Broadcast signcryption method, system, device and readable medium

Abstract

The invention relates to a broadcast signcryption method, a broadcast signcryption system, broadcast signcryption equipment and a readable medium. The method comprises the following steps: a trusted center generates and issues public parameters of a system according to preset security parameters; the receiver generates registration parameters including a key pair, a challenge-response pair and a physical protection parameter, and discloses a public key of the registration parameters; the method comprises the following steps: generating registration parameters including challenge-response pairs and physical protection parameters according to a pseudonym and a part of private keys generated by a sender; the sender judges the physical attack based on own registration parameters; encrypting the confidential information to generate a broadcast ciphertext; broadcasting the broadcast ciphertext and the pseudonym of the sender to each receiver; and each receiver judges the physical attack based on the respective registration parameter, judges the validity of the received broadcast ciphertext, generates a verification parameter to verify the broadcast ciphertext, and decrypts the confidential message in the unattacked broadcast ciphertext. According to the invention, secure communication between the unmanned aerial vehicle and the ground station is realized.

Description

Technical Field

[0001] The present invention relates to the field of communication security, and relates to a broadcast signcryption method, system, device and readable medium. Background Art

[0002] In recent years, digital signature technology has been an important tool for ensuring message integrity and sender authentication. The earliest digital signature schemes can be traced back to the late 1970s and early 1980s. Algorithms such as RSA and DSA were the most famous digital signature technologies at the time. They took advantage of mathematical problems such as large prime number factorization and discrete logarithm problems to achieve confidentiality and verifiability of digital signatures. The main goal of a digital signature is to ensure that the message has not been tampered with and to verify that the sender of the message is legitimate. However, digital signature technologies do not provide message confidentiality, they can only verify the integrity of the message and the identity of the sender. Therefore, when it is necessary to protect the confidentiality of the message at the same time, another technology is needed, namely encryption.

[0003] Although digital signatures and encryption are key components in the field of digital communications, they still have some potential challenges and limitations. First, traditional digital signature techniques usually involve a lot of computational and storage overhead, which may not be efficient enough in resource-constrained environments. Second, digital signatures do not provide message confidentiality. Therefore, in scenarios where message integrity, sender authentication, and message confidentiality need to be ensured at the same time, additional encryption techniques are required, which may increase the complexity and overhead of the system. Finally, with the continuous enhancement of computing power, traditional digital signature and encryption techniques may face potential risks because the speed of solving certain mathematical problems is accelerating, which may affect their long-term security.

[0004] In view of these challenges and limitations, researchers have been seeking more efficient and comprehensive security solutions to adapt to the evolving communication needs and threat environment. In this context, in order to protect the integrity and confidentiality of messages at the same time, digital signatures and encryption began to be used in combination. This combination is called Digital Signature and Encryption (DSE). In DSE, the message is first encrypted, and then the digital signature is attached to the ciphertext. The receiver first verifies the digital signature and then decrypts the message. This method is very effective in protecting the integrity and confidentiality of the message, but it still has a limitation that only specific receivers can decrypt the message. If the message needs to be broadcast to multiple receivers, each receiver needs to decrypt the message individually, which increases the complexity.

[0005] To overcome this limitation, broadcast signature encryption technology has emerged. In broadcast signature encryption, the message sender only needs to digitally sign the message once, and then the message can be broadcast to multiple receivers without encrypting the message separately for each receiver. The application of this technology can not only simplify the complexity of the system, but also provide a more efficient secure communication solution in resource-constrained environments. Broadcast signcryption is a perfect combination of digital signature, encryption and broadcasting. Its goal is to ensure the integrity, confidentiality and authenticity of messages in broadcast communications. In broadcast signcryption, the message sender uses a digital signature to verify the integrity and sender identity of the message, while using encryption to protect the confidentiality of the message. Broadcast signcryption technology has been widely used in many fields: in large-scale Internet of Things, devices need to broadcast status information such as sensor data regularly. Broadcast signcryption can ensure the integrity and confidentiality of this data to prevent unauthorized access and tampering; in intelligent transportation systems, vehicles need to broadcast location and traffic information. Broadcast signcryption can be used to verify the credibility of this information to improve the security of the transportation system; the broadcast of medical information needs to protect patient privacy and the security of medical data. Broadcast signcryption can be used to ensure the secure transmission of medical information; in military communications, the confidentiality and integrity of messages are crucial. Broadcast signcryption can be used to protect the transmission of military information. In these application areas, broadcast signcryption technology has provided a powerful security solution for data integrity, confidentiality and credibility, making broadcast communications more reliable and secure.

