations are performed on the core operation parameters in the exclusive parameter set to generate multiple signature semi-finished products with key level weight imprints, including: Real-time monitoring of multiple indicators of the computing environment as the initial parameters of the chaotic system, dynamically generating weights of sub-private keys at different key levels through chaotic mapping; Combining optical calculation with electronic calculation, using dynamically generated weights to perform weighted signature calculation on the core calculation parameters in the exclusive parameter set; The signature operation process is verified based on zero-knowledge proof technology. If the verification is successful, multiple semi-finished signatures with key level weight imprints are obtained.

[0010] Furthermore, all the semi-finished signatures are integrated to obtain the finished signatures, which include: Generate a first matrix based on the attributes of the data to be signed; generating a second matrix based on the exclusive parameter set; Based on the first matrix, transform the second matrix to obtain a transformation matrix; A transformation key is generated based on the transformation matrix, and each of the sub-private keys, the semi-finished signature product and the finished signature product is encrypted and stored based on the transformation key.

[0011] Further, based on the first matrix, the second matrix is ​​transformed to obtain a transformation matrix, including: Analyze each element of the first matrix, detect English character elements therefrom and connect them in sequence to obtain a first graph; Add the first graphic to the second matrix, and use the elements in the second matrix that overlap with the first graphic as transformation elements; Calculating the mean of the digital character elements in the first matrix; The mean value is added to each of the transformation elements in the second matrix to obtain a transformation matrix.

[0012] The present invention also provides an efficient signature system based on the SM9 algorithm, comprising: An acquisition unit, used to acquire the attributes of the data to be signed; A generating unit, configured to generate a dedicated parameter set adapted to the current signature task based on the SM9 algorithm according to the attributes of the data to be signed; the dedicated parameter set includes core operation parameters adapted to the attributes; The splitting unit is used to split the master private key into multiple sub-private keys with different key levels. The key level of each sub-private key is dynamically set according to the risk of this signature task. A computing unit, configured to perform weighted signature computing on the core computing parameters in the exclusive parameter set based on the sub-private keys of different key levels, and generate a plurality of semi-finished signature products with key level weight imprints; The signature unit is used to integrate all the semi-finished signatures to obtain the finished signatures in order to sign the data to be signed.

[0013] The present invention provides an efficient signature method and system based on the SM9 algorithm, including: obtaining the attributes of the data to be signed; generating an exclusive parameter set adapted to this signature task based on the SM9 algorithm according to the attributes of the data to be signed; the exclusive parameter set includes core operation parameters adapted to the attributes; splitting the master private key to obtain multiple sub-private keys with different key levels; the key level of each sub-private key is dynamically set according to the risk hazards of this signature task; based on the sub-private keys of different key levels, performing weighted signature operations on the core operation parameters in the exclusive parameter set respectively, generating multiple semi-finished signatures with key level weight imprints; integrating all the semi-finished signatures to obtain a finished signature to sign the data to be signed. In the present invention, an exclusive parameter set is generated according to the attributes of the data to be signed, the master private key is flexibly split and the signature operation is performed in a targeted manner, and differentiated digital signatures are generated for different data to be signed, thereby improving the security, efficiency and adaptability of digital signatures. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a schematic diagram of the steps of an efficient signature method based on the SM9 algorithm in one embodiment of the present invention; Figure 2 It is a structural block diagram of an efficient signature system based on the SM9 algorithm in one embodiment of the present invention; Figure 3 It is a schematic block diagram of the structure of a computer device according to an embodiment of the present invention.

[0015] The implementation, functional features and advantages of the present invention will be further described in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0017] Reference Figure 1 In one embodiment of the present invention, an efficient signature method based on the SM9 algorithm is provided, comprising the following steps: Step S1, obtaining the attributes of the data to be signed; Step S2, generating a dedicated parameter set adapted to the current signature task based on the SM9 algorithm according to the attributes of the data to be signed; the dedicated parameter set includes core operation parameters adapted to the attributes; Step S3, split the master private key to obtain multiple sub-private keys with different key levels; the key level of each sub-private key is dynamically set according to the risk of this signature task; Step S4, based on the sub-private keys of different key levels, weighted signature operations are performed on the core operation parameters in the exclusive parameter set to generate multiple signature semi-finished products with key level weight imprints; Step S5, integrating all the semi-finished signatures to obtain the finished signatures to sign the data to be signed.

[0018] In this embodiment, as described in step S1 above, the attributes of the data to be signed cover multiple aspects, such as data type (text, image, audio or video, etc.), data length (data volume), and key elements in the data (such as sensitive content such as account information and transaction amount in financial data; important information such as patient diagnosis results and genetic data in medical data). Accurately acquiring these attributes provides a basic basis for the subsequent generation of a dedicated parameter set based on the SM9 algorithm, so that the signature process can better adapt to the characteristics of the data and improve the security and effectiveness of the signature.

