SM9-based efficient and controllable group signature method
Through the group signature method based on the SM9 identity cryptography system, which integrates hash technology and complete subset coverage technology, the problem of high cost of traditional group signature in behavior supervision, member management and public key certificate management is solved, and an efficient and controllable group signature scheme is realized, which is suitable for scenarios such as electronic voting, blockchain privacy transactions and data auditing.
Patent Information
- Application Number
- CN202511087431.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-05
- Publication Date
- 2025-09-16
AI Technical Summary
Traditional group signatures have deficiencies in security aspects such as behavior supervision, member management, and strong unforgeability. At the same time, they face the problem of high costs in managing public key certificates, making it difficult to meet the current more stringent practical scenario requirements.
Based on the SM9 identity cryptography system, an efficient and controllable group signature method is designed by integrating hash technology and complete subset cover technology. Through initialization, key generation and distribution, dynamic key management, group signature generation and verification algorithms, the synergy between anonymity and traceability is achieved, the certificate management cost is reduced, and the strong unforgeability of the signature is ensured through the chameleon hash function.
It achieves the requirements of behavior supervision, member management and strong unforgeability while ensuring anonymity and traceability, while significantly reducing the cost of public key certificate management. It is suitable for various scenarios such as electronic voting, blockchain privacy transactions and data auditing.
Smart Images
Figure CN120658408A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of information security technology, and in particular relates to an efficient and controllable group signature method based on SM9. Background Art
[0002] As a cryptographic tool that combines anonymity and traceability, group signatures allow group members to anonymously generate signatures on behalf of the group, while allowing group administrators to reveal the identity of the signer when necessary. These properties have led to their widespread application in scenarios such as electronic voting, private blockchain transactions, and data auditing. However, as new application scenarios continue to emerge, traditional group signatures still lack security features such as behavior monitoring, member management, and strong unforgeability. Furthermore, they face the high cost of managing public key certificates, making them difficult to meet the more stringent requirements of today's real-world scenarios.
[0003] To address these issues, Nakanishi et al. proposed a linkable group signature scheme, which protects the privacy of the signer's identity while detecting multiple signing attempts by the same signer, enabling behavior monitoring. Ateniese et al. proposed a revocable group signature scheme, allowing group administrators to manage the addition and revocation of members and, when necessary, reveal the signer's identity, enabling member management. Ling et al. proposed a lattice-based group signature scheme, which prevents attackers from generating new valid signatures for signed messages, thus achieving strong unforgeability. Furthermore, China proposed the SM9 signature algorithm, based on an identity cryptography system, which directly uses user identity information as the public key, eliminating the need for high certificate management costs and significantly reducing the communication and computational overhead of the cryptographic system. However, existing solutions only address these issues separately and cannot meet all four security requirements simultaneously. Research is urgently needed to effectively address the high cost of public key certificate management while ensuring the security properties of behavior monitoring, member management, and strong unforgeability. Summary of the Invention
[0004] In view of the defects and shortcomings of the existing technology, the present invention provides an efficient and controllable group signature method and system based on the SM9 identification password, aiming to solve the shortcomings of traditional group signatures in behavior supervision, member management, strong unforgeability, etc., while overcoming the problem of high cost of public key certificate management.
[0005] This solution is based on the SM9 identity signature algorithm. Its core lies in the integration of hash technology and complete subset cover technology, achieving the coordination of multi-dimensional security features while ensuring anonymity and traceability. Specifically, during the system initialization phase, based on security parameters and the maximum number of members, bilinear group parameters, group public keys, and master private keys are generated. A complete binary tree for member management is constructed, and a revocation list is initialized. When a member joins, an open key and hash value are generated through identity identification. The group manager allocates binary tree leaf nodes and distributes member certificates and signature private keys. No additional public key certificates are required, significantly reducing management costs.
[0006] To achieve dynamic member management and behavior supervision, the solution has designed a time-based key update mechanism: The group manager generates a set of update nodes using a specific function based on the revocation list and binary tree structure. They assign unique update keys to non-revoked members, allowing them to synthesize temporary signature keys. Revoked members, unable to obtain valid update keys, are unable to generate valid signatures, enabling precise time-based control. The group signature generation process combines the temporary signature key with a Chameleon hash function with a trapdoor to ensure strong unforgeability. The signature also includes an ID-based hash value and time period information, enabling linkable tracking of behavior.
