Small-size linear homomorphic signature method and system for post-quantum security

Abstract

The invention belongs to the technical field of quantum security, and discloses a small-size linear homomorphic signature method and system for post-quantum security, which completely eradicates the loss of integrity / authenticity of original basic data without verifying the integrity of each data item one by one. The deception that a remote untrusted computing party does not compute is avoided, and the computing work of the computing party does not need to be repeated for verification; a calculation result transmission error is avoided; and quantum computer attack is resisted. According to the invention, a lattice-based linear homomorphic signature algorithm under a standard model is designed, and compared with the related work, the algorithm has the advantage of small size of a public key.

Description

Technical Field

[0001] The present invention belongs to the field of quantum security technology, and in particular relates to a post-quantum secure small-size linear homomorphic signature method and system. Background Art

[0002] In the context of the gradual development of quantum computing technology, the core problem of existing linear homomorphic signature technology is that its security is based on traditional mathematical problems, such as discrete logarithm problem or RSA, which will fail in quantum computing environment. Lattice cryptography, as an emerging cryptographic method, has the ability to resist quantum computing because the mathematical problems it relies on (such as the shortest vector problem, the nearest vector problem, etc.) remain difficult under quantum computing. However, although some linear homomorphic signature algorithms based on lattice problems have been proposed, such as Boneh and Freeman's lattice algorithm, these algorithms still need to be further optimized and improved in terms of efficiency, practicality and public key size.

[0003] At the same time, in order to cope with the threat of quantum computing, researchers are actively exploring new quantum-resistant cryptographic algorithms and trying to apply them to linear homomorphic signature schemes. These efforts aim to design a linear homomorphic signature scheme that is provably secure under the standard model and quantum-resistant, in order to solve the problem that existing technologies may fail completely due to their reliance on traditional mathematical problems.

[0004] In the random oracle model, the hash function is regarded as a completely random function, and the adversary cannot predict its output. This model provides great convenience for the design of cryptographic algorithms because it simplifies the security proof process. Under the random oracle model, a variety of linear homomorphic signature algorithms have been designed, including single-source and multi-source cases. However, the security of this model relies on a certain probability guarantee, and the adversary's attack in the real environment may be different from the assumptions in the model, resulting in security defects.

[0005] In order to be closer to the real-world usage environment, researchers have designed a variety of linear homomorphic signature schemes under the standard model (without relying on random oracles). The security of these schemes is based on specific mathematical problems, such as the discrete logarithm problem or the mathematical problem of RSA. Representative works include Catalano, Fiore, and Warinschi's algorithms based on bilinear groups and RSA, Freeman's algorithm, and Attrapadung and Libert's algorithms. While these algorithms solve the security limitations of random models, they also face the threat of quantum computers.

[0006] In summary, although the random oracle model simplifies the security proof process, its security may not be guaranteed in the real environment. Although the algorithm under the standard model solves the security problem of the random model, it still needs to cope with the challenge of quantum computing. Therefore, designing a linear homomorphic signature scheme that can maintain security under the standard model and resist the threat of quantum computing is an important direction of current cryptographic research. Summary of the invention

[0007] In view of the problems existing in the prior art, the present invention provides a post-quantum secure small-size linear homomorphic signature method and system.

[0008] The present invention is implemented as follows: a post-quantum secure small-size linear homomorphic signature method comprises:

[0009] Step 1, parameter generation;

[0010] Step 2, signature generation;

[0011] Step 3, signature verification;

[0012] Step 4: Linear homomorphic computation.

[0013] Further, the parameters are generated:

[0014] enter

[0015] n: security parameters of the system;

[0016] r max : Label describing the data, r max <<n

[0017] Output

[0018] Public Key

[0019] Private Key

[0020] 1) Generate device Setup(1 n )

[0021] Explanation 1: The upper limit of the number of plaintexts and signatures included in a single data packet, where plaintexts and signatures correspond one to one;

[0022] 2) Detailed description of the matrix G generating device G-Gen(q,l,k);

[0023] enter

[0024] (q,l,k):q is the number field where the matrix G is located l is the number of rows of matrix G; l·k is the number of columns of matrix G;

[0025] Output

[0026] matrix satisfy and

[0027] 3) Detailed description of the [A, R] generation device;

[0028] Note: This is the first generation method: integer Discrete Gaussian sampling generation method on

[0029] enter

[0030] (q,l,k,G):q is the number field where matrices A and G are located l is the number of rows of matrix G; l·k is the number of columns of matrix R and G;

[0031] Output

[0032]

[0033] satisfy

[0034] The matrix A and Random uniform matrices on are indistinguishable;

[0035] 4) Detailed description of the [A, R] generation device;

[0036] Note: This is the second generation method: Bernoulli generation method on binary {0,1}

[0037] enter

[0038] (q,l,k,G):q is the number field where matrices A and G are located l is the number of rows of matrix G; l·k is the number of columns of matrix R and G;

[0039] Output

[0040]

[0041] satisfy

[0042] The matrix A and A random uniform matrix on is not differentiable.

