Multi-authoritative attribute-based blind signature method for bidirectional privacy protection

Abstract

The invention discloses a multi-authoritative attribute-based blind signature method with bidirectional privacy protection, and relates to the technical field of cyberspace security, the method comprises the following steps: constructing a multi-authoritative attribute-based blind signature system with entities including a central attribute authority, a distributed attribute authority, a signer, a user and a verifier, establishing system parameters and initializing the system parameters; generating a secret key for a signer by using a hash function and a multiple polynomial through the central attribute authority and the distributed attribute authority respectively; the user blinds the message needing blind signature and sends the blinded message to the signer; the signer calculates the signature of the blind message and sends the signature to the user; the user carries out blind solution calculation on the signature of the received blind message to obtain a blind signature and sends the blind signature to a verifier; and the verifier verifies the blind signature. According to the method, the privacy of the user is protected, the signature is prevented from being tracked and associated, the privacy protection of the signer is enhanced, and the flexibility is high.

Description

Technical Field

[0001] The present invention relates to the technical field of cyberspace security, and in particular to a multi-authority attribute-based blind signature method. Background Art

[0002] As a key technology for ensuring the integrity and authentication of information transmission, digital signatures have been widely used in numerous fields due to their unique advantages. However, existing digital signature technologies have numerous limitations. First, traditional digital signature technologies may leak user identity information or certain characteristics of the signature content during the signing process, posing a potential threat to user privacy. Second, traditional attribute-based signature methods typically rely on a single authority for attribute management and authentication, posing a single point of failure risk. Once this authority encounters a problem, the entire system will face paralysis or security threats. Third, in existing attribute-based signature methods, attribute thresholds are typically fixed, making them difficult to dynamically adjust according to the needs of actual application scenarios, limiting the system's flexibility and adaptability.

[0003] Patent application number 202310369772.1 discloses a dynamic, strongly forward-secure attribute-based blind signature scheme. The scheme involves the message owner submitting a signature request to the system, processing the message to be signed, and waiting for the system to generate a signing key. Once the signing key is successfully generated, the message owner blinds the message to be signed and sends the resulting blinded message to the signer. The signer determines whether the signer's attributes satisfy the access structure. The message owner receives the blinded message signature and uses a deblinding function to output the final signature. While this invention offers strong forward and backward security, resisting the risk of key leakage, eliminating the need for a trusted center and reducing the risk of single points of failure, and maintaining the privacy of message content through blind signatures, the patent's periodic key update mechanism increases the complexity and communication overhead of key management, secure distribution, and state synchronization among system members. It also involves attribute management dependencies: operations such as the issuance, verification, and revocation of attributes still rely on a reliable attribute management infrastructure, which may introduce new trust assumptions and management burdens. Having all attribute elements managed by a single management center hinders attribute partitioning, creates a new single point of failure, and increases computational load when there are many users. There is also interaction delay: the signing process requires the message owner to interact with multiple signers who meet the conditions (collecting partial signatures), which increases communication delay and reduces the efficiency of the system.

[0004] Patent application number 202311407732.8 discloses a blind signature method, apparatus, distributed signature system, and medium. These methods include: obtaining a message blinding parameter sent by a user terminal; the message blinding parameter is a parameter obtained by blinding the message to be signed; calculating a key hiding parameter value based on the message blinding parameter and a key hiding parameter disclosed by a key generation center, and sending the calculated key hiding parameter value to other signing participants; the key hiding parameter is a parameter that hides the signature private key; combining the calculated key hiding parameter value calculated by the user terminal with the calculated key hiding parameter value obtained from other participating devices to obtain a combined value; generating a partial signature value based on the combined value and using the user terminal's own secret share, and sending the partial signature value to the user terminal so that the user terminal can determine the signature value based on the partial signature values of each participating device. This method can address the single point of failure problem in blind signatures, thereby improving robustness. However, this patent suffers from high communication overhead, as its solution involves multiple rounds of communication. As the number of participating parties increases, communication complexity and network load increase significantly. This patent protects signers from knowing the message content and their private key shares from being leaked, but it does not provide sufficient privacy protection for signers. It also fails to provide fine-grained access control: this invention primarily ensures that the final signature is generated by signatures from at least t members of a pre-defined signing group. It does not include a built-in mechanism for screening signers. Summary of the Invention