[0006] Although there are some broadcast signcryption methods available, these methods still have significant limitations and need further improvement. One of the main problems is that the recipient of the message can trace the source of the message through the sender's public key, which may affect the anonymity of the message and the privacy of the sender. Specifically, in the broadcast signature encryption method, the sender uses its private key to signcrypt the secret message, generate the corresponding ciphertext, and transmit it to the intended recipient. The recipient uses the sender's public key to decrypt the ciphertext and extract the secret message. Although the ciphertext generated by the sender is random and cannot be traced back to the sender itself, the sender's public key remains unchanged, allowing any recipient to link to the sender's identity through the public key. In other words, although the sender sends different ciphertexts to the same recipient, decryption still requires the use of the sender's public key, which fundamentally increases the traceability of the message source. This is an important limitation of the current method. Another limitation is that the security of existing broadcast signcryption methods is based on an assumption that the secrets stored in the device are long-term and cannot be obtained by malicious attackers. However, in actual situations, attackers can still steal secret information stored on devices through physical attacks, such as side-channel attacks, which poses a serious threat to communication security. Therefore, how to effectively defend against such physical theft attacks has become one of the main challenges that need to be solved urgently.

[0007] The current broadcast signcryption method cannot simultaneously solve the problem of linking the receiver's identity with the sender's identity and preventing physical attacks. In order to overcome these limitations, it is urgent to develop a new broadcast signcryption method that not only has higher security and privacy protection capabilities, but also can effectively resist various potential physical attacks to ensure its safe and reliable application in sensitive environments. This method is expected to solve the problems of the current broadcast signcryption method and make breakthrough progress in the field of information security. Summary of the invention

[0008] In view of the above analysis, the present invention aims to disclose a broadcast signcryption method, system, device and readable medium to meet the security and privacy challenges in the communication field and improve the security and privacy of communications.

[0009] The present invention discloses a broadcast signcryption method, comprising:

[0010] Initialization: Based on the preset security parameters, the trusted center generates and publishes the public parameters of the system;

[0011] Registration; The receiver generates registration parameters including key pairs, challenge-response pairs, and physical protection parameters based on public parameters for secure storage, and discloses its public key; The sender generates registration parameters including challenge-response pairs and physical protection parameters based on the pseudonym and part of the private key generated by the trusted center based on the sender's real identity for secure storage;

[0012] Broadcast signcryption; the sender determines physical attacks based on its own registration parameters; uses its own registration parameters and the identity of each receiver to encrypt confidential information to generate broadcast ciphertext; broadcasts the broadcast ciphertext together with the sender's pseudonym to each receiver;

[0013] Decryption: Each recipient determines the physical attack based on their own registration parameters, determines the validity of the received broadcast ciphertext, generates verification parameters to verify the broadcast ciphertext, and then decrypts the confidential message in the unattacked broadcast ciphertext.

[0014] Further, the system initialization includes:

[0015] 1) Based on the preset security parameters, the trusted center creates an elliptic curve G, which uses P as the generator and has an order of q;

[0016] 2) The trusted center randomly selects a master key and use it to calculate the system's public key P pub =s·P;

[0017] 3) The trusted center selects five one-way hash functions, namely H 1 : {0, 1}* →{0, 1} |ID| , H 4 :(0, 1} * →{0, 1} 2|G|+|m| ,and Among them, ID is the identity identifier, and m is the confidential message;

[0018] 4) The public parameters of the public system published by the trusted center are par = {G, P, P pub , H 1 , H 2 , H 3 , H 4 , H 5}.