[0043] Further, the signature is generated:

[0044] enter

[0045] Public Key

[0046] Private Key

[0047] Plaintext message to be signed

[0048] τ∈{0,1} r : a label describing the data (e.g. “city employee salary”), |τ\≤r max +1

[0049] i∈[1,2,…,k]: plaintext message The sequence number in the dataset

[0050] Output

[0051] Successful execution, output signature

[0052] Execution failed, output "⊥"

[0053] 1) A specific description of the signature generation device {σ / ⊥}←Sign(PK,SK,m,τ,i); Figure 8 As shown;

[0054] 2) Trapdoor expansion device Detailed description of

[0055] enter

[0056] matrix

[0057]

[0058] Output

[0059] satisfy

[0060] 3) Generate an orthogonal lattice from the trapdoor R Detailed description of Geki's device:

[0061] enter

[0062] matrix It is the lattice basis of the matrix G;

[0063] It is the R-trapgate of the matrix A;

[0064] Output

[0065] Satisfy A.S. A =0 mod q;

[0066]

[0067] Specific description;

[0068] Similarly,

[0069]

[0070] Further, the signature verification:

[0071] enter

[0072] Public Key τ∈{0,1} r : Label describing the data, |τ|≤r max +1

[0073] {m,σ}: plaintext message And the corresponding signature Description of the linear function f: Output

[0074] Verification is successful, output "1"

[0075] Verification fails and outputs “⊥”.

[0076] Furthermore, the linear homomorphic calculation:

[0077] Linear homomorphic computing device:

[0078] enter

[0079] Public Key τ∈{0,1} r : a label describing the data (e.g. “city employee salary”), |τ|≤r max +1 for the description of the linear function f: A set of data marked by data label τ and a corresponding set of signatures The linear combination of σ=∑c i ·σ i

[0080] i∈[1,2,…,k]: plaintext message In the dataset The serial number in

[0081] Output

[0082] Successful execution, output a set of data marked by data label τ The corresponding set of signatures The linear combination of σ=∑c i ·σi

[0083] Execution failed, output "⊥".

[0084] Further, the linear homomorphic computing device {σ / ⊥}←Evaluate(PK,SK,m,τ,i).

[0085] Another object of the present invention is to provide a post-quantum secure small-size linear homomorphic signature system comprising:

[0086] Parameter generation module, used for parameter generation;

[0087] Signature generation module, used for signature generation;

[0088] Signature verification module, used for signature verification;

[0089] Computation module, used for linear homomorphic computation.

[0090] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the post-quantum secure small-size linear homomorphic signature method.

[0091] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to perform the steps of the post-quantum secure small-size linear homomorphic signature method.

[0092] Another object of the present invention is to provide an information data processing terminal, which is used to implement the post-quantum secure small-size linear homomorphic signature system.

[0093] The present invention also provides that the data label is τ, |τ|=r <r max ; The data set size is k. Under the standard model and in the scope of post-quantum security, the publicly visible work related to this patent includes the following two items:

[0094] [CLQ16]

[0095] (1) Its public key is (2r max +1) matrices and k vectors; it requires and Select two random matrices as public keys respectively, so (2r max +1) matrices.

[0096] (2) The signature is an n-dimensional vector of r times the size. This is due to two reasons:

[0097] First, for the 2r in the public key max Random Matrix There is no aggregation when signing, it is used independently and pieced together into a whole A τ Here A τ The dimension is (r max +1)·n-dimensional;

[0098] Secondly, it is precisely because A τ The dimension is (r max +1)·n, the signature σ obtained when signing, and its size is r of n max times bigger.

[0099] [LXYHL20]

[0100] Its public key is 2 matrices and k vectors; under the same security parameter n, the signature is a 2n-dimensional vector of twice the size, while this patent only requires 1 n-dimensional vector. The left side of the figure below shows the parameter generation process, and the right side shows the signature process. Specific reason analysis, cost and comparison:

[0101] (1) Public key generation is based on two random matrices U and V and the so-called “full rank difference hash”

[0102] The hash function requires that for two different data labels τ≠τ', Δ=H(τ)-H(τ'), and the difference It is still full rank, that is, its rank is n.

[0103] (2) Under the assumption that Δ = H(τ) - H(τ') is full rank, construct This allows it to be used during the security proof process thereby Here R is an m-dimensional random matrix, so we get Uniformly indistinguishable.

[0104] (3) The cost of introducing the difference full rank hash function is that [LXYHL20] has to introduce another traditional signature algorithm to sign τ in the homomorphic signature (so [LXYHL20] needs two different private keys (sk, sk') to realize the separate signature authentication of (τ, m); this results in two signature components, namely (σ τ ,σ m ): Here σ m is a truly homomorphic signature of the plaintext message m, and σ τ It is the signature of τ using the traditional signature algorithm.

[0105] In comprehensive comparison,

[0106] First, although the public key matrix of [LXYHL20] becomes a constant of 2, it requires the construction of two sets of public key systems to realize the separate signature authentication of (τ, m);

[0107] Secondly, parameter generation only needs to be done once, but after the system is established, signatures are required multiple times, resulting in greater overhead in calculating, generating, storing, transmitting, and verifying twice the size of the signature each time.