[0005] To address the technical issues of insufficient privacy protection, weak security, and poor flexibility in existing digital signature technologies, this paper proposes a multi-authority attribute-based blind signature method with bidirectional privacy protection. By introducing attribute-based signature technology, the digital signature is generated using the signer's attribute information rather than their explicit identity, effectively concealing the signer's identity information and improving the signer's privacy. The introduction of blind signature technology prevents the signer from obtaining the specific information of the signature content during the signing process, effectively preventing the leakage of the signature content. This significantly improves the privacy protection of users using digital signatures and meets the needs of privacy-critical applications. By adopting a multi-authority attribute-based signature method, attribute management is decentralized across multiple independent authorities, enhancing the system's risk resistance and overall security. By introducing a flexible threshold mechanism, the required number and combination of attributes can be dynamically adjusted based on actual application requirements and security policies, achieving more refined and flexible access control policies and permission management. For example, different threshold values can be set based on different access levels or operation types, enabling more fine-grained permission control to meet the needs of diverse application scenarios.

[0006] In order to achieve the above object, the technical solution of the present invention is achieved as follows:

[0007] A two-way privacy-preserving multi-authority attribute-based blind signature method includes the following steps:

[0008] S1. Construct a multi-authority attribute-based blind signature system and system parameters and initialize the system. The entities in the system include a central attribute authority, a distributed attribute authority, a signer, a user, and a verifier.

[0009] S2, the central attribute authority and the distributed attribute authority use hash functions and multi-order polynomials respectively to generate keys for the signer;

[0010] S3. The user blinds the message to be blind-signed and sends the blinded message to the signer.

[0011] S4. The signer calculates the signature of the received blinded message and sends it to the user;

[0012] S5. The user performs unblinding calculation on the signature of the received blinded message to obtain a blind signature, and sends the blind signature to the verifier;

[0013] S6. The verifier verifies the received blind signature.

[0014] Furthermore, the establishment of the system parameters includes: randomly selecting a large prime number q, the large prime number q>2 192 , define the attribute as the set of integers modulo q The elements in , the set of integers modulo q Let K represent the number of distributed attribute authorities; select a positive integer d.

[0015] Furthermore, during system initialization, the central attribute authority performs the following operations:

[0016] Assign a unique and distinct serial number i to each distributed attribute authority, and 1≤i≤K;

[0017] Generate a default attribute set Ω containing (d-1) elements for each distributed attribute authority i ,Ω i is the default attribute set of the distributed attribute authority with sequence number i;

[0018] Generate a set of attributes ω for each distributed attribute authority to be published to the signer i , the attribute sets of different distributed attribute authorities do not intersect with each other, and for the same distributed attribute authority, the attribute set ω i With the default attribute set Ω i do not intersect;

[0019] Set a key for each distributed attribute authority, the key is an integer s1, s2, ..., s K ;

[0020] Selecting a random generator is a multiplicative cyclic group with prime order q;

[0021] Select random number represents the set of all integers that are coprime with and smaller than the prime number q, and α is the master key of the central attribute authority;

[0022] Select a random element

[0023] Select hash functions H1, H2, H3:

[0024] Assume intermediate parameters g1 and Z, intermediate parameter g1 = g α , the intermediate parameter Z = e(g1,g2), where e is a bilinear mapping.