[0007] During the verification phase, bilinear pairing operations are used to verify the validity of signatures. Group administrators can use the open key to trace the identity of the signer. Revocation operations are performed by updating the list based on time periods to avoid affecting the validity of historical signatures. In summary, this solution simultaneously meets the requirements of behavioral supervision, member management, and strong unforgeability, while adapting to the low-cost advantages of the SM9 identification cryptography system. It is suitable for multiple scenarios such as electronic voting, blockchain privacy transactions, and data auditing.
[0008] The technical solution specifically adopted by the present invention to solve the technical problem is:
[0009] An efficient and controllable group signature method based on SM9, comprising:
[0010] System initialization: Based on the security parameter λ and the maximum number of members n, generate the bilinear group parameters, group public key and master private key, construct a complete binary tree of depth d and initialize the revocation list;
[0011] Key generation and distribution:
[0012] Receive user identification ID, generate opening key tk and hash value based on ID;
[0013] Allocate leaf nodes of the complete binary tree and generate member certificates and signature private keys;
[0014] Dynamic Key Management:
[0015] At time period t, an update node set is generated based on the revocation list and the complete binary tree structure;
[0016] Generate an update key for each update node;
[0017] Generate a temporary signing key based on the signature private key, update key and Chameleon hash key pair;
[0018] Group signature generation:
[0019] Using the temporary signature key and the Chameleon hash function, a group signature σ covering time period t is generated;
[0020] Signature verification and member tracking:
[0021] Verify the validity of σ through bilinear pairing operation;
[0022] Trace the signer's identity based on tk and update the revocation list.
[0023] Furthermore, during the system initialization, the bilinear group parameters include two additive groups, one multiplicative group, a bilinear pair mapping function, and a group order; the group public key includes a public key element obtained by operating the master private key and the additive group generator; and the depth of the complete binary tree is calculated based on the maximum number of members.
[0024] Furthermore, in the key generation and distribution, the open key contains three group elements based on random values and additive group generators; the hash value based on the user identifier is obtained by the identifier, random value and private key generation function identifier through a hash algorithm; the member certificate and signature private key are generated by the master private key, the above-mentioned hash value and generator operation.
[0025] Furthermore, in the dynamic key management, the update node set is generated by traversing the revocation list and the complete binary tree path, and the generation rule is: exclude the revoked nodes and all their ancestor nodes before the specified time period in the revocation list, only include the only ancestor node or itself of the unrevoked member node, or include the root node of the complete binary tree.
[0026] Furthermore, the generation logic of the temporary signature key is: the non-revoked member obtains the corresponding update key through its node path and the unique public node of the update node set. The temporary key is a combination of the update key, the signature private key, and the chameleon hash key pair; the temporary key of the revoked member is an invalid value.
[0027] Furthermore, the chameleon hash function is a hash function with a trapdoor, and has the following characteristics: when the trapdoor key is known, different inputs including messages or random values produce the same hash result.
[0028] Furthermore, the group signature includes two signature parts, a time period, an update node identifier and a random number, wherein the first signature part is generated by the signature private key, and the second signature part is generated by the update key, and the two have the same structure.
[0029] Furthermore, the signature verification includes: verifying whether the update node is on the member node path; verifying the matching of the signature and the public key element through a bilinear pair mapping function; and verifying the output consistency of the chameleon hash function.
[0030] Furthermore, the update rule of the revocation list is: if a record with the same anonymous identifier and a revocation time period no later than the current time period already exists in the revocation list, it will not be added again; otherwise, the correspondence between the current time period and the anonymous identifier will be added to the revocation list.
[0031] And, a group signature system based on SM9 identification password, comprising:
[0032] The group manager node is configured to:
[0033] Execute the system initialization algorithm to generate bilinear group parameters, group public key, master private key, complete binary tree and revocation list;
[0034] Respond to member requests, generate and distribute opening keys, member certificates and signature private keys;
[0035] Generate an updated key set in time period t and broadcast it;
[0036] Run the open algorithm to trace the identity of the signer and update the revocation list;
[0037] Swarm member nodes are configured to:
[0038] Generate a Chameleon hash key pair;
[0039] Synthesize temporary signing key;
[0040] Generate a group signature σ covering time period t;
[0041] Validator nodes, configured to:
[0042] Verify the validity of the group signature σ and output the verification result.