[0108] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0109] First, existing linear homomorphic signature methods are mostly based on traditional mathematical problems such as discrete logarithm problems or RSA, and these algorithms will fail in a quantum computing environment. This invention introduces a design framework based on lattice theory to provide a small-size linear homomorphic signature scheme that is quantum-safe under the standard model, significantly enhancing the ability to resist quantum computing attacks and solving the problem that existing technologies cannot meet quantum security requirements.

[0110] The quantum-resistant signature schemes in the prior art often have the problem of too large a public key size, which limits their application in environments with limited storage and communication resources. The present invention optimizes the design of the signature scheme, significantly reduces the size of the public key, makes it more suitable for actual industrial scenarios and distributed systems, and solves the bottleneck problem of too large a public key size in the prior art.

[0111] Linear homomorphic signature schemes under the standard model usually face the problem of low efficiency and are difficult to meet the security and performance requirements in actual industrial applications at the same time. This invention improves the computing efficiency while ensuring strict security by optimizing the design process of signature generation, verification and homomorphic calculation, thus solving the contradiction between performance and security in the prior art.

[0112] The linear homomorphic signature scheme in the prior art lacks flexibility in processing large-scale data and complex linear calculations, which limits its application in multiple data sources and multiple calculation scenarios. The present invention designs a more efficient signature linear combination calculation mechanism, which makes data operations and signature calculations more flexible and adaptable, and significantly improves the practicality and scalability of the scheme in actual industrial applications.

[0113] Second, based on the concept that "data is the fifth major production factor", the present invention proposes a technical solution for measuring abstract computing in a low-cost, open and verifiable manner. Among traditional production factors, the value of land and capital can be directly reflected through market pricing, but for abstract computing, the results must be "measured" before transactions can be formed. Just like supermarkets use "scales" to weigh apples, data and computing also need a reliable "measurement" mechanism to realize the commercialization of computing under the division of labor, cooperation and market environment. With the accelerated development of the digital society, the separation trend between data owners, computing parties and users of computing results has become increasingly obvious. Whether the computing results can be measured in a "correct, verifiable and low-cost" way will directly determine whether computing can become a tradable commodity.

[0114] In order to meet the two key requirements of "correctness" and "verifiability", the present invention starts with the simplest but most versatile linear calculation, and cleverly combines "calculation" and "signature" by introducing linear homomorphic signature technology. Specifically, without having to master the original data signature private key, the calculation can be performed on the original data to perform arbitrary linear function calculations, and at the same time produce a signed result; the user only needs to use the public key to quickly verify the result returned by the calculation party. If the verification passes, it means that the result is consistent with the linear relationship of the original data in a mathematical sense and has not been tampered with, and the calculation can be confirmed to be correct without comparing each original data one by one. This low-cost and publicly verifiable feature opens up the entire process of "calculation → measurement → transaction", providing solid technical support for the commercialization of computing.

[0115] The present invention not only opens up a new path for the commercialization of computing in terms of concept, but also achieves comprehensive advantages over similar technologies in terms of specific implementation details. The system of the present invention no longer requires "two sets of coupled signature systems to be nested", and the function of linear homomorphic signature can be realized with only a single solution. These technical features not only fill the gap in the field of "computational verifiability and commercialization" in the domestic and foreign industries, but also provide a more efficient and low-cost solution for future large-scale computing in government affairs, scientific research and commercial applications.

[0116] In the past, people generally believed that if they wanted to obtain reliable calculation results, they had to first possess all the data and complete the calculations by themselves, which has become a major obstacle at a time when the demand for cloud computing, big data and privacy protection is growing. The present invention breaks the technical prejudice that "only when you possess the data can you calculate" by optimizing key parameters such as public keys, signature sizes and system settings, so that the calculation party can perform correct and verifiable linear calculations without having to possess the signature private key of the original data, and the user can quickly verify its correctness with only the public key. This makes abstract calculations truly enter the market transaction in a "verifiable and low-cost" way, achieving the leap from 0 to 1 in the commercialization of computing. This not only achieves comprehensive optimization in technology, but also opens up new development space for data applications, cloud collaboration and privacy computing in the digital economy era. BRIEF DESCRIPTION OF THE DRAWINGS

[0117] Figure 1 This is a flow chart of a post-quantum secure small-size linear homomorphic signature method provided by an embodiment of the present invention.

[0118] Figure 2 This is a structural block diagram of a small-size linear homomorphic signature system with post-quantum security provided by an embodiment of the present invention.

[0119] Figure 3 The generation device Setup(1) provided in the embodiment of the present invention n ) is a detailed description diagram.

[0120] Figure 4 It is a specific description diagram of the matrix G generating device G-Gen(q,l,k) provided in an embodiment of the present invention.

[0121] Figure 5 It is a specific description diagram of the [A, R] generating device provided in an embodiment of the present invention.

[0122] Figure 6 It is a specific description diagram of the [A, R] generating device provided in an embodiment of the present invention.