[0019] Furthermore, the receiver registration process includes:

[0020] 1) The receiver randomly selects a private key Calculate the corresponding public key pk j =sk j ·P;

[0021] 2) The receiver generates a challenge-response pair (C j , R j ), where R j =PUF(C j );C j is the challenge of the receiver, R j The response corresponding to the challenge;

[0022] 3) The receiver calculates the physical protection parameter Check j =H 2 (C j , R j ,sk j , pk j );

[0023] 4) The receiver sends the public key pk j Publicly and securely store the challenge C j , private key sk j And physical protection parameter Check j .

[0024] Furthermore, the sender registration process includes:

[0025] 1) The sender identifies his / her real identity Send to a trusted center;

[0026] 2) The trusted center receives the ID i Then, randomly select a value Then calculate and The trusted center generates a pseudonym corresponding to the sender's real identity

[0027] 3) The trusted center selects another random value Calculate the partial private key ppk i =(λ i , Y i ):

[0028] Y i =y i ·P;

[0029] h i =H 2 (PID i , Y i , P pub );

[0030] λ i =y i +s·h i ;

[0031] The trusted center will send part of the private key ppk t =(λ i , Y i ) and the pseudonym are returned to the sender;

[0032] 4) The sender generates a challenge-response pair (C i , R i ), where R i =PUF(C i );C i is the sender’s challenge, R i The response corresponding to the challenge;

[0033] 5) The sender calculates the physical protection parameter Check i =H 2 (C i , R i , PID i ,ppk i );

[0034] 6) The sender securely stores the challenge C i 、Pseudonym PID i , part of the private key ppk i And physical protection parameter Check i .

[0035] Furthermore, the trusted center provides the sender with the required pseudonym and partial private key; the sender deletes the used pseudonym and partial private key from the sender's local location; before the pseudonym and partial private key in the sender's local location are exhausted, the sender adds a new pseudonym and partial private key in a timely manner.

[0036] Furthermore, the broadcast signcryption process includes:

[0037] 1) The sender performs physical attack detection;

[0038] The sender calculates R′ i =PUF(C i ) and Check′ i =H 2 (C i , R′ i , PID i ,ppk t ); Compare Check′ i and locally stored Check i ; Check i =Check i Then proceed to the next step; otherwise, take measures including re-registration to deal with physical attacks;

[0039] 2) The sender randomly selects a private key Then calculate the corresponding public key pk i =sk i ·P;

[0040] 3) The sender selects a random number And calculate L i = l i ·P;

[0041] 4) For each ID j ∈Team s ={ID 1 , ID 2 , …, ID s} Calculate the parameters respectively:

[0042] ω j = l i ·pk j ;

[0043] k j =H 3 (ω j , pk j , ID j , PID i , L i );

[0044]

[0045] β j =α i / k j ;

[0046] 5) The sender then calculates θ j Make β j ×θ j ≡1 mod k j ; Calculate var j =β j ×θ j as well as

[0047] 6) The sender then selects a transmission key And calculate: γ i =TK i ×sum i ,

[0048] 7) The sender generates a timestamp t i ,calculate:

[0049] h 1 =H 5 (PID i , t i ,m,pk i , Y i , L i , 1);

[0050] h 2 =H 5 (PID i , t i ,m,pk i , Y i , L i , 2);

[0051] ρ i = l i +h 1 λ i +h 2 sk i ;

[0052] 8) The sender generates a broadcast ciphertext ξ i ={C i , ρ i , t i , L i , γ i}, and the ciphertext ξ i with the sender's pseudonymous PID i Broadcast to the preset receiving teams ={ID 1 , ID 2 , …, ID s}; ID 1 , ID 2 , …, ID s is the real identity of the S recipients.

[0053] Furthermore, the process of decryption includes:

[0054] 1) The receiver receives the ciphertext ξ i ={C i , ρ i , t i , L i , γ i} and the sender's pseudonymous PID i ;

[0055] 2) The receiver verifies whether the data has been physically attacked;

[0056] The receiver calculates R′ j =PUF(C j ) and Check′ j =H 2 (C j , R′ j ,sk j , pk j ); Compare Check′ j and locally stored Check j ; Check j =Check j Then proceed to the next step; otherwise, take measures including re-registration to deal with physical attacks;

[0057] 3) The receiver checks the timestamp t i The validity of the timestamp; when the timestamp has expired, the message is considered invalid and discarded; if the timestamp is valid, proceed to the next step;

[0058] 4) The receiver calculates ω j =sk j ·L i and k j =H 3 (ω j , pk j , ID j , PID i , L i );

[0059] 5) Receiver calculation:

[0060] TK i =γi mod k j ;

[0061]

[0062] h 1 =H 5 (PID i , t i ,m,pk i , Y i , L i , 1);

[0063] h 2 =H 5 (PID i , t i ,m,pk i , Y i , L i , 2);

[0064] 6) The receiver checks the equation ρ i P=L i +h 1 Y i +h 1 h i P pub +h 2 pk i Is it true? If so, the confidential message m is accepted.

