Multi-authority attribute-based proxy signature method with flexible thresholds

Abstract

The invention discloses a multi-authoritative attribute-based proxy signature method with a flexible threshold, and relates to the technical field of cyberspace security, the method comprises the following steps: constructing a multi-authoritative attribute-based proxy signature system with entities including a central attribute authority, a distributed attribute authority, an original signer, a proxy signer and a verifier, and establishing system parameters, carrying out system initialization; generating a secret key for an original signer and a secret key for a proxy signer through central attribute authority and distributed attribute authority respectively; the original signer generates a consignment and authorization to the proxy signer; after the proxy signer receives the authorization sent by the original signer, authorization verification is carried out; after the authorization verification is passed, the proxy signer calculates a proxy signature for the message according to the authorization sent by the original signer, and sends the message, the delegate and the proxy signature to the verifier; the verifier verifies the proxy signature based on the message and the delegate. The method is high in flexibility and adaptability.

Description

Technical Field

[0001] The present invention relates to the technical field of cyberspace security, and in particular to a multi-authority attribute-based proxy signature method. Background Art

[0002] With the widespread and in-depth application of information technology in various fields, digital signatures, as a key technology for ensuring information integrity and authenticating sender identities, are facing increasingly complex and diverse application scenarios. In many practical application environments, traditional attribute-based signature methods have gradually exposed their limitations.

[0003] The invention patent with application number 201711160474.2 discloses a threshold attribute-based signature method for multiple authorization centers. This method first introduces the idea of attribute-based signature, and realizes fine-grained control of user signature authority by whether the user has the corresponding attributes. Utilizing the multi-authorization center technology, the user's attributes are divided into different attribute authorization centers for management. The attribute authorization center generates part of the user's signature private key. An additional trusted central authorization party is required to manage multiple attribute authorization centers and generate part of the user's signature private key. At the same time, combined with the idea of threshold signature, the key for generating the final threshold signature is held by different users. A threshold signature can only be generated when the number of signers is not less than the threshold value.

[0004] The invention patent with application number 202210122279.5 discloses an attribute-based signature method for multiple authorization centers, including the following steps: S1: The central authorization center establishes the public parameters of the system and completes the registration of all users and n attribute authorization centers. Each attribute authorization center generates a set of public-private key pairs, where the public key is securely shared with any entity in the system. The central authorization center generates the public key of the system based on the public key of the attribute authorization center; S2: The user applies to k attribute key components associated with the attribute set owned by n attribute authorization centers and reconstructs them to obtain a complete key; S3: The user sends a signed message with a specified predicate strategy based on the complete key; S4: Any other user judges whether the signed message is legal based on the predicate strategy, and outputs 1 if it is, otherwise outputs 0.

[0005] Both of the above invention patents implement attribute-based signature methods with multi-attribute authority, but both have the problem that the signer's signature authority cannot be transferred to other entities and cannot authorize other entities to sign on their behalf. This requires the signer to continuously provide signature services online, which is difficult to achieve in practical applications. Summary of the Invention

[0006] In view of the technical problem that the existing multi-attribute authoritative attribute-based signature method has the problem that the signer's signing authority cannot be transferred to other entities and other entities cannot be authorized to sign on their behalf, the present invention proposes a multi-attribute authoritative attribute-based proxy signature method with a flexible threshold. By introducing a proxy signature mechanism, the signer can temporarily grant his or her signing authority to the proxy, and the proxy will sign on his or her behalf to protect the integrity and authentication of the message.

[0007] In order to achieve the above object, the technical solution of the present invention is achieved as follows:

[0008] A multi-attribute authoritative attribute-based proxy signature method with flexible thresholds includes the following steps:

[0009] S1. Construct a multi-authority attribute-based proxy signature system and system parameters and initialize the system. The entities in the system include a central attribute authority, a distributed attribute authority, an original signer, a proxy signer, and a verifier.