[0025] Furthermore, during system initialization, the distributed attribute authority with sequence number i performs the following operations:

[0026] Set contains n i Attribute set for an element

[0027] Set the threshold k i , k i <n i And k i <d;

[0028] Setting the predicate Among them, ω i,θ represents the attribute set generated by the distributed attribute authority with serial number i for the signer with identity θ;

[0029] Among them, the predicate Has the following properties:

[0030] like Then the predicate Otherwise, the predicate

[0031] The public parameters params in the system are (g, g1, g2, Z, d, H1, H2, H3), and the master key of the central attribute authority is a random number α.

[0032] Furthermore, the central attribute authority and the distributed attribute authority respectively use a hash function and a multi-order polynomial to generate a key for the signer in the following manner:

[0033] Assume that the signer's identity is θ, which is 128 bits in length; different distributed attribute authorities generate attribute sets ω for the signer respectively.i,θ ,and

[0034] The signer's key consists of two parts: a central key d generated by a central attribute authority and a θ,0 and the distributed first key d generated by the distributed attribute authority i,j,1 and the distributed second key d i,j,2 ;

[0035] Among them, the central attribute authority generates the central key d θ,0 The method is:

[0036] The central attribute authority selects a hash function f to generate a central key for the signer identified as θ in, Concatenate s after the identity θ i , and the result is used as the input of the hash function f; K represents the number of distributed attribute authorities, and the random number α is the master key of the central attribute authority.

[0037] Furthermore, the distributed attribute authority generates a distributed first key d i,j,1 and the distributed second key d i,j,2 The method is: distributed attribute authority selects (d-1) degree polynomial q i (·),and Generate random numbers Calculate the distributed first key Distributed Second Key Where j∈ω i,θ ∪Ω i , j is the attribute set ω i,θ ∪Ω i Elements in; random elements is a multiplicative cyclic group with prime order q, H1(j) means that the output of the hash function H1 after acting on the input element j is mapped to a multiplicative cyclic group with prime order q Elements in .

[0038] Furthermore, the method for the user to blind the message to be blind signed is:

[0039] Suppose the message to be blind signed is m, and the user generates a random number Then the blinded message H′2(m)=H2(m)g β , where H2(m) represents the output of the hash function H2 applied to the input message m, which is mapped to a multiplicative cyclic group with prime order q. The elements in g β is an intermediate variable.

[0040] Furthermore, the calculation method of the signature of the blinded message is:

[0041] To compute the signature of a blinded message, the predicate For every attribute set ω i,θ , there are at least k i The attribute exists in the i A collection of attributes In which, k i and n i are all positive integers, k i <n i And k i <d;

[0042] The signer selects a i A subset of attributes Default attribute subset And |Ω′ i |=dk i , and random numbers

[0043] Let the intermediate parameter S i =ω′ i,θ ∪Ω′ i , the signature of the blinded message σ′ θ,0 is the first part of the signature of the blinded message, is the second part of the signature of the blinded message, σ′ i,0 The third part of the signature of the blinded message.

[0044] in, σ′0=g δ Where, H′2(m) δ 、g δ 、 All are intermediate variables;

[0045] Lagrange coefficient

[0046] Furthermore, the user performs an unblinding calculation on the signature of the received blinded message, and obtains the expression of the blind signature as follows:

[0047] σ θ,0 =σ′ θ,0 / (σ′0) β ;

[0048] Among them, σ θ,0 Blind signature.

[0049] Furthermore, the verifier verifies the received blind signature by using a verification equation:

[0050]

[0051] Where H1(j) represents the output of the hash function H1 applied to the input element j, which is mapped to a multiplicative cyclic group with prime order q. Elements in

[0052] If the verification equation holds, the blind signature is considered valid; otherwise, the blind signature is considered invalid.

[0053] Compared with the prior art, the present invention has the following beneficial effects:

[0054] (1) Protects user privacy. When signing a message, the signer cannot know the specific content of the message. The signer only signs a blinded message and does not know the content of the message before blinding.

[0055] (2) Prevent signatures from being tracked and associated. The signer cannot see the message content and cannot match the signature with the original message.