[0123] Figure 7 It is a specific description diagram of the signature generation device provided in an embodiment of the present invention.

[0124] Figure 8 It is a specific description diagram of the signature generation device {σ / ⊥}←Sign(PK,SK,m,τ,i) provided in an embodiment of the present invention.

[0125] Fig. 9 The trapdoor expansion device provided by the embodiment of the present invention Detailed description diagram.

[0126] Fig.10 The embodiment of the present invention provides an orthogonal grid generated from a trapdoor R. A detailed description of Geji's device.

[0127] Fig.11 The signature verification device provided by the embodiment of the present invention is {1 / ⊥}←Verify(PK,m,σ,τ, <f>) is a detailed description diagram.

[0128] Fig.12 It is a specific description diagram of the linear homomorphic computing device {σ / ⊥}←Evaluate(PK,SK,m,τ,i) provided in an embodiment of the present invention.

[0129] Fig.13 This is a distribution statistics diagram of private keys provided by an embodiment of the present invention.

[0130] Fig.14 It is a verification diagram for a linear homomorphic computation signature provided by an embodiment of the present invention.

[0131] Fig.15 It is a graph of average running time of each stage of the algorithm under different security strengths provided by the embodiment of the present invention.

[0132] Fig.16 It is a general effect diagram of the present invention provided by the embodiments of the present invention.

[0133] Fig.17 It is a comparison diagram of the operation of four stages provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0134] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0135] In a distributed wage payment system, companies need to sign employees' wage details and submit them to the blockchain network while ensuring the integrity of the data. However, the traditional signature scheme is not secure enough under quantum computing attacks and is difficult to meet future needs. The present invention provides a safe and reliable solution for distributed wage payment through a post-quantum secure linear homomorphic signature method based on lattice theory. The system administrator first generates a public key and a private key. The public key is used to distribute to the wage management and accounting modules, and the private key is used to sign the wage details of each employee to ensure that the data cannot be tampered with.

[0136] The salary management module generates corresponding signatures based on the salary details of each employee. Specifically, the salary details include data such as basic salary, bonus and tax rate. After the system signs the detailed information with a private key, it ensures that the generated signature is both small in size and meets post-quantum security requirements. The signed salary data can be securely stored and transmitted to prevent tampering or forgery in the distributed network. At the same time, the efficiency of the signature method reduces system resource consumption, making it suitable for widespread application in the distributed environment of enterprises.

[0137] In the process of salary calculation, the linear homomorphism of the present invention enables the system to directly perform linear calculations on the signed salary data, such as calculating the total salary, the amount of tax deduction, or the average salary. Without accessing the original data, the system can quickly output the calculation results through the linear combination signature and generate a new signature. This feature not only improves the accounting efficiency, but also avoids the risk of exposing the original data in traditional methods.

[0138] Finally, before submitting the salary details and calculation results to the blockchain, the system uses the public key to verify all signatures to ensure data integrity and authenticity. After verification, the data is written to the blockchain for employees and enterprises to review. The post-quantum secure linear homomorphic signature scheme of the present invention not only improves the security, efficiency and flexibility of the salary payment system, but also provides strong support for distributed payment scenarios.

[0139] 1. Linear Homomorphic Signature:

[0140] 1. Functional description of linear homomorphic signature scheme

[0141] A linear homomorphic signature scheme:

[0142] For an n-dimensional plaintext vector Linear homomorphic signature gets a signature here is a finite field;

[0143] Let us remember a set of k n-dimensional plaintext vectors {m1,…,m k }, and the corresponding k signatures are {σ1,…,σ k }. The linear homomorphism property means that: given k signatures {σ1,…,σ k }, anyone (without the private key sk) can generate a linear space generated by these k plaintext vectors Any vector in The signature of Any vector other than Signature.

[0144] A real application scenario is as follows:

[0145] The Municipal Finance Bureau has the salary records of all employees in the city {m1,…,m k }, where k is the total number of "all employees".

[0146] The Finance Bureau signs each person's salary to indicate the authenticity and integrity of the salary data, forming the following triplet:

[0147] Data label τ (salary, employee number) sign τ = "Monthly salary record" <![CDATA[m1]]> <![CDATA[σ1=Sign sk (t,m1)]]> τ = "Monthly salary record" <![CDATA[m2]]> <![CDATA[σ2=Sign sk (τ,m2)]]> … … … τ = "Monthly salary record" <![CDATA[m k ]]> <![CDATA[σ k =Sign sk (τ,m k )]]>

[0148] The table is stored on a remote cloud server for the relevant departments to conduct in-depth macroeconomic data mining. i ,σ i ) ensures the authenticity and integrity of the original data on monthly income of the city’s employees.

[0149] Average monthly income of all employed persons in the city:

[0150] To prevent the remote cloud server from cheating without calculation, for example, the remote cloud server arbitrarily returns "the average salary of the city is 7835" without calculation, causing distortion of macroeconomic data and affecting decision-making;

[0151] The linear homomorphic signature technology solves this problem as follows:

[0152] The remote cloud server returns a signature

[0153] receive After that, according to the verification algorithm of linear homomorphic signature, if the verification is successful, it can be confirmed that the remote cloud server has truly and correctly calculated the average monthly income m of the city's employees. It is not necessary to verify the authenticity of the wages of all employees one by one, that is, to verify them one by one (m i ,σ i )’s authenticity and completeness.