[0010] S2, the central attribute authority and the distributed attribute authority use hash functions and multi-order polynomials to generate keys for the original signer and for the proxy signer, respectively;

[0011] S3. The original signer generates a power of attorney and authorization to the proxy signer;

[0012] S4. After receiving the authorization from the original signer, the proxy signer performs authorization verification. If the verification passes, the process proceeds to step S5; otherwise, the process returns to step S3.

[0013] S5. The proxy signer calculates the proxy signature of the message based on the authorization sent by the original signer, and sends the message, the power of attorney, and the proxy signature to the verifier;

[0014] S6. The verifier verifies the proxy signature based on the message and the power of attorney.

[0015] Preferably, the establishment of the system parameters includes: randomly selecting a large prime number q, the large prime number q>2 192 , define the attribute as the set of integers modulo q The elements in , the set of integers modulo q Let K represent the number of distributed attribute authorities; select a positive integer d.

[0016] Preferably, when the system is initialized, the operations performed by the central attribute authority include:

[0017] Assign a unique and distinct serial number i to each distributed attribute authority;

[0018] Generate a default attribute set Ω containing (d-1) elements for each distributed attribute authorityi ,|Ω i |=d-1;

[0019] Generate an attribute set ω for each distributed attribute authority to be published to the original signer and the proxy signer i , where 1≤i≤K, the attribute sets of different distributed attribute authorities are disjoint, and for the same distributed attribute authority, the attribute set ω i With the default attribute set Ω i do not intersect;

[0020] Set a key for each distributed attribute authority, the key is an integer s1, s2, ..., s K ;

[0021] Selecting a random generator is a multiplicative cyclic group with prime order q;

[0022] Select random number represents the set of all integers that are coprime with and smaller than the prime number q, and α is the master key of the central attribute authority;

[0023] Select a random element

[0024] Select hash functions H1, H2, H3:

[0025] Let the intermediate parameter g1 = g α , the intermediate parameter Z = e(g1,g2), where e is a bilinear mapping.

[0026] Preferably, when the system is initialized, the operations performed by the distributed attribute authority with sequence number i include:

[0027] Set contains n i Attribute set for an element

[0028] Set the threshold k i , k i <n i And k i <d;

[0029] Setting the predicate Among them, θ is the identity identifier, ω i,θ represents the attribute set generated by the distributed attribute authority with serial number i for the signer with identity θ;

[0030] Among them, the predicate Has the following properties:

[0031] like Then the predicate Otherwise, the predicate

[0032] The public parameters params in the system are (g, g1, g2, Z, d, H1, H2, H3), and the master key of the central attribute authority is a random number α.

[0033] Preferably, the central attribute authority and the distributed attribute authority use a hash function and a multi-order polynomial respectively to generate a key for the original signer and a key for the proxy signer in the following manner:

[0034] Assume that the identities of the original signer and the proxy signer are θ o and θ p , with a length of 128 bits in binary; different distributed attribute authorities generate attribute sets for the original signer and the proxy signer respectively. and and 1≤i o ,i p ≤K;i o is the serial number of the distributed attribute authority that generated the key for the original signer, i p is the serial number of the distributed attribute authority that generates keys for the proxy signer;

[0035] The original signer's key consists of two parts: a central key generated by a central attribute authority and a and a distributed first key generated by a distributed attribute authority and distributed second key

[0036] Among them, the central attribute authority generates the central key The method is:

[0037] The central attribute authority selects the hash function f, and the central attribute authority is the identity θ o The central key generated by the original signer in, In the identity θ o Post-tandem The result is used as the input of the hash function f;

[0038] Among them, the distributed attribute authority generates the distributed first key and distributed second key The method is:

[0039] Serial number is i o The distributed attribute authority selects a (d-1) degree polynomial and Generate random numbers Calculate the distributed first key Distributed Second Key where 1≤i o ≤K, The serial number is i o The default attribute set of the distributed attribute authority, j o For attribute set Elements in .