[0019] As described in step S2 above, based on the data attributes obtained in step S1, this step uses the characteristics of the SM9 algorithm to customize a dedicated parameter set. The SM9 algorithm itself has a certain degree of flexibility, and by analyzing the attributes of the data, it can generate a set of parameters in a targeted manner. For example, if the data to be signed is highly sensitive financial transaction data, in order to ensure security, the core operation parameters in the exclusive parameter set will enhance the encryption strength, such as using more complex hash function parameters, larger finite field parameters, etc.; if the data is ordinary public text and the security requirements are relatively low, the parameters can be adjusted to improve the operation efficiency. The exclusive parameter set generated in this way enables the SM9 algorithm to achieve a balance between security and efficiency according to the data attributes in this signature task.

[0020] As described in step S3 above, this step breaks the traditional single private key usage mode and splits the master private key (a key pair pre-generated with the master public key in the SM9 algorithm) based on the risk assessment of the signature task. By comprehensively considering the importance of the data to be signed, the impact that may be caused by tampering and other risk factors, the number of splits of the master private key and the critical level of each sub-private key are determined. For example, for signature tasks involving high risks, the master private key can be split into multiple parts, in which a higher proportion of high-criticality sub-private keys are set to perform signature operations of key parts to enhance the security of the signature; for signature tasks of general daily data, the number of splits can be appropriately reduced, and the proportion of high-criticality sub-private keys can be reduced. The above-mentioned method of dynamically setting the critical level of the sub-private key enables the signing process to flexibly adjust the security policy according to different risk scenarios.

[0021] As described in step S4 above, after obtaining the sub-private keys of different key levels and the exclusive parameter set, this step performs the signature operation. Sub-private keys of different key levels have different weights in the signature operation. The sub-private keys of high key levels have higher weights in the operation, which means that they have a greater impact on the signature result, and correspondingly, more complex and safer operation methods will be adopted, such as increasing the number of scalar multiplication operations in elliptic curve cryptography or using more advanced encryption transformations; the sub-private keys of low key levels have lower weights and the operation is relatively simple to improve the overall operation efficiency. Through this weighted signature operation, the role of sub-private keys of different key levels is fully utilized, which not only ensures the security of the signature, but also takes into account the operation efficiency, and generates semi-finished signatures with different key level weight imprints, laying the foundation for the generation of the final signature product.

[0022] As described in step S5 above, all the semi-finished signatures are integrated to obtain the finished signatures to sign the data to be signed. The multiple semi-finished signatures generated previously are integrated. The integration process can be a simple splicing, or it can be based on a preset algorithm and logic, combined with the key level weight imprints of each semi-finished signature, to ensure that the integrated signature product contains all the necessary information and complies with the signature specification of the SM9 algorithm. The final signature product can be used to sign the data to be signed, as an effective proof of the authenticity and integrity of the data, and plays a key role in the subsequent data transmission, storage and verification process.

[0023] In an embodiment of the present invention, an exclusive parameter set is generated according to the attributes of the data to be signed, the master private key is flexibly split and the signature operation is performed in a targeted manner, and differentiated digital signatures are generated according to the different data to be signed, thereby improving the security, efficiency and adaptability of the digital signature.

[0024] In one embodiment, the attributes of the data to be signed include data type, data length, and key elements in the data.

[0025] In one embodiment, according to the attributes of the data to be signed, a dedicated parameter set adapted to the current signature task is generated based on the SM9 algorithm, including: Analyze the attributes of the data to be signed, identify the sensitivity of the data to be signed, and mark it; Based on the mark, the corresponding basic parameter template in the SM9 algorithm is retrieved; Adjust the hash function parameters in the basic parameter template in combination with the data length of the data to be signed; Based on the adjusted parameter template, the current system timestamp information is integrated, the random number generation parameters in the parameter template are calibrated, and a dedicated parameter set adapted to this signature task is generated.

[0026] In this embodiment, the sensitivity of the data to be signed is one of the key factors that determine the security strength of the signature. Through in-depth analysis of data attributes, its sensitivity is judged from multiple aspects such as data type and information content. For example, if the data contains information such as personal ID number and bank card password, it can be judged as highly sensitive data; if it is general public news information, the sensitivity is lower. The identified sensitivity is clearly marked, such as divided into three levels: high, medium and low, to provide a clear basis for the subsequent selection of appropriate basic parameter templates, ensuring that the signing process can match the corresponding security level according to the sensitivity of the data.

[0027] The above SM9 algorithm pre-sets a variety of basic parameter templates to adapt to signature tasks with different security requirements. Based on the marking of data sensitivity in the previous step, the appropriate template can be accurately retrieved from the algorithm reserve. For highly sensitive data, templates with high-intensity encryption and complex verification mechanisms will be called to ensure the security of the data during signing and subsequent use; for low-sensitivity data, in order to improve computing efficiency, relatively simplified templates that focus on fast processing will be selected. This targeted template retrieval allows the SM9 algorithm to flexibly adjust the emphasis on security and efficiency according to the actual data situation.