[0154] 2. Terminology Explanation: Basic Concepts and Conclusions about Case

[0155] 1. An n-dimensional lattice is The full-rank additive subgroup in An additive subgroup of full rank in ;

[0156] Equivalently, the lattice is composed of n linearly independent vectors generated, where B is called the generating basis of the lattice Λ. There are infinitely many sets of generating bases that generate the same lattice Λ. Representation vector The quadratic paradigm.

[0157] 2. For integers q ≥ 2, a matrix with l rows and n columns Define n-dimensional orthogonal lattice One of its cosets is defined as: in satisfy

[0158] 3. Remember the set of vectors Then ‖S‖ represents the paradigm of its longest vector, that is, ||S||=max 1≤i≤k ||S i ||. Represents the set of vectors in S formed by GramSchmidt orthogonalization.

[0159] 4. [BF11 Theorem 3.2] Probabilistic polynomial time algorithm (A, S) ← TrapGen (q, l, n): Its input is three positive integers (q, l, n) greater than 1 such that n ≥ 6·l·logq; Output is a matrix Passive A short generating base S of , with the following properties:

[0160] A and The uniformly distributed matrix is ​​statistically indistinguishable;

[0161] ||S||≤O(l·logq),

[0162] 5. Discrete Gaussian distribution on lattice [MR04, GPV08]: For any s>0, n≥1, the Gaussian function Defined as Accompany Above, the discrete Gaussian distribution with s>0 as the standard deviation is denoted as in

[0163] 6. For the n-dimensional lattice Λ, its dual lattice

[0164] 7. Smoothness parameter η of n-dimensional grid Λ ε (Λ): For real numbers ε>0, η ε (Λ) is defined as Here * It is the dual lattice of lattice Λ.

[0165] Theorem 1 [GPV08, Lemma 5.3] For a matrix For a prime number q and (n,l) satisfying n≥2·l·logq, there exists a negligible function ε(n) such that with great probability

[0166] Theorem 2 [CHKP10 Lemma 2.4]. For a matrix Let S be A generating basis of as well as Then we have:

[0167] (1). [GPV08, Lemma 2.11]: There is a probabilistic polynomial time algorithm It follows a discrete Gaussian distribution with great probability To output a vector

[0168] (2).[MR04, Lemma 4.4]:

[0169] like Figure 1 As shown, a post-quantum secure small-size linear homomorphic signature method and system provided by an embodiment of the present invention includes the following steps:

[0170] S101, parameter generation;

[0171] S102, signature generation;

[0172] S103, signature verification;

[0173] S104, linear homomorphic computation.

[0174] The parameter generation provided by the embodiment of the present invention is as follows:

[0175] enter

[0176] n: security parameters of the system;

[0177] r max : Label describing the data, r max <<n

[0178] Output

[0179] Public Key

[0180] Private Key

[0181] 1) Generate device Setup(1 n )

[0182] Explanation 1: The upper limit of the number of plaintexts and signatures included in a single data packet, where plaintexts and signatures correspond one to one;

[0183] 2) Detailed description of the matrix G generating device G-Gen(q,l,k);

[0184] enter

[0185] (q,l,k):q is the number field where the matrix G is located l is the number of rows of matrix G; l·k is the number of columns of matrix G;

[0186] Output

[0187] matrix satisfy and

[0188] 3) Detailed description of the [A, R] generation device;

[0189] Note: This is the first generation method: through integer The method of generating matrix R by discrete Gaussian sampling on

[0190] enter

[0191] (q,l,k,G):q is the number field where matrices A and G are located l is the number of rows of matrix G; l·k is the number of columns of matrix R and G;

[0192] Output

[0193]

[0194] satisfy

[0195] The matrix A and Random uniform matrices on are indistinguishable;

[0196] 4) Detailed description of the [A, R] generation device;

[0197] Note: This is the second method to generate the matrix [A, R]: Bernoulli generation method on binary {0,1}

[0198] enter

[0199] (q,l,k,G):q is the number field where matrices A and G are located l is the number of rows of matrix G; l·k is the number of columns of matrix R and G;

[0200] Output

[0201]

[0202] satisfy

[0203] The matrix A and A random uniform matrix on is not differentiable.