[0056] (3) Enhanced privacy protection for signers: Through the proposed attribute-based signature mechanism, the digital signature is generated using the signer's attribute information rather than their explicit identity. While ensuring the validity of the signature, the signer's identity information is effectively concealed, thereby improving the level of privacy protection for the signer during the signing process.

[0057] (4) Improve system configuration flexibility and availability: Supports dynamically adjustable threshold parameter settings. This feature not only gives the system a high degree of configuration flexibility to adapt to diverse application scenarios, but also effectively avoids the risk of system service interruption or unavailability caused by the adjustment process of traditional fixed thresholds, ensuring the continuous and stable operation of the system.

[0058] (5) By building a distributed multi-attribute authority management system, the robustness and efficiency of the system are improved: The present invention adopts a distributed architecture of multi-attribute authority, authorizing different categories of attribute information to corresponding independent attribute authorities for management and verification. Compared with the traditional single attribute authority model, the distributed architecture of multi-attribute authority fundamentally eliminates the hidden danger of single point failure of the system caused by the failure of a single attribute authority. In addition, by distributing and balancing user access requests and the corresponding computing load among multiple attribute authorities, the overall processing capacity, response speed and fault tolerance of the system can be improved, thereby enhancing the robustness and scalability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0060] Figure 1 It is a schematic diagram of the process of the present invention. DETAILED DESCRIPTION

[0061] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without creative work are within the scope of protection of the present invention.

[0062] like Figure 1 As shown, a two-way privacy-preserving multi-authority attribute-based blind signature method includes the following steps:

[0063] S1. Construct a multi-authority attribute-based blind signature system and system parameters and initialize the system. The entities in the system include a central attribute authority, a distributed attribute authority, a signer, a user (the entity that requests the signer to perform a blind signature), and a verifier.

[0064] The central attribute authority is responsible for generating keys for the distributed attribute authorities and for generating partial keys for signers. Distributed attribute authorities manage attributes within their respective domains. Different distributed attribute authorities manage disjoint attributes. They are also responsible for generating partial keys for signers. A user generates a message to be signed, blinds it, and requests the signer to sign the blinded message. The signer calculates the signature of the blinded message and sends it to the user. After receiving the signature, the user performs the unblinding calculation and sends the resulting blind signature to the verifier. The verifier verifies the blind signature sent by the user and outputs the verification result.

[0065] The process of establishing system parameters is as follows:

[0066] The elements in each attribute set in the present invention are all attributes. Randomly select a large prime number q and q>2 192 , define the attribute as the set of integers modulo q The elements in , the set of integers modulo q

[0067] K represents the number of distributed attribute authorities. If there is only one distributed attribute authority, the requirement for multiple attribute authorities is not met. If the number of distributed attribute authorities is too large, the computational complexity will be high. In this embodiment, the number of distributed attribute authorities K is in the range of 3 ≤ K ≤ 10.

[0068] Select a positive integer d. If the value of the positive integer d is too small, system security will be reduced; if the value of the positive integer d is too large, the computational complexity will increase. Therefore, the value of the positive integer d should be selected based on the user's actual needs. In this embodiment, the positive integer value is: d ≥ 5.

[0069] Furthermore, during system initialization, the central attribute authority performs the following operations:

[0070] Assign a unique and different serial number i to each distributed attribute authority, and 1≤i≤K.

[0071] Generate a default attribute set Ω containing (d-1) elements for each distributed attribute authority i ,|Ω i |=d-1.Ω i Is the default attribute set for the distributed attribute authority with sequence number i.

[0072] Generate a set of attributes ω for each distributed attribute authority to be published to the signer i , where 1≤i≤K. The attribute sets of different distributed attribute authorities do not intersect with each other, and for the same distributed attribute authority, the attribute set ω i With the default attribute set Ω i Do not intersect.

[0073] Set a key for each distributed attribute authority, the key is an integer s1, s2, ..., s K , with a length of 128 binary bits.

[0074] Selecting a random generator is a multiplicative cyclic group of prime order q.