[0043] And, an electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described above when executing the program.
[0044] A non-transitory computer-readable storage medium stores a computer program, which implements the steps of the method described above when executed by a processor.
[0045] Compared to existing technologies, the present invention and its preferred solution achieve the synergy of multiple security features and efficient management that are difficult to balance with traditional group signatures by integrating the SM9 identification cryptography system, hash technology, and complete subset cover technology. On the one hand, based on the SM9 identification cryptography, user identity information is directly used as the public key, eliminating the need for additional public key certificates, fundamentally reducing the certificate management cost, communication, and computing overhead of the cryptographic system. On the other hand, with the help of a complete binary tree structure and a dynamic key update mechanism, member joining and revocation management are accurately implemented, and revocation operations are only effective for a specific time period, without affecting the validity of historical signatures, thus taking into account the flexibility of member management and the stability of the system.
[0046] The scheme also ensures strong unforgeability of group signatures through a trapdoored chameleon hash function, making it difficult for attackers to tamper with or forge valid signatures. The anonymous identifier and time period information included in the signature protects the privacy of the signer while enabling linkable tracking of multiple actions by the same signer, meeting the needs of behavioral regulation. Furthermore, the bilinear pairing verification method and the collaborative architecture of multiple nodes (group managers, group members, and verifiers) further enhance the accuracy of signature verification and the reliability of system operation, making it suitable for a variety of scenarios with stringent security and anonymity requirements, such as electronic voting, blockchain privacy transactions, and data auditing. BRIEF DESCRIPTION OF THE DRAWINGS
[0047] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments:
[0048] Figure 1 This is a diagram of the system architecture for implementing the solution of the embodiment of the present invention;
[0049] Figure 2 This is a schematic diagram of a complete binary tree;
[0050] Figure 3 The figure is a schematic diagram of the implementation process of the embodiment of the present invention. DETAILED DESCRIPTION
[0051] In order to make the features and advantages of the present invention more clearly understood, the following embodiments are given for detailed description:
[0052] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used in this specification have the same meanings as those commonly understood by those skilled in the art to which this application belongs.
[0053] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.
[0054] The technical problem to be solved by the present invention is: under the premise of ensuring anonymity and traceability, in order to meet the security properties such as behavior supervision, member management and strong unforgeability, while effectively solving the problem of high cost of public key certificate management.
[0055] To address these issues, this paper proposes an efficient and controllable group signature scheme based on the SM9 signature algorithm, featuring linkability, revocability, and strong unforgeability. This scheme maintains consistency with the SM9 signature algorithm in key construction, signature, and verification algorithms, and integrates hashing and complete subset cover techniques. While ensuring anonymity and traceability, it also addresses the security requirements of behavior monitoring, membership management, and strong unforgeability, while effectively addressing the high cost of public key certificate management.
[0056] This invention addresses the shortcomings of traditional group signatures in terms of security properties such as behavior monitoring, member management, and strong unforgeability, as well as the high cost of public key certificate management. Based on the SM9 identity signature algorithm, this invention proposes an efficient and controllable group signature scheme with linkability, revocability, and strong unforgeability. This scheme maintains consistency with the SM9 identity signature algorithm in the key steps of key construction, signature, and verification algorithms, and integrates hashing and complete subset cover techniques. While ensuring anonymity and traceability, it meets the security properties of behavior monitoring, member management, and strong unforgeability, while effectively addressing the high cost of public key certificate management.