[0040] Preferably, the proxy signer's key consists of two parts: a central key generated by a central attribute authority and a and a distributed first key generated by a distributed attribute authority and distributed second key The identity is θ p The central key generated by the central attribute authority for the proxy signer is By serial number i p The distributed first key generated by the distributed attribute authority Distributed Second Key where 1≤i p ≤K, Random Numbers (d-1) degree polynomial satisfy The serial number is i p The default attribute set of the distributed attribute authority, j p For attribute set Elements in .

[0041] Preferably, the method for the original signer to generate a power of attorney and authorize the proxy signer is:

[0042] The power of attorney w includes the original signer's entrustment information to the proxy signer, and the entrustment information includes the entrustment content and validity period; the original signer's predicate Require that for each attribute set At least The attribute exists in the A collection of attributes Among them, and are all positive integers, and

[0043] If the original signer's predicate The original signer cannot generate authorization;

[0044] If the original signer's predicate The original signer performs the following operations to generate a power of attorney and authorization for the proxy signer:

[0045] ① For each distributed attribute authority generated attribute set Select the A subset of attributes Default attribute subset and

[0046] ②For each attribute set generated by the distributed attribute authority Pick a random number

[0047] ③For each attribute set generated by the distributed attribute authority Set the intermediate parameters The original signer calculates the authorization to send to the proxy signer

[0048] in, For the first part of the authorization, For the second part of the authorization, This is the third part of the authorization; σ′ o,0 =g δ ;

[0049] H2(w) δ , g δ , are all intermediate variables; Lagrange coefficients

[0050] Preferably, after the proxy signer receives the authorization from the original signer, the method for performing authorization verification is as follows: the proxy signer verifies the authorization from the original signer by verifying the following equation:

[0051]

[0052] H1(j o ) represents the hash function H1 acting on the input element j o The output is mapped to a multiplicative cyclic group with prime order q The elements in H2(w) represent the output of the hash function H2 after acting on the input proxy w is mapped to a multiplicative cyclic group with prime order q Elements in

[0053] If the equality holds, the authorization sent by the original signer is considered valid; otherwise, the authorization sent by the original signer is considered invalid.

[0054] Preferably, the proxy signer calculates the proxy signature of the message based on the authorization sent by the original signer in the following manner:

[0055] The proxy signer calculates the proxy signature of message m based on the authorization of the original signer. To calculate the proxy signature of message m, the predicate of the proxy signer is Require that for each attribute set At least The attribute exists in the A collection of attributes middle, and are all positive integers, and

[0056] If the predicate of the proxy signer The proxy signer cannot compute the proxy signature;

[0057] If the predicate of the proxy signer The proxy signer performs the following operations to compute the proxy signature of message m:

[0058] (1) For each attribute set generated by the distributed attribute authority Select the A subset of attributes Default attribute subset and

[0059] (2) For each attribute set generated by the distributed attribute authority Pick a random number

[0060] (3) For each attribute set generated by the distributed attribute authority Set the intermediate variable The proxy signature calculated by the proxy signer is

[0061] in, For the first part of the signature, For the second part of the signature, The third part of the signature; σ′ p ,0=g ε ;

[0062] in, H3(m) ε for, and g ε All are intermediate variables.

[0063] Preferably, the method for the verifier to verify the proxy signature based on the message and the power of attorney is: the verifier verifies the proxy signature through the following verification equation:

[0064]

[0065] Among them, H1(j p ) represents the hash function H1 acting on the input element j p The output is mapped to a multiplicative cyclic group with prime order q The elements in H3(m) represent the output of the hash function H3 after applying the input message m to a multiplicative cyclic group with a prime order q. Elements in

[0066] If the verification equation holds, the proxy signature is considered valid; otherwise, the proxy signature is considered invalid.

[0067] Compared with the prior art, the present invention has the following beneficial effects:

[0068] The present invention allows the original signer to grant the signing authority to the proxy signer, and allows the proxy signer to calculate the digital signature on behalf of the original signer, thereby protecting the integrity and authentication of the message.

[0069] The present invention uses the attribute information of the signer rather than the identity information to calculate the digital signature, thereby protecting the identity privacy of the signer.

[0070] The present invention can provide a flexible threshold value, improve the flexibility of the system, and avoid the situation where the system becomes unavailable due to changing the threshold value.