[0204] The signature generation provided by the embodiment of the present invention:

[0205] enter

[0206] Public Key

[0207] Private Key

[0208] Plaintext message to be signed

[0209] τ∈{0,1} r : a label describing the data (e.g. "city employee salary"), |τ|≤r max +1

[0210] i∈[1,2,…,k]: plaintext message The sequence number in the dataset

[0211] Output

[0212] Successful execution, output signature

[0213] Execution failed, output "⊥"

[0214] 1) A specific description of the signature generation device {σ / ⊥}←Sign(PK,SK,m,τ,i); Figure 8 As shown;

[0215] 2) Trapdoor expansion device Detailed description of

[0216] enter

[0217] matrix

[0218]

[0219] Output

[0220] satisfy

[0221] 3) Generate an orthogonal lattice from the trapdoor R Detailed description of Geki's device:

[0222] enter

[0223] matrix It is the lattice basis of the matrix G;

[0224] It is the R-trapgate of the matrix A;

[0225] Output

[0226] Satisfy A.S. A =0 mod q;

[0227]

[0228] Specific description;

[0229] Similarly,

[0230]

[0231] The signature verification provided by the embodiment of the present invention:

[0232] enter

[0233] Public Key τ∈{0,1} r : Label describing the data, |τ|≤r max +1

[0234] {m,σ}: plaintext message And the corresponding signature Description of the linear function f: Output

[0235] Verification successful, output "1"

[0236] Verification failed, output "⊥".

[0237] The linear homomorphic computing provided by the embodiment of the present invention:

[0238] Linear homomorphic computing device:

[0239] enter

[0240] Public Key τ∈{0,1} r : a label describing the data (e.g. "city employee salary"), |τ\≤r max +1 for the description of the linear function f: A set of data marked by data label τ and a corresponding set of signatures The linear combination of σ=∑c i ·σ i

[0241] i∈[1,2,…,k]: plaintext message The sequence number in the dataset

[0242] Output

[0243] Successful execution, output a set of data marked by data label τ The corresponding set of signatures The linear combination of σ=∑c i ·σ i

[0244] Execution failed, output "⊥".

[0245] The linear homomorphic computing device provided by the embodiment of the present invention is {σ / ⊥}←Evaluate(PK,SK,m,τ,i).

[0246] like Figure 2 As shown, a post-quantum secure small-size linear homomorphic signature system provided by an embodiment of the present invention includes:

[0247] Parameter generation module, used for parameter generation;

[0248] Signature generation module, used for signature generation;

[0249] Signature verification module, used for signature verification;

[0250] Computation module, used for linear homomorphic computation.

[0251] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the post-quantum secure small-size linear homomorphic signature method.

[0252] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to perform the steps of the post-quantum secure small-size linear homomorphic signature method.

[0253] Another object of the present invention is to provide an information data processing terminal, which is used to implement the post-quantum secure small-size linear homomorphic signature system.

[0254] The present invention is specifically implemented:

[0255]

[0256]

[0257] 1. (Level 1 device) Parameter generation device Setup (1 n )

[0258] enter

[0259] n: security parameters of the system;

[0260] r max : Label describing the data, r max <<n

[0261] Output

[0262] Public Key

[0263] Private Key

[0264] 1. Generate device Setup(1 n ) specific description; such as Figure 3 As shown;

[0265] Explanation 1: The upper limit of the number of plaintexts and signatures included in a single data packet, where plaintexts and signatures correspond one to one;

[0266] 2. (Secondary Device) Detailed description of the matrix G generating device G-Gen(q,l,k); Figure 4 As shown;

[0267] enter

[0268] (q,l,k):q is the number field where the matrix G is located l is the number of rows of matrix G; l·k is the number of columns of matrix G;

[0269] Output

[0270] matrix satisfy and

[0271] 3. (Secondary Device) [A, R] Detailed description of the generating device; e.g. Figure 5 As shown;

[0272] Note: This is the first generation method: integer Discrete Gaussian sampling generation method on

[0273] enter

[0274] (q,l,k,G):q is the number field where matrices A and G are located l is the number of rows of matrix G; l·k is the number of columns of matrix R and G;

[0275] Output

[0276]

[0277] satisfy

[0278] The matrix A and Random uniform matrices on are indistinguishable;

[0279] 4. (Secondary Device) [A, R] Detailed description of the generating device; e.g. Figure 6 As shown;

[0280] Note: This is the second generation method: Bernoulli generation method on binary {0,1}

[0281] enter

[0282] (q,l,k,G):q is the number field where matrices A and G are located l is the number of rows of matrix G; l·k is the number of columns of matrix R and G;

[0283] Output

[0284]

[0285] satisfy

[0286] The matrix A and Random uniform matrices on are indistinguishable;

[0287] 2. (Level 1 device) Detailed description of the signature generation device; e.g. Figure 7 As shown;

[0288] enter

[0289] Public Key

[0290] Private Key

[0291] Plaintext message to be signed

[0292] τ∈{0,1} r : a label describing the data (e.g. "city employee salary"), |τ|≤r max +1

[0293] i∈[1,2,…,k]: plaintext message The sequence number in the dataset

[0294] Output

[0295] Successful execution, output signature Execution failed, output "⊥"

[0296] 1. Specific description of the signature generation device {σ / ⊥}←Sign(PK,SK,m,τ,i); Figure 8 As shown; 2. (Secondary device) Trapdoor expansion device Detailed description of Fig. 9 As shown;

[0297] enter

[0298] matrix

[0299]

[0300] Output

[0301] satisfy

[0302] 3. (Secondary Device) Generate an Orthogonal Grid from Trapdoor R Detailed description of Geki's device:

[0303] enter

[0304] matrix It is the lattice basis of the matrix G;

[0305] It is the R-trapgate of the matrix A.