[0057] As a cryptographic tool that combines anonymity and traceability, group signatures allow group members to anonymously generate signatures on behalf of the group, while group managers can reveal the identity of the signer when necessary. These properties have led to their widespread application in scenarios such as electronic voting, blockchain privacy transactions, and data auditing. However, as new application scenarios continue to emerge, traditional group signatures still have shortcomings in security properties such as behavior supervision, member management, and strong unforgeability. At the same time, they face the problem of high cost of public key certificate management, making it difficult to meet the current more stringent practical scenario requirements. To solve this problem, the present invention proposes an efficient and controllable group signature scheme with linkability, revocability, and strong unforgeability based on the identity signature algorithm SM9. This scheme is consistent with the identity signature algorithm SM9 in the key steps of key construction, signature, and verification algorithms, and integrates hash technology and complete subset cover technology. While ensuring anonymity and traceability, it meets the security properties of behavior supervision, member management, and strong unforgeability, while effectively solving the problem of high cost of public key certificate management.
[0058] The key concept of this invention lies in addressing the shortcomings of traditional group signatures in terms of security properties such as behavior monitoring, member management, and strong unforgeability, as well as the high cost of public key certificate management. Based on the identity signature algorithm SM9, this scheme proposes an efficient and controllable group signature scheme with linkability, revocability, and strong unforgeability. This scheme maintains consistency with the identity signature algorithm SM9 in the key steps of key construction, signature, and verification algorithms, and integrates hashing and complete subset cover techniques. While ensuring anonymity and traceability, it meets the security properties of behavior monitoring, member management, and strong unforgeability, while effectively addressing the high cost of public key certificate management.
[0059] Therefore, the implementation of the present invention is specifically introduced below through specific implementation methods:
[0060] Please refer to Figure 1 The system architecture based on the embodiment of the present invention mainly includes three types of entities: group managers, group members, and verifiers. Among them, the group manager is trustworthy. The user first sends his or her ID to the group manager through a secure channel. And open the key tk to apply to join the group. After verifying that tk is correct, the group manager generates a member certificate for it and the long-term signature private key sk, and transmit it through a secure channel The tk and sk are returned to the corresponding user, who then officially becomes a group member. Group members can anonymously sign messages on behalf of the group and send the signature to the verifier. Upon receiving the message-signature pair, the verifier verifies its validity using the group public key, the message, and its signature. Group administrators can use tk to reveal the true identity of the signer and have the right to revoke their signing privileges.
[0061] Please refer to Figure 2 , represents a complete binary tree, where the dotted nodes represent revocation nodes and the bold nodes represent update nodes. Represents the root node. is a leaf node, then Indicates from arrive (include and ) is the set of all nodes on the path. For any non-leaf node ,So and express The left and right child nodes of .
[0062] In this embodiment, the update node set must meet the following conditions: for all revocation time periods in the revocation list, the revocation time period is less than or equal to Node (i.e. The leaf nodes (i.e., group members that have not been revoked) and all their ancestor nodes are not included in the set; while all other leaf nodes (i.e., group members that have not been revoked) have exactly one ancestor node (or themselves) included in the set.
[0063] In order to obtain the updated node set that meets the above conditions, the present invention defines a function KUNode, which is a complete binary tree. , revocation list and time period Generate an updated set of identification nodes for the input. The specific function is as follows:
[0064] KUNode( , , )
[0065] Order set ;
[0066] right , and ,Will Each node in the collection is added middle;
[0067] right ,if , then Add to Collection In, if , then Add to Collection middle;
[0068] if , the root node Add to Collection middle;
[0069] make , output .
[0070] Please refer to Figure 3 , showing the specific steps of the implementation process of an efficient and controllable group signature method based on SM9 provided by the present invention:
[0071] S101. The group manager runs the system initialization algorithm and uses the security parameters and the maximum number of group members to generate the system's group public key, the group manager's private key, a complete binary tree, and an empty revocation list.
[0072] S102: Group members and group managers generate member certificates, long-term signature private keys, and unlock keys, and send the member certificates and long-term signature private keys to corresponding group members via a secure channel.
[0073] S103: The group manager runs a key update algorithm, using the group public key, the group manager's private key, the complete binary tree, the revocation list, and the time period to generate an updated key set, and broadcasts it to group members via a public channel.
[0074] S104. Group members run a temporary key algorithm to generate a temporary key using the long-term signature private key, the update key set, and the Chameleon Hash key pair.
[0075] S105. Group members run a group signature algorithm to generate a group signature using the group public key, message, temporary key, anonymous identifier, and timestamp.