[0071] The present invention manages different types of attribute information by different attribute authorities. This avoids the problem of using a single attribute authority to manage all attribute information, which can cause the attribute authority to become a single point of failure and result in a high computational load when there are many original signers and proxy signers. By using multiple attribute authorities to manage different types of attribute information, a single point of failure is avoided, system robustness is improved, and a large number of access requests can be balanced across different attribute authorities. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0073] Figure 1It is a schematic diagram of the process of the present invention. DETAILED DESCRIPTION

[0074] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without creative work are within the scope of protection of the present invention.

[0075] like Figure 1 As shown, a multi-authority attribute-based proxy signature method with a flexible threshold value includes the following steps:

[0076] S1. Construct a multi-authority attribute-based proxy signature system and system parameters and initialize the system. The entities in the system include a central attribute authority, a distributed attribute authority, an original signer, a proxy signer, and a verifier.

[0077] The central attribute authority is responsible for generating keys for the distributed attribute authorities and for generating partial keys for the original signer and proxy signer. Distributed attribute authorities are responsible for managing attributes within their respective domains. Different distributed attribute authorities manage disjoint attributes. Distributed attribute authorities are also responsible for generating partial keys for the original signer and proxy signer. The original signer is responsible for generating a power of attorney for the proxy signer, calculating the corresponding authorization, and granting signing authority to the proxy signer. The proxy signer is responsible for verifying the integrity and authenticity of the power of attorney and authorization. If the integrity and authenticity are intact, the proxy signature is calculated based on the original signer's power of attorney and authorization. The verifier is responsible for verifying the proxy signature sent by the proxy signer and outputting the verification result.

[0078] The process of establishing system parameters is as follows:

[0079] The elements in each attribute set in the present invention are all attributes. Randomly select a large prime number q, large prime number q>2 192 , define the attribute as the set of integers modulo q The elements in , the set of integers modulo q

[0080] K represents the number of distributed attribute authorities. Having only one distributed attribute authority does not meet the requirement for multiple attribute authorities. Excessive distributed attribute authorities will result in a high computational load during authorization generation, authorization verification, signature calculation, and signature verification. In this embodiment, the number of distributed attribute authorities, K, is in the range of 3 ≤ K ≤ 10.

[0081] Select a positive integer d. If the value of the positive integer d is too small, system security will be reduced; if the value of the positive integer d is too large, the computational complexity will increase. Therefore, the value of the positive integer d is selected based on the actual needs of the original signer and the proxy signer. In this embodiment, the positive integer value is: d ≥ 5.

[0082] Furthermore, during system initialization, the central attribute authority performs the following operations:

[0083] Assign a unique and distinct sequence number i to each distributed attribute authority.

[0084] Generate a default attribute set Ω containing (d-1) elements for each distributed attribute authority i ,|Ω i |=d-1.

[0085] Generate an attribute set ω for each distributed attribute authority to be published to the original signer and the proxy signer i , where 1≤i≤K. The attribute sets of different distributed attribute authorities do not intersect with each other, and for the same distributed attribute authority, the attribute set ω i With the default attribute set Ω i Do not intersect.

[0086] Set a key for each distributed attribute authority, the key is an integer s1, s2, ..., s K , with a length of 128 binary bits.

[0087] Selecting a random generator is a multiplicative cyclic group of prime order q.

[0088] Select random number The length is 128 bits in binary. represents the set of all integers that are coprime with and smaller than the large prime number q, and α is the master key of the central attribute authority.

[0089] Select a random element

[0090] Select hash functions H1, H2, H3: The hash function uses the SHA256 algorithm or the SM3 algorithm issued by the State Cryptography Administration, and then maps the algorithm output to a multiplication cyclic group with a prime order q. Elements in .

[0091] Let the intermediate parameter g1 = g α , the intermediate parameter Z = e(g1,g2), where e is a bilinear mapping.