[0028] The above data length is another important factor that affects the signature operation. Data of different lengths have different requirements for hash functions when performing hash operations. For data to be signed with a longer data length, in order to ensure the uniqueness and security of the hash result, it is necessary to adjust the hash function parameters in the basic parameter template. For example, increasing the number of iterations of the hash function, expanding the range of hash values, etc., so that the hash function can better handle large amounts of data, reduce the probability of hash collisions, and improve the security and reliability of the signature. For data with a shorter data length, the hash function operation can be appropriately simplified to improve the operation efficiency while ensuring basic security. By adjusting the hash function parameters in combination with the data length, the adaptability of the signature algorithm to data of different sizes is further optimized.

[0029] The above system timestamp information has the characteristics of uniqueness and real-time. The current system timestamp information is integrated into the adjusted parameter template, and the random number generation parameters are calibrated using the characteristics of the timestamp. This means that the random number sequence generated by each signature is closely related to the current time, which increases the randomness and unpredictability of the signature. For example, according to the numerical change of the timestamp, the seed value or iterative formula of the random number generation algorithm is dynamically adjusted to make the generated random numbers more diverse. After such a calibrated parameter template, an exclusive parameter set adapted to this signature task is finally generated, which not only takes into account the sensitivity and length of the data, but also combines the real-time time factor, comprehensively improving the security and uniqueness of the signature, making the signature more difficult to forge or crack.

[0030] In one embodiment, the master private key is split to obtain multiple sub-private keys with different key levels, including: Analyze the risk level of the data to be signed; Determine the number of splits of the master private key and the key level of the sub-private key according to the risk level of the data to be signed; Based on the number of splits, the master private key is split using the Shamir secret sharing algorithm to obtain a corresponding number of sub-private keys; Each sub-private key is marked with the corresponding key level information, and different storage strategies are configured for sub-private keys of different key levels; among them, the sub-private keys of the highest key level are stored in a secure storage device with multiple encryption and physical isolation, and integrity verification and backup are performed regularly.

[0031] In this embodiment, first, a comprehensive assessment is performed on the data to be signed to determine its risk level. The assessment process takes into account many factors, such as the sensitivity of the data, the severity of the consequences that may be caused by data leakage or tampering, and the security requirements of the field to which the data belongs. Accurately analyzing the risk level provides a basis for the subsequent reasonable splitting of the master private key and determining the key level of the sub-private key.

[0032] Then, based on the risk level determined in the previous step, formulate the corresponding master private key splitting strategy. The higher the risk level, the more master private key splits are usually required to ensure the security of the signature, and the proportion of high-key sub-private keys will also increase accordingly. For example, for data with extremely high risk levels, the master private key is split into multiple sub-private keys, and a larger number of high-key sub-private keys are set; while for data with low risk levels, the master private key is split into fewer sub-private keys, and the key level distribution is mainly at a lower level. In this way, the splitting of the master private key matches the data risk, ensuring the security of the signature while avoiding the waste of computing resources and increased management complexity caused by excessive splitting.

[0033] The above-mentioned Shamir secret sharing algorithm is a mature key splitting technology. It splits the master private key into multiple sub-private keys, and these sub-private keys have certain characteristics, that is, only when a sufficient number of sub-private keys (determined by the algorithm parameters) are collected can the original master private key be restored. Based on the number of splits determined in the previous step, the master private key is input into the Shamir secret sharing algorithm as a secret value. The algorithm operates in a finite field, selects a suitable polynomial and generates the corresponding sub-private key shares. For example, if it is determined that the master private key is split into 5 sub-private keys, the algorithm will generate 5 sub-private keys in a finite field, and these sub-private keys cannot restore the master private key when they exist alone. Only when a specific threshold is met (such as a combination of 3 or more sub-private keys) can the master private key be restored. This splitting method ensures that even if some sub-private keys are leaked, it will not directly endanger the security of the master private key.

[0034] Finally, in order to better manage and protect the split sub-private keys, each sub-private key is marked with its corresponding key level information. This enables different security measures to be taken according to the key level when the sub-private keys are used and managed in the future. Different storage strategies are configured for sub-private keys of different key levels to achieve reasonable resource allocation and maximize security. Sub-private keys of the highest key level are extremely important for signature security, so their storage security requirements are extremely high. They are stored in secure storage devices with multiple encryption technologies, and the combination of multiple encryption algorithms increases the difficulty of cracking. At the same time, physical isolation measures are adopted, such as placing storage devices in independent security areas, which are physically isolated from external networks to prevent network attacks. These sub-private keys of the highest key level are regularly checked for integrity to check whether they have been tampered with or damaged, and backed up to prevent the loss of sub-private keys due to storage device failures and other reasons. This hierarchical storage and management strategy not only ensures signature security, but also improves the reliability and stability of the system.

[0035] In one embodiment, based on the child private keys of different key levels, weighted signature operations are performed on the core operation parameters in the dedicated parameter set to generate multiple signature semi-finished products with key level weight imprints, including: Real-time monitoring of multiple indicators of the computing environment as the initial parameters of the chaotic system, dynamically generating weights of sub-private keys at different key levels through chaotic mapping; Combining optical calculation with electronic calculation, using dynamically generated weights to perform weighted signature calculation on the core calculation parameters in the exclusive parameter set; The signature operation process is verified based on zero-knowledge proof technology. If the verification is successful, multiple semi-finished signatures with key level weight imprints are obtained.