[0075] Select random number The length is 128 bits in binary. represents the set of all integers that are coprime with and smaller than the prime number q. α is the master key of the central attribute authority.

[0076] Select a random element

[0077] Select hash functions H1, H2, H3: The hash function can select the SHA256 algorithm or the SM3 algorithm released by the National Cryptography Administration, and then map the algorithm output to the elements in the multiplicative cyclic group with prime order q. in.

[0078] Let the intermediate parameters be g1 and Z, where the intermediate parameter g1 = g α , and the intermediate parameter Z = e(g1, g2), where e is a bilinear mapping.

[0079] Furthermore, when performing system initialization, the operations performed by the distributed attribute authority with serial number i include:

[0080] Set the attribute set containing n i elements

[0081] Set the threshold value k i , k i < n i and k i < d, and the threshold value is flexibly set according to actual needs.

[0082] Set the predicate where θ is the signer's identity identifier, and ω i,θ represents the attribute set generated by the distributed attribute authority with serial number i for the signer with identity identifier θ.

[0083] where the predicate has the following properties:

[0084] If then the predicate Otherwise, the predicate

[0085] The public parameters params in the system are (g, g1, g2, Z, d, H1, H2, H3), and the master key of the central attribute authority is the random number α.

[0086] S2, the central attribute authority and the distributed attribute authority respectively use the hash function and multiple polynomials to generate keys for the signer.

[0087] Assume that the signer's identity identifier is θ, with a length of 128 bits in binary. The distributed attribute authority with serial number i generates the attribute set ω i,θ , and

[0088] The signer's key consists of two parts, namely the central key d θ,0 generated by the central attribute authority and the distributed first key d i,j,1 and the distributed second key d i,j,2.

[0089] Among them, the central attribute authority generates the central key d θ,0 The method is:

[0090] The central attribute authority selects the hash function f, which can be the SHA256 algorithm or the SM3 algorithm issued by the State Cryptography Administration. The central attribute authority generates a central key for the signer identified as θ in, That is, concatenate s after the identity θ i , and use the result as the input of the hash function f.

[0091] Among them, the distributed attribute authority generates the distributed first key d i,j,1 and the distributed second key d i,j,2 The method is:

[0092] Distributed attribute authority selects (d-1) degree polynomial q i (·),and Generate random numbers Calculate the distributed first key Distributed Second Key where 1≤i≤K, j∈ω i,θ ∪Ω i . j is the attribute set ω i,θ ∪Ω i The elements in , H1(j) means that the output of the hash function H1 after acting on the input element j is mapped to a multiplicative cyclic group with prime order q Elements in .

[0093] S3. The user blinds the message that needs to be blind signed and sends the blinded message to the signer.

[0094] Assume that the message to be blind signed is m, and the user generates a random number with a length of 128 bits in binary Calculate the blinded message H′2(m)=H2(m)g β , and sends the blinded message H′2(m) to the signer, where H2(m) represents the output of the hash function H2 applied to the input message m, which is mapped to a multiplicative cyclic group with a prime order q. The elements in g β is an intermediate variable.

[0095] S4. The signer calculates the signature of the received blinded message and sends it to the user.

[0096] To compute the signature of a blinded message, the predicate For every attribute set ω i,θ , there are at least k iThe attribute exists in the i A collection of attributes In which, k i and n i are all positive integers, k i <n i And k i <d。

[0097] The signer selects a i A subset of attributes Default attribute subset And |Ω′ i |=dk i , and random numbers These random numbers are all positive integers with a length of 128 binary bits.

[0098] Let the intermediate parameter S i =ω′ i,θ ∪Ω′ i The signer computes the signature of the blinded message σ′ θ,0 is the first part of the signature of the blinded message, is the second part of the signature of the blinded message, and σ0′ is the third part of the signature of the blinded message.

[0099] in, σ′0=g δ Where, H′2(m) δ 、g δ 、 All are intermediate variables.