[0092] Further, when performing system initialization, the operations performed by the distributed attribute authority with serial number i include:

[0093] Set an attribute set containing n i elements

[0094] Set the threshold value k i , k i < n i and k i < d, and the threshold value is flexibly set according to actual needs.

[0095] Set the predicate where θ is the identity identifier, and ω i,θ represents the attribute set generated by the distributed attribute authority with serial number i for the signer with identity identifier θ.

[0096] where the predicate has the following properties:

[0097] If then the predicate Otherwise, the predicate

[0098] The public parameters params in the system are (g, g1, g2, Z, d, H1, H2, H3), and the master key of the central attribute authority is the random number α.

[0099] S2, the central attribute authority and the distributed attribute authority respectively use the hash function and the multiple polynomial to generate keys for the original signer and the proxy signer respectively.

[0100] Assume that the identity identifiers of the original signer and the proxy signer are θ o and θ p , with a length of 128 bits in binary. The attribute sets generated by different distributed attribute authorities for the original signer and the proxy signer are respectively and and 1 ≤ i o , i p ≤ K. i o is the serial number of the distributed attribute authority that generates the key for the original signer, and i p is the serial number of the distributed attribute authority that generates the key for the proxy signer.

[0101] The distributed attribute authority with serial number i o generates an attribute set for the original signer with identity identifier θ o The distributed attribute authority with serial number i p generates an attribute set for the original signer with identity identifier θp The proxy signer generates the attribute set

[0102] The original signer's key consists of two parts: a central key generated by a central attribute authority and a and a distributed first key generated by a distributed attribute authority and distributed second key

[0103] Among them, the central attribute authority generates the central key The method is:

[0104] The central attribute authority selects the hash function f, which uses the SHA256 algorithm or the SM3 algorithm issued by the State Cryptography Administration. The central attribute authority is the identity θ o The central key generated by the original signer in, That is, in the identity θ o Post-tandem The result is used as the input of the hash function f.

[0105] Among them, the distributed attribute authority generates the distributed first key and distributed second key The method is:

[0106] Serial number is i o The distributed attribute authority selects a (d-1) degree polynomial and Generate random numbers Calculate the distributed first key Distributed Second Key where 1≤i o ≤K, in, The serial number is i o The default attribute set of the distributed attribute authority, j o For attribute set Elements in .

[0107] The proxy signer's key also consists of two parts: a central key generated by a central attribute authority and a and a distributed first key generated by a distributed attribute authority and distributed second key

[0108] The method for generating the key of the proxy signer is the same as that of the original signer, and the identity is θ p The central key generated by the central attribute authority for the proxy signer is By serial number i p The distributed first key generated by the distributed attribute authority Distributed Second Key where 1≤i p ≤K, Random Numbers (d-1) degree polynomial satisfy The serial number is i p The default attribute set of the distributed attribute authority, j p For attribute set Elements in .

[0109] S3. The original signer generates a power of attorney and authorization for the proxy signer.

[0110] The original signer generates a power of attorney w and authorizes the proxy signer. The power of attorney w includes the original signer's authorization information to the proxy signer, including the authorization content, validity period, etc.

[0111] To generate authorization, the original signer's predicate Require that for each attribute set At least The attribute exists in the A collection of attributes Among them, and are all positive integers, and

[0112] If the original signer's predicate The original signer cannot generate an authorization.

[0113] If the original signer's predicate The original signer performs the following operations to generate a power of attorney and authorization for the proxy signer:

[0114] ① For each distributed attribute authority generated attribute set Select the A subset of attributes Default attribute subset and

[0115] ②For each attribute set generated by the distributed attribute authority Pick a random number These random numbers are all positive integers with a length of 128 binary bits.

[0116] ③For each attribute set generated by the distributed attribute authority Set the intermediate parameters The original signer calculates the authorization to send to the proxy signer in, For the first part of the authorization, For the second part of the authorization, This is the third part of the authorization. σ′ o,0 =g δ .

[0117] in, H2(w) δ , g δ , All are intermediate variables.

[0118] Lagrange coefficient

[0119] ④ The original signer will submit the power of attorney and authorization Sent to the proxy signer.