[0036] In this embodiment, before performing the signature operation, multiple key indicators of the computing environment need to be monitored in real time, including but not limited to the current load of the system, available computing resources, network bandwidth, and real-time delay of data transmission, etc. These indicators fully reflect the real-time status of the computing environment.

[0037] The above indicators monitored in real time are used as the initial parameters of the chaotic system. The chaotic system is extremely sensitive to initial conditions, and a small change in the initial parameters will lead to a huge difference in the system output. By utilizing this characteristic of the chaotic system, the generation of the sub-private key weight is highly random and unpredictable. The chaotic system processes the initial parameters through chaotic mapping, which is a nonlinear transformation that can perform complex iterative operations on the initial parameters in the chaotic space. After chaotic mapping, the weights of the sub-private keys at different key levels are dynamically generated. Due to the inherent randomness of the chaotic system and its sensitivity to initial conditions, the weights generated each time are unique and difficult to be predicted by external attackers, thus providing an additional layer of security for the signature operation. This method of dynamically generating weights can flexibly adjust the importance of the sub-private key in the signature operation according to the real-time changes in the operation environment, ensuring that the signature process can maintain high security and adaptability under different environmental conditions.

[0038] Combining optical computing with electronic computing, using dynamically generated weights to perform weighted signature operations on the core computing parameters in the exclusive parameter set: This step innovatively combines the two technologies of optical computing and electronic computing. Optical computing has the ability to process data in parallel at high speed, and can handle a large amount of data operations in a short period of time, and is particularly suitable for processing some computing tasks that require extremely high speed. Electronic computing has advantages in logical control and precise numerical calculations, and the combination of the two can give full play to their respective strengths.

[0039] Based on the weights of the sub-private keys of different key levels dynamically generated in the first step, weighted signature operations are performed for the core operation parameters in the exclusive parameter set. For sub-private keys of high key levels, the high-speed parallelism of optical computing is used to perform complex encryption operations on the core operation parameters to give full play to their important role in the signature process and ensure the security of the signature; for sub-private keys of low key levels, relatively simple operations are performed using electronic computing, which not only ensures the accuracy of the operations but also saves computing resources to a certain extent. This method of combining the two calculation methods and performing differentiated operations based on the weights of the sub-private keys not only improves the efficiency of the signature operation, but also takes into account the security requirements of sub-private keys of different key levels in the signature process, achieving a balance between security and efficiency.

[0040] The above zero-knowledge proof technology is a technology that proves a statement to the verifier that it is true without revealing any actual information. In the signature operation process, the zero-knowledge proof technology is used to ensure that the verifier is sure that the signature operation process is correct and legal without revealing the specific details of the signature operation (such as the weight of the sub-private key, the specific values ​​of the core operation parameters, and the intermediate results in the operation process). The verification process is based on the zero-knowledge proof protocol. The verifier verifies the proof provided by the signer through a series of verification steps and challenge-response mechanisms. If the verification is successful, it means that the signature operation process meets the expected security and correctness requirements, and multiple semi-finished signatures with key level weight imprints are obtained. The above semi-finished signatures not only contain the weight information corresponding to the key level of the sub-private key, but also undergo strict verification to ensure their reliability and integrity. This verification process based on zero-knowledge proof technology further enhances the security and privacy protection of the signature process, prevents the leakage of key information in the signature operation process, and ensures the quality and credibility of the semi-finished signatures.

[0041] In one embodiment, all semi-finished signature products are integrated to obtain a finished signature product, and after signing the data to be signed, the process includes: Generate a first matrix based on the attributes of the data to be signed; generating a second matrix based on the exclusive parameter set; Based on the first matrix, transform the second matrix to obtain a transformation matrix; A transformation key is generated based on the transformation matrix, and each of the sub-private keys, the semi-finished signature product and the finished signature product is encrypted and stored based on the transformation key.

[0042] In this embodiment, first, the attributes of the data to be signed include various information such as data type, data length, key elements, etc. These attributes are quantified and encoded to be converted into a matrix form. For example, for data types, a unique hot encoding method can be used to map different types to specific vectors in the matrix; the data length can be normalized and used as a dimension value in the matrix; the key elements are filled into the corresponding positions of the matrix in a specific numerical form according to their importance and characteristics. The generated first matrix can comprehensively and concisely represent the attribute characteristics of the data to be signed, and provide a basis for subsequent matrix transformation and encryption operations based on this. The generation method of this matrix is ​​intended to convert complex data attributes into a form that is convenient for mathematical operations and processing, so as to better establish connections with other data in the encryption storage link and enhance overall security.

[0043] The above-mentioned exclusive parameter set is a parameter set adapted to this signature task based on the attributes of the data to be signed and generated based on the SM9 algorithm, which contains important information such as core operation parameters. Similarly, the various parameters in the exclusive parameter set are sorted and digitally represented to construct a second matrix. For example, different parameters are arranged in order in different rows and columns of the matrix according to their roles and relationships in the algorithm. This matrix represents the specific parameter configuration used in this signature task, is the key basis for the signature operation, and is also an indispensable part of the subsequent encryption storage process. By converting the exclusive parameter set into a matrix form, it can be operated in the same mathematical space as the first matrix, providing the possibility of generating more complex and secure encryption transformations.