[0065] The present invention also discloses a broadcast signcryption system, including a trusted center, a sender, and at least one receiver corresponding to the sender;

[0066] The broadcast signcryption system adopts the broadcast signcryption method as described above to realize system initialization, registration of the sender and the receiver, broadcast signcryption of the sender and decryption of the receiver; and realizes confidential transmission of confidential information of the sender and the receiver.

[0067] The present invention also discloses an electronic device, comprising:

[0068] one or more processors;

[0069] A storage device for storing one or more programs;

[0070] When the one or more programs are executed by the one or more processors, the one or more processors implement the broadcast signcryption method as described above.

[0071] The present invention also discloses a computer-readable medium on which a computer program is stored. When the program is executed by a processor, the broadcast signcryption method as described above is implemented.

[0072] The present invention can achieve one of the following beneficial effects:

[0073] The broadcast signcryption method disclosed in the present invention has physical security and unlinkability, solves the problem of linking the receiver's identity with the sender's identity and preventing physical attacks; has higher security and privacy protection capabilities, and can effectively resist various potential physical attacks to ensure its safe and reliable application in sensitive environments.

[0074] And in the broadcast signcryption method, the sender first signs the sensitive information and converts it into ciphertext to ensure the confidentiality and integrity of the information. This ensures that the information in transmission will not be accessed or tampered with without authorization. The ciphertext is then transmitted to multiple potential recipients, but only recipients who meet the sender's preset conditions have decryption authority and can obtain the original secret information. This ensures the authentication, integrity and confidentiality of the message while improving transmission efficiency. In order to protect the sender's privacy, the sender updates its key pair each time before broadcast signcryption to ensure the freshness of its public key. This means that no recipient can trace the identity of the sender, thereby providing a high degree of privacy protection for the sender.

[0075] The method also uses a pseudonym mechanism to effectively hide the real identity of the sender using the pseudonym, thereby preventing it from being associated with its real identity. This enhances the anonymity of the sender. In order to resist potential physical theft attack threats, the present invention deploys an unclonable function in the storage device, further enhancing the physical security of the communication. This ensures that even if the device is stolen, sensitive information is still effectively protected. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] The accompanying drawings are only used for the purpose of illustrating specific embodiments and are not to be considered as limiting the present invention. In the entire drawings, the same reference symbols represent the same components;

[0077] Figure 1 The figure is a flow chart of a broadcast signcryption method in an embodiment of the present invention. DETAILED DESCRIPTION

[0078] The preferred embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used to illustrate the principles of the present invention together with the embodiments of the present invention.

[0079] Embodiment 1

[0080] An embodiment of the present invention discloses a broadcast signcryption method, such as Figure 1 As shown, including:

[0081] Step S1, initialization; based on the preset security parameters, the trusted center generates and publishes the public parameters of the system;

[0082] Step S2, registration; the receiver generates registration parameters including key pairs, challenge-response pairs, and physical protection parameters based on public parameters for secure storage, and discloses its public key; the sender generates registration parameters including challenge-response pairs and physical protection parameters based on the pseudonym and part of the private key generated by the trusted center based on the sender's real identity for secure storage;

[0083] Step S3, broadcast signcryption; the sender determines the physical attack based on its own registration parameters; uses its own registration parameters and the identity of each recipient to encrypt the confidential information to generate a broadcast ciphertext; broadcasts the broadcast ciphertext together with the sender's pseudonym to each recipient;

[0084] Step S4, decrypting the signcryption; each receiving party determines the physical attack based on its own registration parameters, determines the validity of the received broadcast ciphertext, generates verification parameters to verify the broadcast ciphertext, and then decrypts the confidential message in the broadcast ciphertext that has not been attacked.