[0120] S4. After receiving the authorization from the original signer, the proxy signer performs authorization verification. If the verification passes, step S5 is executed; otherwise, the process returns to step S3.

[0121] After the proxy signer receives the authorization from the original signer, it verifies the authorization by verifying the following equation:

[0122]

[0123] If the equation holds true, the authorization sent by the original signer is considered valid; otherwise, the authorization sent by the original signer is considered invalid. o ) represents the hash function H1 acting on the input element j o The output is mapped to a multiplicative cyclic group with prime order q H2(w) represents the output of the hash function H2 applied to the input proxy w, which is mapped to a multiplicative cyclic group with prime order q. Elements in .

[0124] S5. The proxy signer calculates the proxy signature of the message based on the authorization sent by the original signer, and sends the message, the power of attorney, and the proxy signature to the verifier.

[0125] The proxy signer computes the proxy signature of message m based on the authorization of the original signer. To compute the proxy signature of message m, the predicate of the proxy signer Require that for each attribute set At least The attribute exists in the A collection of attributes middle, and are all positive integers, and

[0126] If the predicate of the proxy signer A proxy signer cannot compute a proxy signature.

[0127] If the predicate of the proxy signer The proxy signer performs the following operations to compute the proxy signature of message m:

[0128] (1) For each attribute set generated by the distributed attribute authority Select the A subset of attributes Default attribute subset and

[0129] (2) For each attribute set generated by the distributed attribute authority Pick a random number These random numbers are all positive integers with a length of 128 binary bits.

[0130] (3) For each attribute set generated by the distributed attribute authority Set the intermediate variable The proxy signature calculated by the proxy signer is in, For the first part of the signature, is the second part of the signature, σ′ p,0 This is the third part of the signature.

[0131] in, σ′ p,0 =g ε .

[0132] in, H3(m) ε for, and g ε All are intermediate variables.

[0133] (4) The proxy signer sends the message m, the power of attorney w, and the proxy signature Sent to the validator.

[0134] S6. The verifier verifies the proxy signature based on the message and the power of attorney.

[0135] The verifier receives the message m, the power of attorney w and the proxy signature from the proxy signer Finally, the proxy signature is verified by the following verification equation:

[0136]

[0137] If the verification equation holds, the proxy signature is considered valid and the string "True" is output; otherwise, the proxy signature is considered invalid and the string "False" is output.

[0138] Among them, H1(j p ) represents the hash function H1 acting on the input element j p The output is mapped to a multiplicative cyclic group with prime order q H3(m) means that the output of the hash function H3 after applying the input message m is mapped to a multiplicative cyclic group with prime order q Elements in .

[0139] By introducing a multi-attribute authority mechanism, the present invention gets rid of the dependence on a single attribute authority, and can comprehensively determine the authority qualifications of the original signer or the proxy signer based on multiple different attribute dimensions, making the signing process more in line with complex real-world business logic, so as to meet the multi-faceted identity verification needs of participants under different organizational structures and business processes, greatly broadening the scope of application of signatures, and can accurately adapt to complex business scenarios such as cross-departmental collaboration, heterogeneous system interaction, and multi-subject participation.

[0140] At the same time, by designing flexible threshold values, compared with traditional fixed threshold signatures, the present invention can dynamically adjust the number or weight of attribute conditions that need to be met for the signature to take effect according to the specific business sensitivity, risk level, and trust relationship between the participants, so as to avoid business process delays and inefficiency caused by setting the fixed threshold too high, or security risks caused by setting the fixed threshold too low. For example, in the high-security level of government confidential document processing, the threshold requirements are raised to enhance security; while in daily general business dealings and information sharing scenarios, the threshold is appropriately lowered to speed up business flow. Through this flexible configuration, it not only guarantees the security of key information, but also takes into account the efficiency of daily operations, providing strong signature technology support for the smooth, efficient and secure development of various digital businesses, filling the gaps in the flexibility and adaptability of the current attribute-based proxy signature technology, and helping to accelerate the digital transformation of various industries.