[0076] S106. The verifier runs the verification algorithm, using the group public key, message, and group signature to verify the validity of the group signature. If the verification passes, the verifier outputs 1; otherwise, the verifier outputs 0.
[0077] S107: The group manager runs the open algorithm, using the group public key, group signature, identifier, member certificate, and open key to verify whether the group signature is generated by the group member. If the verification is successful, the output is 1; otherwise, the output is 0.
[0078] S108: The group manager runs a revocation algorithm and generates a time-based revocation list using the revocation list, the time period, and the anonymous identifier.
[0079] As a preferred solution of this embodiment, the above steps are detailed as follows:
[0080] In step S101, the group manager runs the system initialization algorithm and uses the security parameters and the maximum number of group members , generate group public key mpk, group manager private key msk, complete binary tree and an empty revocation list . Specifically including:
[0081] Based on the maximum number of group members , calculate the depth of the complete binary tree as , construct a Complete binary tree with leaf nodes , and initialize an empty revocation list According to the safety parameters Generate an asymmetric bilinear group ,in is an additive group, , are their generators, is the multiplication group, is a bilinear pairing function, It's a group Select six cryptographic hashing algorithms , , , and , and select a byte to represent the private key generation function identifier hid. Among them, It is a chameleon hash function with a trapdoor, which has the property of generating hash collisions when the trapdoor key is known. Among them, the chameleon hash function can be implemented using publicly known solutions such as RSA, ECC, discrete logarithm or lattice difficulty. Randomly select an integer ,calculate Elements in . Output group public key 、Group manager private key , complete binary tree and revocation lists for: , , , .
[0082] In step S102, the interactive protocol between the group members and the group manager is executed by both parties to generate member certificates. , long-term signing private key and open key and pass the member certificate through a secure channel and long-term signing private key Sent to corresponding group members, including:
[0083] Pair logo , the user selects a random value ,calculate and open key , set ID, and Sent to the group manager via a secure channel. The group manager receives the ID, and After that, first verify Is it correct? , then assign the user An unassigned leaf node in ,Will Replace ID as an anonymous identifier and add to Calculation , Member Certificate and long-term signing private key ,Will and The key is sent to the corresponding user through a secure channel, and the user officially becomes a member of the group. Group members generate a Chameleon hash key pair. and ,in is the hashed public key, The trapdoor key.
[0084] In step S103, the group manager runs the key update algorithm, using the group public key mpk, the group manager private key msk, and the complete binary tree , revocation list and time period Generate an updated key set and broadcast it to group members through a public channel, including:
[0085] right , the group manager calculates and updates the node identification set as . For the set Each identifier in , pick a random value , and calculate , and update the key . Output updated key set and broadcast it to group members through public channels.
[0086] In step S104, the group members run the temporary key algorithm, using the long-term signature private key sk and the updated key set , Chameleon hash key pair HK and TK generates a temporary key, specifically including:
[0087] If the group member has not been revoked, the member node The set of nodes on the path and update node collection There must be a unique public node . Group members find the update key corresponding to the node and define the temporary signing key as If the group member has been revoked, there is no public update node. ,remember . Output temporary signing key .
[0088] In step S105, the group members run the group signature algorithm, using the group public key mpk, message , temporary key , anonymous identification 、 and timestamp Generate a group signature, including:
[0089] Precomputation Elements in . Pick a random number ,calculate . Pick a random value ( is the message space) and ,calculate . Pick a random value and calculate .calculate , . Using a trapdoor key Find one Make ,get . Then As the signature private key, the same can be obtained Finally, output the group signature .
[0090] In step S106, the verifier runs the verification algorithm, using the group public key mpk, message and group signatures , verify the validity of the group signature; if the verification is successful, output 1; otherwise, output 0; specifically including:
[0091] Decision Node Is it a member node? The set of nodes on the path If not, the algorithm terminates and returns 0; otherwise, continue to perform the following steps. ,for ,calculate .calculate , .calculate .verify Is it true? If not, output 0; if true, further verification .like If the verification fails, 0 is output; if the verification passes, the group signature is verified and 1 is output.