[0085] Specifically, the system initialization in step S1 includes:

[0086] 1) Based on the preset security parameters, the trusted center creates an elliptic curve G, which uses P as the generator and has an order of q;

[0087] 2) The trusted center randomly selects a master key and use it to calculate the system's public key P pub =s·P;

[0088] 3) The trusted center selects five one-way hash functions, namely H 1 : {0, 1} * →{0, 1} |ID| , H 4 :(0, 1} * →{0, 1} 2|G|+|m| ,and Among them, ID is the identity identifier, and m is the confidential message;

[0089] 4) The public parameters of the public system published by the trusted center are par = {G, P, P pub , H 1 , H 2 , H 3 , H 4 , H 5}.

[0090] Specifically, the receiver registration in step S2 includes:

[0091] 1) The receiver randomly selects a private key Calculate the corresponding public key pk j =sk j ·P;

[0092] 2) The receiver generates a challenge-response pair (C j , R j ), where R j =PUF(C j );C j is the challenge of the receiver, R j The response corresponding to the challenge;

[0093] Resist potential physical theft attack threats through Physical Unclonable Function (PUF);

[0094] 3) The receiver calculates the physical protection parameter Check j =H 2 (C j , R j ,sk j , pk j );

[0095] The physical protection parameter is used to determine physical attacks;

[0096] 4) The receiver sends the public key pk j Publicly and securely store the challenge C j , private key sk j And physical protection parameter Check j .

[0097] Specifically, the sender registration in step S2 includes:

[0098] 1) The sender identifies his / her real identity Send to a trusted center;

[0099] 2) The trusted center receives the ID i Then, randomly select a value Then calculate and The trusted center generates a pseudonym corresponding to the sender's real identity

[0100] 3) The trusted center selects another random value Calculate the partial private key ppk i =(λ i , Y i ):

[0101] Y i =y i ·P;

[0102] h i =H 2 (PID i , Y i , P pub );

[0103] λ i =y i +s•h i ;

[0104] The trusted center will send part of the private key ppk i =(λ i , Y i ) and the pseudonym are returned to the sender;

[0105] The use of a pseudonym effectively hides the true identity of the sender using the pseudonym, thereby preventing the sender from being associated with his or her true identity; this enhances the anonymity of the sender.

[0106] 4) The sender generates a challenge-response pair (C i , R i ), where R i =PUF(C i );C i is the sender’s challenge, R i The response corresponding to the challenge;

[0107] 5) The sender calculates the physical protection parameter Check i =H 2 (C i , R i , PID i ,ppk i );

[0108] 6) The sender securely stores the challenge C i 、Pseudonym PID i , part of the private key ppk i And physical protection parameter Check i .

[0109] Furthermore, the trusted center provides the sender with the required pseudonym and partial private key to achieve anonymity and unlinkability. The sender deletes the used pseudonym and partial private key from the sender's local area; before the pseudonym and partial private key in the sender's local area are exhausted, the sender timely adds a new pseudonym and partial private key; the sender's anonymity and data security are ensured, while allowing the trusted center to provide each sender with the required pseudonym and partial private key to maintain the unlinkability of the data.

[0110] Broadcast signcryption in step S3, sender ID iNeed to send your confidential information to multiple receiving teams s ={ID 1 , ID 2 , …, ID s}. The specific broadcast signcryption process includes:

[0111] 1) The sender performs physical attack detection;

[0112] The sender calculates R′ i =PUF(C i ) and Check′ i =H 2 (C i , R′ i , PID i ,ppk i ); Compare Check′ i and locally stored Check i ; Check i =Check i Then proceed to the next step; otherwise, take measures including re-registration to deal with physical attacks;

[0113] 2) The sender randomly selects a private key Then calculate the corresponding public key pk i =sk i ·P;

[0114] 3) The sender selects a random number And calculate L i = l i ·P;

[0115] 4) For each ID j ∈Team s ={ID 1 , ID 2 , …, ID s} Calculate the parameters respectively:

[0116] ω j = l i •pk j ;

[0117] k j =H 3 (ω j , pk j , ID j , PID i , L i );