[0141] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A multi-authority attribute-based proxy signature method with flexible threshold, characterized in that: The following steps are involved: S1. Construct a multi-authority attribute-based proxy signature system and system parameters and initialize the system. The entities in the system include a central attribute authority, a distributed attribute authority, an original signer, a proxy signer, and a verifier. S2, the central attribute authority and the distributed attribute authority use hash functions and multi-order polynomials to generate keys for the original signer and for the proxy signer, respectively; S3. The original signer generates a power of attorney and authorization to the proxy signer; S4. After receiving the authorization from the original signer, the proxy signer performs authorization verification. If the verification passes, the process proceeds to step S5; otherwise, the process returns to step S3. S5. The proxy signer calculates the proxy signature of the message based on the authorization sent by the original signer, and sends the message, the power of attorney, and the proxy signature to the verifier; S6. The verifier verifies the proxy signature based on the message and the power of attorney.

2. The multi-authority attribute-based proxy signature method with flexible threshold according to claim 1, characterized in that: The establishment of the system parameters includes: randomly selecting a large prime number q, where the large prime number q>2 192 , define the attribute as the set of integers modulo q The elements in , the set of integers modulo q Let K represent the number of distributed attribute authorities; select a positive integer d.

3. The multi-authority attribute-based proxy signature method with flexible threshold according to claim 2, characterized in that: During system initialization, the central attribute authority performs the following operations: Assign a unique and distinct serial number i to each distributed attribute authority; Generate a default attribute set Ω containing (d-1) elements for each distributed attribute authority i ,|Ω i |=d-1; Generate an attribute set ω for each distributed attribute authority to be published to the original signer and the proxy signer i , where 1≤i≤K, the attribute sets of different distributed attribute authorities are disjoint, and for the same distributed attribute authority, the attribute set ω i With the default attribute set Ω i do not intersect; Set a key for each distributed attribute authority, the key is an integer s1, s2, ..., s K ; Selecting a random generator is a multiplicative cyclic group with prime order q; Select random number represents the set of all integers that are coprime with and smaller than the prime number q, and α is the master key of the central attribute authority; Select a random element Choosing a hash function Let the intermediate parameter g1 = g α , the intermediate parameter Z = e(g1,g2), where e is a bilinear mapping.

4. The multi-authority attribute-based proxy signature method with flexible threshold according to claim 3, characterized in that: During system initialization, the distributed attribute authority with sequence number i performs the following operations: Set contains n i Attribute set for an element Set the threshold k i , k i <n i And k i <d; Setting the predicate Among them, θ is the identity identifier, ω i,θ represents the attribute set generated by the distributed attribute authority with serial number i for the signer with identity θ; Among them, the predicate Has the following properties: like Then the predicate Otherwise, the predicate The public parameters params in the system are (g, g1, g2, Z, d, H1, H2, H3), and the master key of the central attribute authority is a random number α.

5. The multi-authority attribute-based proxy signature method with flexible threshold according to claim 1 or 4, characterized in that: The central attribute authority and the distributed attribute authority use hash functions and multi-order polynomials respectively to generate keys for the original signer and for the proxy signer respectively as follows: Assume that the identities of the original signer and the proxy signer are θ o and θ p , with a length of 128 bits in binary; different distributed attribute authorities generate attribute sets for the original signer and the proxy signer respectively. and and 1≤i o ,i p ≤K;i o is the serial number of the distributed attribute authority that generated the key for the original signer, i p is the serial number of the distributed attribute authority that generates keys for the proxy signer; The original signer's key consists of two parts: a central key generated by a central attribute authority and a and a distributed first key generated by a distributed attribute authority and distributed second key Among them, the central attribute authority generates the central key The method is: The central attribute authority selects the hash function f, and the central attribute authority is the identity θ o The central key generated by the original signer in, In the identity θ o Post-tandem The result is used as the input of the hash function f; Among them, the distributed attribute authority generates the distributed first key and distributed second key The method is: Serial number is i o The distributed attribute authority selects a (d-1) degree polynomial and Generate random numbers Calculate the distributed first key Distributed Second Key where 1≤i o ≤K, The serial number is i o The default attribute set of the distributed attribute authority, j o For attribute set Elements in .