[0100] Lagrange coefficient

[0101] S5. The user performs unblinding calculation on the signature of the received blinded message, obtains a blind signature, and sends the blind signature to the verifier.

[0102] Perform unblinding calculation and obtain the expression of blind signature:

[0103] σ θ,0 =σ′ θ,0 / (σ′0)β

[0104] Among them, σ θ,0 Blind signature.

[0105] S6. The verifier verifies the received blind signature.

[0106] After receiving the blind signature from the user, the verifier verifies the blind signature using the verification equation, which is:

[0107]

[0108] If the verification equation holds true, the blind signature is considered valid and the string "True" is output; otherwise, the blind signature is considered invalid and the string "False" is output.

[0109] In summary, when signing a message, the signer in the present invention cannot know the specific content of the message, nor can he match the signature with the original message, which effectively protects the user's privacy.

[0110] This invention proposes an attribute-based signature mechanism that uses the signer's attribute information rather than their explicit identity to generate a digital signature. This ensures the validity of the signature while effectively concealing the signer's identity information, thereby enhancing the signer's privacy during the signing process.

[0111] This invention utilizes a distributed architecture with multiple attribute authorities, authorizing the management and verification of different types of attribute information to corresponding independent attribute authorities. Compared to the traditional single-attribute authority model, this distributed architecture fundamentally eliminates the single point of failure that can occur in the system due to the failure of a single attribute authority. Furthermore, by distributing and balancing user access requests and the corresponding computing load across multiple attribute authorities, the system's overall processing capacity, response speed, and fault tolerance are improved, thereby enhancing the system's robustness and scalability.

[0112] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A two-way privacy-preserving multi-authority attribute-based blind signature method, characterized in that: The following steps are involved: S1. Construct a multi-authority attribute-based blind signature system and system parameters and initialize the system. The entities in the system include a central attribute authority, a distributed attribute authority, a signer, a user, and a verifier. S2, the central attribute authority and the distributed attribute authority use hash functions and multi-order polynomials respectively to generate keys for the signer; S3. The user blinds the message to be blind-signed and sends the blinded message to the signer. S4. The signer calculates the signature of the received blinded message and sends it to the user; S5. The user performs unblinding calculation on the signature of the received blinded message to obtain a blind signature, and sends the blind signature to the verifier; S6. The verifier verifies the received blind signature.

2. The multi-authority attribute-based blind signature method for bidirectional privacy protection according to claim 1 is characterized in that: The establishment of the system parameters includes: randomly selecting a large prime number q, where the large prime number q>2 192 , define the attribute as the set of integers modulo q The elements in , the set of integers modulo q Let K represent the number of distributed attribute authorities; select a positive integer d.

3. The multi-authority attribute-based blind signature method for bidirectional privacy protection according to claim 2 is characterized in that: During system initialization, the central attribute authority performs the following operations: Assign a unique and distinct serial number i to each distributed attribute authority, and 1≤i≤K; Generate a default attribute set Ω containing (d-1) elements for each distributed attribute authority i ,Ω i is the default attribute set of the distributed attribute authority with sequence number i; Generate a set of attributes ω for each distributed attribute authority to be published to the signer i , the attribute sets of different distributed attribute authorities do not intersect with each other, and for the same distributed attribute authority, the attribute set ω i With the default attribute set Ω i do not intersect; Set a key for each distributed attribute authority, the key is an integer s1, s2, ..., s K ; Selecting a random generator is a multiplicative cyclic group with prime order q; Select random number represents the set of all integers that are coprime with and smaller than the prime number q, and α is the master key of the central attribute authority; Select a random element Choosing a hash function Assume intermediate parameters g1 and Z, intermediate parameter g1 = g α , the intermediate parameter Z = e(g1,g2), where e is a bilinear mapping.