[0306] Output

[0307] Satisfy A.S. A =0 mod q.

[0308]

[0309] Specific description

[0310] Similarly, like Fig.10 As shown;

[0311] 3. (Level 1 Device) Signature Verification Device

[0312] enter

[0313] Public Key

[0314] τ∈{0,1} r : a label describing the data (e.g. "city employee salary"), |τ|≤r max +1

[0315] {m,σ}: plaintext message And the corresponding signature

[0316] Description of the linear function f:

[0317] Output

[0318] Verification successful, output "1"

[0319] Verification failed, output "⊥"

[0320] 1. Verify the signature device {1 / ⊥}←Verify(PK,m,σ,τ, <f>) specific description; such as Fig.11 As shown;

[0321] 4. (Level 1 Device) Linear Homomorphic Computing Device

[0322] enter

[0323] Public Key

[0324] τ∈{0,1} r : a label describing the data (e.g. "city employee salary"), |τ|≤r max +1

[0325] Description of the linear function f:

[0326] A set of data marked by data label τ and a corresponding set of signatures The linear combination of σ=∑c i ·σ i

[0327] i∈[1,2,…,k]: plaintext message The sequence number in the dataset

[0328] Output

[0329] Successful execution, output a set of data marked by data label τ The corresponding set of signatures The linear combination of σ=∑c i ·σ i

[0330] Execution failed, output "⊥"

[0331] 1. Specific description of the linear homomorphic computing device {σ / ⊥}←Evaluate(PK,SK,m,τ,i); Fig.12 shown.

[0332] 1. The authenticity of linear calculations in the three-party scenario ("data provider, calculation party, data user") is publicly verifiable

[0333] my country has clearly stated that data is the fifth major production factor, and data must circulate to generate value. Static, isolated and protected data cannot play a role. How to circulate data and play the role of data in generating factor allocation in the whole society is the core issue of the digital economy. The integrity / authenticity of basic original data and the verifiability of calculations based on data are key basic technologies to ensure the correct implementation of the digital economy.

[0334] This patent is a basic patent for computing commercialization from 0 to 1. The scenarios it targets involve three parties, as explained below:

[0335] The data provider provides the basic original data and guarantees the integrity of the original data through cryptographic signature. It is the department, enterprise, institution, etc. in the national economy that owns the data, depending on the specific business scenario.

[0336] The data user needs the calculator to calculate a specific linear function f on the remote basic data. It can be a department, enterprise, institution, etc., depending on the specific business scenario;

[0337] The computing party stores a large amount of basic raw data, has powerful computing devices and equipment, and is a commercial operator that legally provides computing results to the whole society. It can be a data center, a data exchange, a cloud computing party, etc., depending on the specific business scenario.

[0338] A real application case is as follows:

[0339] The Municipal Finance Bureau has the salary records of all employees in the city {m1,…,m k }, where k is the total number of "all employees".

[0340] The Municipal Finance Bureau signs each person's salary to indicate the authenticity and integrity of the salary data, forming the following triplet:

[0341] Data label τ (salary, employee number) sign τ = "Monthly salary record" <![CDATA[m1]]> <![CDATA[σ1=Sign sk (t,m1)]]> τ = "Monthly salary record" <![CDATA[m2]]> <![CDATA[σ2=Sign sk (τ,m2) <!-- 17 -->]]> … … … τ = "Monthly salary record" <![CDATA[m k ]]> <![CDATA[σ k =Sign sk (τ,m k )]]>

[0342] According to work needs, the Municipal Finance Bureau uploads the table to a remote cloud server for the relevant departments to conduct in-depth macroeconomic data calculation and mining. i ,σ i ) ensures the authenticity and integrity of the original data on monthly income of the city’s employees.

[0343] On a certain day, calculate the average monthly income of all employed persons in the city:

[0344] To prevent the remote cloud server from cheating or transmitting errors without calculation, such as the remote cloud server arbitrarily returning "the average salary of the city is 7835" without calculation, causing distortion of macroeconomic data and affecting decision-making;

[0345] The linear homomorphic signature technology solves this problem as follows:

[0346] The remote cloud server returns a signature

[0347] receive After that, according to the verification algorithm of linear homomorphic signature, if the verification is successful, it can be confirmed that the remote cloud server has truly and correctly calculated the average monthly income m of the city's employees. It is not necessary to verify the authenticity of the wages of all employees one by one, that is, to verify them one by one (m i ,σ i )’s authenticity and completeness.

[0348] Application effect: If the verification algorithm of linear homomorphic signature passes

[0349] 1. Eliminate the loss of integrity / authenticity of the original basic data without having to verify the integrity of each data entry one by one

[0350] 2. It eliminates the fraud of remote untrusted computing parties without the need to repeat the computing work of the computing party for verification.

[0351] 3. Eliminate errors in transmission of calculation results

[0352] 4. Resistant to quantum computer attacks.