[0044] Furthermore, the first matrix is ​​used to transform the second matrix, and this process applies the relevant theories and methods of matrix operations. For example, matrix multiplication, addition or other more complex matrix transformation rules can be used to make targeted adjustments to the second matrix according to the attribute information of the data to be signed contained in the first matrix. Since the first matrix reflects the characteristics of the data to be signed, and the second matrix represents the exclusive parameters of the signature task, the second matrix is ​​transformed based on the first matrix, so that the generated transformation matrix can integrate the key information of the two, and the transformation matrix is ​​closely related to the current signature task and the data to be signed. This transformation of the parameter matrix based on data attributes increases the correlation between the encryption process and the specific signature task, making the encrypted information more difficult to crack, because the cracker not only needs to understand the encryption algorithm, but also needs to master the detailed attributes of the data to be signed in order to carry out an effective attack.

[0045] Finally, based on the transformation matrix, a transformation key is generated through a specific key generation algorithm. The algorithm uses the combination and arrangement of elements in the transformation matrix to generate a unique key through mathematical operations. Since the transformation matrix integrates the information of the attributes of the data to be signed and the exclusive parameter set, the generated transformation key is also highly relevant to this signature task and has strong pertinence. After obtaining the transformation key, the key is used to encrypt and store each sub-private key, semi-finished signature, and finished signature. The encryption process uses a suitable encryption algorithm, such as a symmetric encryption algorithm or an asymmetric encryption algorithm, to convert these important data into ciphertext form for storage. The purpose of this is to further protect the key information involved in the signing process and prevent it from being stolen or tampered with during the storage process. Even if the attacker obtains the stored data, due to the lack of the correct transformation key, the original sub-private key, semi-finished signature, and finished signature cannot be restored, thereby effectively ensuring the security and integrity of the signature data.

[0046] In one embodiment, based on the first matrix, transforming the second matrix to obtain a transformation matrix includes: Analyze each element of the first matrix, detect English character elements therefrom and connect them in sequence to obtain a first graph; Add the first graphic to the second matrix, and use the elements in the second matrix that overlap with the first graphic as transformation elements; Calculating the mean of the digital character elements in the first matrix; The mean value is added to each of the transformation elements in the second matrix to obtain a transformation matrix.

[0047] In this embodiment, the first matrix is ​​generated based on the attributes of the data to be signed, and the elements therein include various types, such as numeric characters, English characters, etc. The core purpose of this step is to filter out English character elements from the first matrix. The detected English character elements are connected according to their order in the first matrix. This connection method will combine the originally scattered characters into a whole with a specific meaning, namely the first graph. This first graph can be regarded as a feature identifier extracted from the attributes of the data to be signed, and it will serve as an important input in the subsequent matrix transformation process.

[0048] The above-mentioned second matrix is ​​generated based on an exclusive parameter set, which represents the specific parameter configuration used in this signature task. Adding the first graphic to the second matrix means integrating the characteristic identifier of the attribute of the data to be signed into the parameter matrix of the signature task. This addition operation can be regarded as a process of fusing the data attribute information with the signature parameters, so that subsequent transformations can comprehensively consider these two factors. After adding the first graphic to the second matrix, find the elements in the second matrix that overlap with the first graphic. These overlapping elements are selected as transformation elements because they are the parts where the data attribute characteristics and the signature parameters directly intersect. Transforming these elements can more effectively reflect the attribute information of the data to be signed in the final transformation matrix, thereby making the transformation matrix more in line with the actual needs of this signature task.

[0049] The digital character elements in the first matrix also contain important information about the attributes of the data to be signed. The mean of these digital character elements is calculated. This mean can be regarded as a comprehensive reflection of the digital features in the attributes of the data to be signed. It is used as an adjustment factor in the subsequent matrix transformation to adjust the transformation elements in the second matrix, thereby further integrating the attribute information of the data to be signed into the transformation matrix.

[0050] The mean of the digital character elements of the first matrix calculated above is added to each transformation element of the second matrix. In this way, the digital feature information of the attributes of the data to be signed is transferred to the key part of the second matrix (i.e., the transformation element). After such adjustment, the transformation element not only contains the exclusive parameter information of the signature task, but also incorporates the attribute characteristics of the data to be signed, thereby obtaining a brand new matrix, i.e., the transformation matrix. The above transformation matrix combines the attribute information of the data to be signed and the exclusive parameter information of the signature task. Subsequently, a transformation key will be generated based on this transformation matrix for encrypted storage of each sub-private key, semi-finished signature, and finished signature. Since the transformation matrix is ​​closely related to this signature task, the generated transformation key is also highly targeted and can better ensure the security and integrity of the signature data.