4. The method for bidirectional privacy protection with multiple authority attribute-based blind signatures according to claim 3, characterized in that: During system initialization, the distributed attribute authority with sequence number i performs the following operations: Set contains n i Attribute set for an element Set the threshold k i , k i <n i And k i <d; Setting the predicate Among them, ω i,θ represents the attribute set generated by the distributed attribute authority with serial number i for the signer with identity θ; Among them, the predicate Has the following properties: like Then the predicate Otherwise, the predicate The public parameters params in the system are (g, g1, g2, Z, d, H1, H2, H3), and the master key of the central attribute authority is a random number α.

5. The multi-authority attribute-based blind signature method for bidirectional privacy protection according to claim 1 or 4, characterized in that: The central attribute authority and the distributed attribute authority use hash functions and multi-order polynomials respectively to generate keys for signers in the following manner: Assume that the signer's identity is θ, which is 128 bits in length; different distributed attribute authorities generate attribute sets ω for the signer respectively. i,θ ,and The signer's key consists of two parts: a central key d generated by a central attribute authority and a θ,0 and the distributed first key d generated by the distributed attribute authority i,j,1 and the distributed second key d i,j,2 ; Among them, the central attribute authority generates the central key d θ,0 The method is: The central attribute authority selects a hash function f to generate a central key for the signer identified as θ in, Concatenate s after the identity θ i , and the result is used as the input of the hash function f; K represents the number of distributed attribute authorities, and the random number α is the master key of the central attribute authority.

6. The method for bidirectional privacy protection with multiple authority attribute-based blind signatures according to claim 5, characterized in that: The distributed attribute authority generates a distributed first key d i,j,1 and the distributed second key d i,j,2 The method is: distributed attribute authority selects (d-1) degree polynomial q i (·),and Generate random numbers Calculate the distributed first key Distributed Second Key Where j∈ω i,θ ∪Ω i , j is the attribute set ω i,θ ∪Ω i Elements in; random elements is a multiplicative cyclic group with prime order q, H1(j) means that the output of the hash function H1 after acting on the input element j is mapped to a multiplicative cyclic group with prime order q Elements in .

7. The multi-authority attribute-based blind signature method for bidirectional privacy protection according to claim 5, characterized in that: The method for the user to blind the message that needs to be blind signed is: Suppose the message to be blind signed is m, and the user generates a random number Then the blinded message H2′(m)=H2(m)g β , where H2(m) represents the output of the hash function H2 applied to the input message m, which is mapped to a multiplicative cyclic group with prime order q. The elements in g β is an intermediate variable.

8. The method for bidirectional privacy-preserving multi-authority attribute-based blind signature according to claim 7, characterized in that: The calculation method of the signature of the blinded message is: To compute the signature of a blinded message, the predicate For every attribute set ω i,θ , there are at least k i The attribute exists in the i A collection of attributes In which, k i and n i are all positive integers, k i <n i And k i <d; The signer selects a i A subset of attributes Default attribute subset And |Ω′ i |=dk i , and random numbers Let the intermediate parameter S i =ω′ i,θ ∪Ω′ i , the signature of the blinded message σ′ θ,0 is the first part of the signature of the blinded message, is the second part of the signature of the blinded message, σ′ i,0 The third part of the signature of the blinded message. in, Where, H′2(m) δ 、g δ 、 All are intermediate variables; Lagrange coefficient 9. The method for bidirectional privacy-preserving multi-authority attribute-based blind signature according to claim 8, characterized in that: The user performs unblinding calculation on the signature of the received blinded message and obtains the expression of the blind signature: s θ,0 =σ′ θ,0 / (σ′0)β; Among them, σ θ,0 Blind signature.

10. The two-way privacy-preserving multi-authority attribute-based blind signature method according to claim 9, characterized in that: The method for the verifier to verify the received blind signature is: the verifier verifies the received blind signature through the verification equation, and the verification equation is: Where H1(j) represents the output of the hash function H1 applied to the input element j, which is mapped to a multiplicative cyclic group with prime order q. Elements in If the verification equation holds, the blind signature is considered valid; otherwise, the blind signature is considered invalid.

Images