[0353] 1. Specific application fields or related products of the present invention.

[0354] The specific application field of the present invention is in the field of digital economy, such as outsourced computing in the current cloud computing industry, and future data exchanges / centers in the "Eastern Data Western Computing" industry. In addition, the present invention can also be applied to the field of network coding to prevent data contamination attacks in network communications and protect data security.

[0355] 2. Relevant evidence of the technical effects obtained by the embodiments of the present invention.

[0356] The operating environment of this patent on a desktop PC is as follows:

[0357] (1) The PC model is ThinkCentre M910z, the processor model is Intel Core i5-7500 (vPro) (CORE i5, 3.4GHz), the operating system is Windows 10 Professional Edition, and the memory is 16G;

[0358] (2) The development language is Python, and the development tools used are Pycharm+Anaconda3 (64-bit);

[0359] (3) In this experiment, the main safety parameters tested were n=128, n=256, and n=512. The experimental parameters when n=256 are shown in the following table:

[0360] n p q r m 256 107 1009 13 256

[0361] Under the above experimental environment and parameters, the experimental results are as follows:

[0362] (1) G-matrix: Each row is linearly independent

[0363]

[0364] (2) Private key SK: generated by discrete Gaussian sampling

[0365]

[0366] (3) Distribution statistics of private keys Fig.13 :The private key distribution conforms to the discrete Gaussian distribution, and the value fluctuates around the expected value, which is in line with expectations

[0367] (4) Signature of m

[0368]

[0369] (5) Verification of Linear Homomorphic Computation Signatures Fig.14 ;

[0370] (6) Average running time of each stage of the algorithm at different security strengths (unit: seconds) Fig.15 ;

[0371] The above data show that in the various stages of the linear homomorphic signature in this paper, the linear calculation of Evaluate() does not increase significantly due to the increase in dimension, while the running time of the other three stages increases significantly, among which the Sign() stage increases most significantly because a large amount of calculation is required in this stage.

[0372] The effects of the present invention in a general sense are as follows Fig.16 Show.

[0373] The four phases of operation are compared as follows: Fig.17 shown.

[0374] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. A person of ordinary skill in the art will appreciate that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVDROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0375] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.< / f> < / f>

Claims

1. A post-quantum secure small-size linear homomorphic signature method, characterized in that: The following steps are involved: 1) Parameter generation: Generate the public key and private key of the system; 2) Signature generation: Generate a signature based on the plaintext message to be signed, the data tag and the serial number; 3) Signature verification: Verify the input signature and plaintext message, and output the verification result; 4) Linear homomorphic computation: Calculate the linear combination of a set of signatures and plaintext messages, and output the signature result of the linear combination.

2. The linear homomorphic signature method according to claim 1, wherein: Parameter generation includes the following steps: Enter system security parameters to describe the upper limit of the length of data tags; Generate public and private keys, where the public key includes system parameters, related vectors and matrices describing messages and signatures, and the private key is a secret matrix generated by the system.

3. The linear homomorphic signature method according to claim 2, wherein: Public key generation includes the following steps: A matrix is ​​generated using a matrix generation device, the matrix belongs to a specific number field and has a corresponding lattice basis; Another matrix is ​​generated by using discrete Gaussian sampling, which is connected to the first matrix through a mathematical relationship and satisfies its constraints under the modular specific number field.

4. The linear homomorphic signature method according to claim 3, wherein: Signature generation includes the following steps: Input the public key, private key, plaintext message to be signed, data tag and serial number; Use the private key to expand and generate a new matrix that satisfies the linear constraints in a specific number field; According to the extended private key, the corresponding signature is generated in combination with the message to be signed.

5. The linear homomorphic signature method according to claim 4, wherein: Signature verification consists of the following steps: Input public key, data label, plaintext message and its corresponding signature, and description of linear function; Verify that the input signature satisfies a specific mathematical relationship with the message and the description of the linear function.

6. The linear homomorphic signature method according to claim 5, wherein: Linear homomorphic computation includes the following steps: Input a public key, a data label, a description of a linear function, a set of plaintext messages and their corresponding signatures; According to the linear function description, a weighted linear combination is performed on the plaintext message and the corresponding signature to generate a combined signature result.

7. The linear homomorphic signature method according to claim 6, wherein: The linear homomorphic computing device is implemented through a computing module, the input includes a public key, a private key, a plaintext message, a data label and a serial number, and the output is a combined signature or a failure indication.

8. A post-quantum secure small-size linear homomorphic signature system implementing the post-quantum secure small-size linear homomorphic signature method according to any one of claims 1 to 6, characterized in that: The post-quantum secure small-size linear homomorphic signature system comprises: Parameter generation module, used for parameter generation; Signature generation module, used for signature generation; Signature verification module, used for signature verification; Computation module, used for linear homomorphic computation.

9. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the post-quantum secure small-size linear homomorphic signature method according to any one of claims 1 to 6.

10. An information data processing terminal, characterized in that: The information data processing terminal is used to implement the post-quantum secure small-size linear homomorphic signature system as described in claim 7.

Images