[0051] In one embodiment, generating a transformation key based on the transformation matrix includes: Map the elements in the transformation matrix to the quantum state space to construct a quantum matrix, use a quantum computer to simulate quantum fluctuations to perturb it, measure the disturbed quantum matrix, and extract the quantum eigenvector; Collect background noise and process it digitally to extract feature sequences; fuse them with quantum feature vectors through information entropy maximization algorithm to obtain fusion vectors; Input the fused vector into the pre-built simulated biological neural network and extract a stable and highly nonlinear output vector from the output layer; The space-time coding technology is used to determine the coding parameters by combining the geographic location and time information, and the output vector is processed to generate a transformation key containing the space-time identifier.

[0052] In this embodiment, the elements in the transformation matrix are mapped to the quantum state space, which is the process of converting classical information into quantum information. In the quantum state space, each element will exist in the form of a quantum bit, and multiple quantum bits are combined to form a quantum matrix. Quantum states have characteristics such as superposition and entanglement, which can bring advantages that classical computing does not have for subsequent processing, greatly increasing the complexity and security of information. Quantum computers are used to simulate quantum fluctuations and perturb the constructed quantum matrix. Quantum fluctuations are random fluctuations of energy and particles in a quantum system, and this uncertainty is simulated to act on the quantum matrix. The disturbed quantum matrix is ​​then measured, and since quantum measurements cause the quantum state to collapse, a set of definite measurement results is obtained. From these measurement results, quantum feature vectors are extracted, which contain the unique characteristics of the quantum matrix after being disturbed, and are an important basis for the subsequent generation of keys.

[0053] Various background noises are collected, such as cosmic microwave background noise, thermal noise of electronic devices, etc. These background noises are naturally random and unpredictable. The collected background noise is digitized and converted into digital signals that can be processed by computers, and feature sequences are extracted from them, which represent the main characteristics of the background noise. The feature sequence of the background noise is fused with the previously obtained quantum feature vector using the information entropy maximization algorithm. Information entropy is an indicator of information uncertainty. Through this algorithm, the fused vector can have the maximum information entropy, that is, the maximum randomness and uncertainty. The fused vector obtained in this way further enhances the complexity and security of the information.

[0054] A simulated biological neural network is pre-built, which is a simulation of the working mode of neurons in the biological brain. The network consists of a large number of neuron nodes and synapses connecting these nodes, and has powerful information processing and learning capabilities. Input the fusion vector into this simulated biological neural network, and the neurons in the network will process and transmit the input information according to their own weights and biases. After multiple iterations and adjustments, the network will gradually reach a stable state. A stable and highly nonlinear output vector is extracted from the output layer of the network. Due to the nonlinear characteristics of biological neural networks, this output vector contains complex information processing results, which increases the uniqueness and security of the key.

[0055] The spatiotemporal coding technology is used to determine the coding parameters in combination with the current geographic location and time information. The geographic location information can be obtained through the global positioning system (GPS), and the time information can be obtained from the precise clock system. Different geographic locations and times will correspond to different coding parameters, adding the spatiotemporal dimension to the key. The output vector obtained above is processed using the determined coding parameters to integrate the spatiotemporal information into the vector. After processing, a transformation key containing the spatiotemporal identifier is finally generated. This key with a spatiotemporal identifier is not only closely integrated with the information related to the signature task, but also further increases the uniqueness and security of the key, making the key more difficult to crack and forge.

[0056] In one embodiment, generating a transformation key based on the transformation matrix includes: Extract all digital elements in the first matrix and generate a first digital sequence according to a preset rule; extract all digital elements in the second matrix and generate a second digital sequence according to a preset rule; Extracting one number from the first digital sequence and the second digital sequence in sequence to form corresponding coordinate points; connecting the coordinate points to generate a connection graph; Combining the digital elements in the transformation matrix into a third digital sequence, and generating a plurality of target coordinate points based on the third digital sequence; In the same coordinate system, according to the positional relationship between each of the target coordinate points and the connection graph, a coordinate point that meets the preset conditions is selected from the target coordinate points as the key coordinate point; The transformation key is generated based on the numbers in the respective key coordinate points.

[0057] In this embodiment, the first matrix is ​​generated based on the attributes of the data to be signed, which contains various types of elements, such as numbers, letters, symbols, etc. This step focuses on screening out all digital elements. This is because digital elements usually contain quantitative information related to the data to be signed, and can be used as a key data source in the subsequent generation of transformation keys. The extracted digital elements are arranged and combined according to preset rules to form a first digital sequence. The preset rules can be the order of appearance of the digital elements in the matrix, the order of the rows or columns, etc. For example, if the matrix elements are arranged in row priority order, the digital elements of the first row will be arranged in sequence, and then the digital elements of the second row will be arranged, and so on. This first digital sequence provides a set of digital foundations for the subsequent construction of coordinate points.

[0058] The second matrix is ​​generated based on a dedicated parameter set and may also contain multiple elements. The digital elements are extracted, which represent the quantitative information of the specific parameters used in this signature task, which is crucial to generating the transformation key. Similar to the generation of the first digital sequence, the digital elements in the second matrix are arranged according to preset rules to form a second digital sequence. The preset rules here can be the same as when generating the first digital sequence, or they can be adjusted according to specific needs. The second digital sequence cooperates with the first digital sequence to generate coordinate points.