6. The multi-authority attribute-based proxy signature method with flexible threshold according to claim 5, characterized in that: The proxy signer's key consists of two parts: a central key generated by a central attribute authority and a and a distributed first key generated by a distributed attribute authority and distributed second key The identity is θ p The central key generated by the central attribute authority for the proxy signer is By serial number i p The distributed first key generated by the distributed attribute authority Distributed Second Key where 1≤i p ≤K, Random Numbers (d-1) degree polynomial satisfy The serial number is i p The default attribute set of the distributed attribute authority, j p For attribute set Elements in .

7. The multi-authority attribute-based proxy signature method with flexible threshold according to claim 5, characterized in that: The method for the original signer to generate a power of attorney and authorize the proxy signer is: The power of attorney w includes the original signer's entrustment information to the proxy signer, and the entrustment information includes the entrustment content and validity period; The original signer's predicate Require that for each attribute set At least The attribute exists in the A collection of attributes Among them, and are all positive integers, and If the original signer's predicate The original signer cannot generate authorization; If the original signer's predicate The original signer performs the following operations to generate a power of attorney and authorization for the proxy signer: ① For each distributed attribute authority generated attribute set 1≤i o ≤K, select A subset of attributes Default attribute subset and ②For each attribute set generated by the distributed attribute authority Pick a random number ③For each attribute set generated by the distributed attribute authority Set the intermediate parameters The original signer calculates the authorization to send to the proxy signer in, For the first part of the authorization, For the second part of the authorization, This is the third part of the authorization; σ′ o,0 =g δ ; H2(w) δ , g δ , are all intermediate variables; Lagrange coefficients 8. The multi-authority attribute-based proxy signature method with flexible threshold according to claim 7, characterized in that: After the proxy signer receives the authorization from the original signer, the method for authorization verification is as follows: the proxy signer verifies the authorization from the original signer by verifying the following equation: H1(j o ) represents the hash function H1 acting on the input element j o The output is mapped to a multiplicative cyclic group with prime order q The elements in H2(w) represent the output of the hash function H2 after acting on the input proxy w is mapped to a multiplicative cyclic group with prime order q Elements in If the equality holds, the authorization sent by the original signer is considered valid; otherwise, the authorization sent by the original signer is considered invalid.

9. The multi-authority attribute-based proxy signature method with flexible threshold according to claim 8, characterized in that: The proxy signer calculates the proxy signature of the message based on the authorization sent by the original signer as follows: The proxy signer calculates the proxy signature of message m based on the authorization of the original signer. To calculate the proxy signature of message m, the predicate of the proxy signer is Require that for each attribute set At least The attribute exists in the A collection of attributes middle, and are all positive integers, and If the predicate of the proxy signer The proxy signer cannot compute the proxy signature; If the predicate of the proxy signer The proxy signer performs the following operations to compute the proxy signature of message m: (1) For each attribute set generated by the distributed attribute authority 1≤i p ≤K, select A subset of attributes Default attribute subset and (2) For each attribute set generated by the distributed attribute authority Pick a random number (3) For each attribute set generated by the distributed attribute authority Set the intermediate variable The proxy signature calculated by the proxy signer is in, For the first part of the signature, For the second part of the signature, The third part of the signature; in, H3(m) ε for, and g ε All are intermediate variables.

10. The multi-authority attribute-based proxy signature method with flexible threshold according to claim 9, characterized in that: The method by which the verifier verifies the proxy signature based on the message and the power of attorney is as follows: the verifier verifies the proxy signature using the following verification equation: Among them, H1(j p ) represents the hash function H1 acting on the input element j p The output is mapped to a multiplicative cyclic group with prime order q The elements in H3(m) represent the output of the hash function H3 after applying the input message m to a multiplicative cyclic group with a prime order q. Elements in If the verification equation holds, the proxy signature is considered valid; otherwise, the proxy signature is considered invalid.

Images