[0118]

[0119] β j =α i / k j ;

[0120] 5) The sender then calculates θ j Make β j ×θ j Three 1 mod k j ; Calculate var j =β j ×θ j as well as

[0121] 6) The sender then chooses a transmission key And calculate: γ i =TK i ×sum i ,

[0122] 7) The sender generates a timestamp t i ,calculate:

[0123] h 1 =H 5 (PID i , t i ,m,pk i , Y i , L i , 1);

[0124] h 2 =H 5 (PID i , t i ,m,pk i , Y i , L i , 2);

[0125] ρ i = l i +h 1 λ i +h 2 sk i ;

[0126] 8) The sender generates a broadcast ciphertext ξ i ={C i , ρ i , t i , L i , γ i}, and the ciphertext ξ i with the sender's pseudonymous PID i Broadcast to the preset receiving team s ={ID 1, ID 2 , …, ID s}; ID 1 , ID 2 , …, ID s is the real identity of the S recipients.

[0127] Through this step, the ciphertext is transmitted to multiple potential recipients, but only recipients who meet the sender's preset conditions have the decryption authority to obtain the original secret information. This ensures the authentication, integrity and confidentiality of the message, while improving transmission efficiency.

[0128] Specifically, the decryption process in step S4 includes:

[0129] 1) The receiver receives the ciphertext ξ i ={C i , ρ i , t i , L i , γ i} and the sender's pseudonymous PID i ;

[0130] 2) The receiver verifies whether the data has been physically attacked;

[0131] The receiver calculates R′ j =PUF(C j ) and Check′ j =H 2 (C j , R′ j ,sk j , pk j ); Compare Check′ j and locally stored Check j ; Check j =Check j Then proceed to the next step; otherwise, take measures including re-registration to deal with physical attacks;

[0132] 3) The receiver checks the timestamp t i The validity of the timestamp; when the timestamp has expired, the message is considered invalid and discarded; if the timestamp is valid, proceed to the next step;

[0133] 4) The receiver calculates: j =sk j ·L i and k j =H 3 (ω j , pk j , ID j , PID i , Li );

[0134] 5) Receiver calculation:

[0135] TK i =γ i mod k j ;

[0136]

[0137] h 1 =H 5 (PID i , t i ,m,pk i , Y i , L i , 1);

[0138] h 2 =H 5 (PID i , t i ,m,pk i , Y i , L i , 2);

[0139] 6) The receiver checks the equation ρ i P=L i +h 1 Y i +h 1 h i P pub +h 2 pk i Is it true? If so, the message m is accepted, indicating that the message is complete and comes from a legitimate source. On the contrary, if the authentication fails, the message will be discarded immediately because it may be tampered with or come from an unauthorized source. If any abnormality is found, the recipient will take necessary actions, which may include re-registration to deal with potential physical attacks or information leakage.

[0140] Through this series of checking steps, the receiver can ensure that the message received from the sender has not been damaged or tampered with during transmission and comes from the legitimate sender.

[0141] In summary, the broadcast signcryption method of this embodiment is physically secure and unlinkable, which solves the problem of linking the receiver's identity with the sender's identity and preventing physical attacks; it has higher security and privacy protection capabilities, and can effectively resist various potential physical attacks to ensure its safe and reliable application in sensitive environments.

[0142] And in the broadcast signcryption method, the sender first signs the sensitive information and converts it into ciphertext to ensure the confidentiality and integrity of the information. This ensures that the information in transmission will not be accessed or tampered with without authorization. The ciphertext is then transmitted to multiple potential recipients, but only recipients who meet the sender's preset conditions have decryption authority and can obtain the original secret information. This ensures the authentication, integrity and confidentiality of the message while improving transmission efficiency. In order to protect the sender's privacy, the sender updates its key pair each time before broadcast signcryption to ensure the freshness of its public key. This means that no recipient can trace the identity of the sender, thereby providing a high degree of privacy protection for the sender.

[0143] The method also uses a pseudonym mechanism to effectively hide the real identity of the sender using the pseudonym, thereby preventing it from being associated with its real identity. This enhances the anonymity of the sender. In order to resist potential physical theft attack threats, the present invention deploys an unclonable function in the storage device, further enhancing the physical security of the communication. This ensures that even if the device is stolen, sensitive information is still effectively protected.