[0059] In mathematics, coordinate points are usually represented by two numbers, the horizontal coordinate and the vertical coordinate, respectively. In this step, a number is taken out from the first number sequence as the horizontal coordinate, and a number is taken out from the second number sequence as the vertical coordinate, and the two numbers are combined to form the corresponding coordinate point. For example, the first number of the first number sequence and the first number of the second number sequence form the first coordinate point, the second number of the first number sequence and the second number of the second number sequence form the second coordinate point, and so on. In this way, the two number sequences are converted into a series of coordinate points in the coordinate system, and these coordinate points form a graphical basis with a specific distribution.

[0060] Connect the previously generated coordinate points in a certain order (such as the order of generation) in the coordinate system. After connecting these coordinate points, a connection graph with a specific shape will be formed. The shape and characteristics of this connection graph depend on the digital elements in the first matrix and the second matrix and the preset digital sequence generation rules. It is a visual embodiment of the attributes of the data to be signed and the exclusive parameter set information. The key coordinate points will be screened based on this connection graph in the future.

[0061] The transformation matrix is ​​obtained through a series of matrix transformation operations, which integrates the information of the attributes of the data to be signed and the exclusive parameter set. The digital elements in the transformation matrix are combined into a third digital sequence according to certain rules (such as row priority or column priority). Multiple target coordinate points are generated based on the third digital sequence. A similar method to the generation of the previous coordinate points can be used, such as combining the numbers in the third digital sequence in pairs to form coordinate points. These target coordinate points represent another representation of the information contained in the transformation matrix, which is used for subsequent comparison of the positional relationship with the connection graph.

[0062] Place all target coordinate points and connection graphics in the same coordinate system, and calculate the relative position relationship between the target coordinate point and the connection graphics, such as determining whether the target coordinate point is inside or outside the connection graphics or the distance from the graphics boundary. The preset conditions can be set according to the requirements of security and key generation, such as selecting coordinate points inside the connection graphics, or selecting coordinate points within a certain range from the connection graphics boundary. According to the preset conditions, select the coordinate points that meet the requirements from all target coordinate points, and use these coordinate points as key coordinate points. These key coordinate points integrate the information of the attributes of the data to be signed, the exclusive parameter set, and the matrix transformation, and are the key data for generating the transformation key.

[0063] The numbers in each key coordinate point are combined and processed according to certain rules, such as arranging the horizontal and vertical coordinates of the coordinate points in sequence, or performing specific mathematical operations (such as summation, multiplication, etc.), and finally generating a transformation key. This transformation key is unique and closely related to this signature task, and can be used to encrypt and store each sub-private key, semi-finished signature, and finished signature to ensure the security of signature data.

[0064] Reference Figure 2 In another embodiment of the present invention, there is also provided an efficient signature system based on the SM9 algorithm, comprising: An acquisition unit, used to acquire the attributes of the data to be signed; A generating unit, configured to generate a dedicated parameter set adapted to the current signature task based on the SM9 algorithm according to the attributes of the data to be signed; the dedicated parameter set includes core operation parameters adapted to the attributes; The splitting unit is used to split the master private key into multiple sub-private keys with different key levels. The key level of each sub-private key is dynamically set according to the risk of this signature task. A computing unit, configured to perform weighted signature computing on the core computing parameters in the exclusive parameter set based on the sub-private keys of different key levels, and generate a plurality of semi-finished signature products with key level weight imprints; The signature unit is used to integrate all the semi-finished signatures to obtain the finished signatures in order to sign the data to be signed.

[0065] In this embodiment, for the specific implementation of each unit in the above system embodiment, please refer to the above method embodiment, which will not be repeated here.

[0066] Reference Figure 3 In an embodiment of the present invention, a computer device is also provided. The computer device may be a server, and its internal structure may be as follows: Figure 3 As shown. The computer device includes a processor, a memory, a display screen, an input device, a network interface and a database connected through a system bus. Among them, the processor designed by the computer is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store the corresponding data in this embodiment. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the above method is implemented.

[0067] Those skilled in the art will understand that Figure 3 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present invention, and does not constitute a limitation on the computer device to which the solution of the present invention is applied.

[0068] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the above method is implemented. It can be understood that the computer-readable storage medium in this embodiment can be a volatile readable storage medium or a non-volatile readable storage medium.

[0069] In summary, the efficient signature method and system based on the SM9 algorithm provided in the embodiment of the present invention include: obtaining the attributes of the data to be signed; generating an exclusive parameter set adapted to this signature task based on the SM9 algorithm according to the attributes of the data to be signed; the exclusive parameter set includes core operation parameters adapted to the attributes; splitting the master private key to obtain multiple sub-private keys with different key levels; the key level of each sub-private key is dynamically set according to the risk hazards of this signature task; based on the sub-private keys of different key levels, weighted signature operations are performed for the core operation parameters in the exclusive parameter set respectively, and multiple signature semi-finished products with key level weight imprints are generated; all signature semi-finished products are integrated to obtain signature finished products to sign the data to be signed. In the present invention, an exclusive parameter set is generated according to the attributes of the data to be signed, the master private key is flexibly split and the signature operation is performed in a targeted manner, and differentiated digital signatures are generated for different data to be signed, thereby improving the security, efficiency and adaptability of digital signatures.

[0070] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided by the present invention and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double-speed data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM.

[0071] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.

[0072] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. An efficient signature method based on the SM9 algorithm, characterized in that: The following steps are involved: Get the attributes of the data to be signed; According to the attributes of the data to be signed, a dedicated parameter set adapted to this signature task is generated based on the SM9 algorithm; the dedicated parameter set includes core operation parameters adapted to the attributes; The master private key is split to obtain multiple sub-private keys with different key levels. The key level of each sub-private key is dynamically set according to the risk of this signing task. Based on the sub-private keys of different key levels, weighted signature operations are performed on the core operation parameters in the exclusive parameter set to generate multiple signature semi-finished products with key level weight imprints; Integrate all the semi-finished signatures to obtain the finished signatures to sign the data to be signed.

2. The efficient signature method based on the SM9 algorithm according to claim 1, characterized in that: The attributes of the data to be signed include the data type, data length, and key elements in the data.

3. The efficient signature method based on the SM9 algorithm according to claim 1, characterized in that: According to the attributes of the data to be signed, a dedicated parameter set adapted to this signature task is generated based on the SM9 algorithm, including: Analyze the attributes of the data to be signed, identify the sensitivity of the data to be signed, and mark it; Based on the mark, the corresponding basic parameter template in the SM9 algorithm is retrieved; Adjust the hash function parameters in the basic parameter template in combination with the data length of the data to be signed; Based on the adjusted parameter template, the current system timestamp information is integrated, the random number generation parameters in the parameter template are calibrated, and a dedicated parameter set adapted to this signature task is generated.

4. The efficient signature method based on the SM9 algorithm according to claim 1, characterized in that: The master private key is split into multiple sub-private keys with different key levels, including: Analyze the risk level of the data to be signed; Determine the number of splits of the master private key and the key level of the sub-private key according to the risk level of the data to be signed; Based on the number of splits, the master private key is split using the Shamir secret sharing algorithm to obtain a corresponding number of sub-private keys; Each sub-private key is marked with the corresponding key level information, and different storage strategies are configured for sub-private keys of different key levels; among them, the sub-private keys of the highest key level are stored in a secure storage device with multiple encryption and physical isolation, and integrity verification and backup are performed regularly.

5. The efficient signature method based on the SM9 algorithm according to claim 1, characterized in that: Based on the sub-private keys of different key levels, weighted signature operations are performed on the core operation parameters in the exclusive parameter set to generate multiple semi-finished signatures with key level weight imprints, including: Real-time monitoring of multiple indicators of the computing environment as the initial parameters of the chaotic system, dynamically generating weights of sub-private keys at different key levels through chaotic mapping; Combining optical calculation with electronic calculation, using dynamically generated weights to perform weighted signature calculation on the core calculation parameters in the exclusive parameter set; The signature operation process is verified based on zero-knowledge proof technology. If the verification is successful, multiple semi-finished signatures with key level weight imprints are obtained.

6. The efficient signature method based on the SM9 algorithm according to claim 1, characterized in that: All semi-finished signatures are integrated to obtain the finished signatures, which include: Generate a first matrix based on the attributes of the data to be signed; generating a second matrix based on the exclusive parameter set; Based on the first matrix, transform the second matrix to obtain a transformation matrix; A transformation key is generated based on the transformation matrix, and each of the sub-private keys, the semi-finished signature product and the finished signature product is encrypted and stored based on the transformation key.

7. The efficient signature method based on the SM9 algorithm according to claim 6, characterized in that: Based on the first matrix, transforming the second matrix to obtain a transformation matrix includes: Analyze each element of the first matrix, detect English character elements therefrom and connect them in sequence to obtain a first graph; Add the first graphic to the second matrix, and use the elements in the second matrix that overlap with the first graphic as transformation elements; Calculating the mean of the digital character elements in the first matrix; The mean value is added to each of the transformation elements in the second matrix to obtain a transformation matrix.

8. An efficient signature system based on the SM9 algorithm, characterized in that: include: An acquisition unit, used to acquire the attributes of the data to be signed; A generating unit, configured to generate a dedicated parameter set adapted to the current signature task based on the SM9 algorithm according to the attributes of the data to be signed; the dedicated parameter set includes core operation parameters adapted to the attributes; The splitting unit is used to split the master private key into multiple sub-private keys with different key levels. The key level of each sub-private key is dynamically set according to the risk of this signature task. A computing unit, configured to perform weighted signature computing on the core computing parameters in the exclusive parameter set based on the sub-private keys of different key levels, and generate a plurality of semi-finished signature products with key level weight imprints; The signature unit is used to integrate all the semi-finished signatures to obtain the finished signatures in order to sign the data to be signed.

Images