[0144] Embodiment 2

[0145] An embodiment of the present invention provides a broadcast signcryption system, including a trusted center, a sender, and at least one receiver corresponding to the sender;

[0146] The broadcast signcryption system adopts the broadcast signcryption method as described in Example 1 to implement system initialization, registration of the sender and the receiver, broadcast signcryption of the sender and decryption of the receiver; and confidential transmission of confidential information of the sender and the receiver is achieved.

[0147] The remaining specific technical details and beneficial effects of this embodiment are the same as those in Embodiment 1. Please refer to them for details and will not be described in detail here.

[0148] Embodiment 3

[0149] An embodiment of the present invention provides an electronic device; the electronic device includes:

[0150] one or more processors;

[0151] A storage device for storing one or more programs;

[0152] When the one or more programs are executed by the one or more processors, the one or more processors implement the broadcast signcryption method as described in the first embodiment.

[0153] Embodiment 4

[0154] The embodiment of the present disclosure provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the broadcast signcryption method described in Embodiment 1 are executed. The storage medium may be a volatile or non-volatile computer-readable storage medium.

[0155] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. A broadcast signcryption method, It is characterized in that include: initialization; Based on the preset security parameters, the trusted center generates and publishes the public parameters of the system; Registration: The recipient generates registration parameters including key pairs, challenge-response pairs, and physical protection parameters based on public parameters for secure storage, and discloses its public key; The sender generates registration parameters including challenge-response pairs and physical protection parameters for secure storage based on the pseudonym and part of the private key generated by the trusted center based on the sender's real identity; Broadcast signcryption; the sender determines physical attacks based on its own registration parameters; uses its own registration parameters and the identity of each receiver to encrypt confidential information and generate broadcast ciphertext; Broadcast the broadcast ciphertext together with the sender's pseudonym to each receiver; Decryption of the signature; Each receiver determines the physical attack based on its own registration parameters, determines the validity of the received broadcast ciphertext, generates verification parameters to verify the broadcast ciphertext, and then decrypts the confidential information in the broadcast ciphertext that has not been attacked.

2. The broadcast signcryption method according to claim 1, It is characterized in that The system initialization includes: 1) Based on the preset security parameters, the trusted center creates an elliptic curve G, which uses P as the generator and has an order of q; 2) The trusted center randomly selects a master key and use it to calculate the system's public key P pub =s·P; 3) The trusted center selects five one-way hash functions, namely H 1 :{0,1} * →{0,1} |ID| , H 2 : H 3 : H 4 :{0,1} * →{0,1} 2|G|+|M| , and H 5 : Among them, ID is the identity identifier, and m is the confidential message; 4) The public parameters of the public system published by the trusted center are par = {G, P, P pub ,H 1 ,H 2 ,H 3 ,H 4 ,H 5 }.

3. The broadcast signcryption method according to claim 2, It is characterized in that The receiver registration process includes: 1) The receiver randomly selects a private key Calculate the corresponding public key pk j =sk j ·P; 2) The receiver generates a challenge-response pair (C j , R j ), where R j =PUF(C j );C j is the challenge of the receiver, R j The response corresponding to the challenge; 3) The receiver calculates the physical protection parameter Check j =H 2 (C j , R j ,sk j , pk j ); 4) The receiver sends the public key pk j Publicly and securely store the challenge C j , private key sk j And physical protection parameter Check j .

4. The broadcast signcryption method according to claim 3, It is characterized in that The sender registration process includes: 1) The sender identifies his / her real identity Send to a trusted center; 2) The trusted center receives the ID i Then, randomly select a value Then calculate and The trusted center generates a pseudonym corresponding to the sender's real identity 3) The trusted center selects another random value Calculate the partial private key ppk i =(λ i , Y i ): AND i =and i ·P; h i =H 2 (PID i ,Y i ,P pub ); l i =y i +s•h i ; The trusted center will send part of the private key ppk i =(λ i , Y i ) and the pseudonym are returned to the sender; 4) The sender generates a challenge-response pair (C i , R i ), where R i =PUF(C i );C i is the sender’s challenge, R i The response corresponding to the challenge; 5) The sender calculates the physical protection parameter Check i =H 2 (C i , R i , PID i ,ppk i ); 6) The sender securely stores the challenge C i 、Pseudonym PID i , part of the private key ppk i And physical protection parameter Check i .

5. The broadcast signcryption method according to claim 4, It is characterized in that The trusted center provides the sender with the required pseudonym and partial private key; the sender deletes the used pseudonym and partial private key from the sender's local location; before the pseudonym and partial private key in the sender's local location are exhausted, the sender adds a new pseudonym and partial private key in a timely manner.

6. The broadcast signcryption method according to claim 5, It is characterized in that The broadcast signcryption process includes: 1) The sender performs physical attack detection; The sender calculates R′ i =PUF(C i ) and Check′ i =H 2 (C i , R′ i , PID i ,ppk i ); Compare Check′ i and locally stored Check i ; Check i =Check i Then proceed to the next step; otherwise, take measures including re-registration to deal with physical attacks; 2) The sender randomly selects a private key Then calculate the corresponding public key pk i =sk i ·P; 3) The sender selects a random number And calculate L i = l i ·P; 4) For each ID j ∈Team s ={ID 1 , ID 2 , …, ID s } Calculate the parameters respectively: ω j =l i ·pk j ; k j =H 3 (ω j ,pk j ,ID j ,PID i ,L i ); β j ＝α i / k j ； 5) The sender then calculates θ j Make β j ×θ j ≡1mod k j ; Calculate var j =β j ×θ j as well as 6) The sender then chooses a transmission key And calculate: γ i =TK i ×sum i , 7) The sender generates a timestamp t i ,calculate: h 1 =H 5 (PID i ,t i ,m,pk i ,Y i ,L i ,1); h 2 =H 5 (PID i ,t i ,m,pk i ,Y i ,L i ,2); ρ i =l i +h 1 λ i +h 2 en i ; 8) The sender generates a broadcast ciphertext ξ i ={C i , ρ i , t i , L i , γ i }, and the ciphertext ξ i with the sender's pseudonymous PID i Broadcast to the preset receiving team s =(ID 1 , ID 2 , …, ID s }; ID 1 , ID 2 , …, ID s is the real identity of the S recipients.

7. The broadcast signcryption method according to claim 5, It is characterized in that The process of decryption includes: 1) The receiver receives the ciphertext ξ i ={C i , ρ i , t i , L i , γ i } and the sender's pseudonymous PID i ; 2) The receiver verifies whether the data has been physically attacked; The receiver calculates R′ j =PUF(C j ) and Check′ j =H 2 (C j , R′ j ,sk j , pk j ); Compare Check′ j and locally stored Check j ; Check j =Check j Then proceed to the next step; otherwise, take measures including re-registration to deal with physical attacks; 3) The receiver checks the timestamp t i The validity of the timestamp; when the timestamp has expired, the message is considered invalid and discarded; if the timestamp is valid, proceed to the next step; 4) The receiver calculates ω j =sk j ·L i and k j =H 3 (ω j , pk j , ID j , PID i , L i ); 5) Receiver calculation: TK i =γ i mod k j ; h 1 =H 5 (PID i ,t i ,m,pk i ,Y i ,L i ,1); h 2 =H 5 (PID i ,t i ,m,pk i ,Y i ,L i ,2); 6) The receiver checks the equation ρ i P=L i +h 1 Y i +h 1 h i P pub +h 2 pk i Is it true? If so, the confidential message m is accepted.

8. A broadcast signcryption system, It is characterized in that It includes a trusted center, a sender, and at least one receiver corresponding to the sender; The broadcast signcryption system adopts the broadcast signcryption method as described in any one of claims 1 to 7 to realize system initialization, registration of the sender and the receiver, broadcast signcryption of the sender and decryption of the receiver; and realizes confidential transmission of confidential information of the sender and the receiver.

9. An electronic device, It is characterized in that include: one or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the broadcast signcryption method according to any one of claims 1 to 7.

10. A computer readable medium having a computer program stored thereon, It is characterized in that When the program is executed by a processor, the broadcast signcryption method according to any one of claims 1 to 7 is implemented.

Images