[0092] In step S107, the group manager runs the open algorithm, using the group public key mpk and group signature , identification ID, member certificate and open key , verify whether the group signature is generated by the group member. If the verification is successful, output 1, otherwise, output 0. Specifically include:
[0093] Given an efficient and controllable group signature based on SM9 and open key , group managers according to Efficiently identify the identity of group members. The group member cannot deny his signature because the group manager can provide proof that the signature was indeed generated by the group member. Verification , If the verification is successful, output 1; otherwise, output .
[0094] In step S108, the group manager runs the revocation algorithm and uses the revocation list , time period and anonymous identification Generate a time-based revocation list, including:
[0095] Group administrators follow the revocation list , time period and anonymous identification After that, if there is an element and , then return directly; otherwise, Add to revocation list , output .
[0096] As can be seen from the above description, this invention proposes an efficient and controllable group signature scheme based on the SM9 identity signature algorithm, featuring linkability, revocability, and strong unforgeability. This scheme maintains consistency with the SM9 identity signature algorithm in key construction, signature, and verification algorithms, and integrates hashing and complete subset cover techniques. While ensuring anonymity and traceability, it also addresses the security requirements of behavior monitoring, membership management, and strong unforgeability, while effectively addressing the high cost of public key certificate management.
[0097] Based on the same inventive concept, the present invention also provides a computer device, which includes: one or more processors and a memory for storing one or more computer programs; the program includes program instructions, and the processor is used to execute the program instructions stored in the memory. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is used to implement one or more instructions, specifically for loading and executing one or more instructions in a computer storage medium to implement the above method.
[0098] It should be further explained that, based on the same inventive concept, the present invention also provides a computer storage medium having a computer program stored thereon, which, when executed by a processor, performs the above-described method. The storage medium may be any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.
[0099] Throughout this specification, references to terms such as "one embodiment," "example," or "specific example" indicate that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present disclosure. In this specification, schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.
[0100] The above shows and describes the basic principles, main features and advantages of the present disclosure. Those skilled in the art should understand that the present disclosure is not limited to the above embodiments. The above embodiments and descriptions are merely illustrative of the principles of the present disclosure. Various changes and improvements may be made to the present disclosure without departing from the spirit and scope of the present disclosure, and such changes and improvements shall fall within the scope of the present disclosure.
[0101] The present invention is not limited to the above-mentioned optimal implementation mode. Anyone can derive various other forms of an efficient and controllable group signature method based on SM9 under the inspiration of the present invention. All equal changes and modifications made according to the scope of the patent application of the present invention should fall within the scope of the present invention.
Claims
1. An efficient and controllable group signature method based on SM9, characterized in that: include: System initialization: Based on the security parameter λ and the maximum number of members n, generate the bilinear group parameters, group public key and master private key, construct a complete binary tree of depth d and initialize the revocation list; Key generation and distribution: Receive user identification ID, generate opening key tk and hash value based on ID; Allocate leaf nodes of the complete binary tree and generate member certificates and signature private keys; Dynamic Key Management: At time period t, an update node set is generated based on the revocation list and the complete binary tree structure; Generate an update key for each update node; Generate a temporary signing key based on the signature private key, update key and Chameleon hash key pair; Group signature generation: Using the temporary signature key and the Chameleon hash function, a group signature σ covering time period t is generated; Signature verification and member tracking: Verify the validity of σ through bilinear pairing operation; Trace the signer's identity based on tk and update the revocation list.
2. The efficient and controllable group signature method based on SM9 according to claim 1, characterized in that: During system initialization, bilinear group parameters include two additive groups, one multiplicative group, a bilinear pairing mapping function, and a group order; the group public key includes a public key element obtained by operating a master private key with an additive group generator; and the depth of the complete binary tree is calculated based on the maximum number of members.
3. The efficient and controllable group signature method based on SM9 according to claim 1, characterized in that: In the key generation and distribution, the open key contains three group elements based on random values and additive group generators; the hash value based on the user identifier is obtained by the identifier, random value and private key generation function identifier through a hash algorithm; the member certificate and signature private key are generated by the master private key, the above hash value and generator operation.
4. The efficient and controllable group signature method based on SM9 according to claim 1, characterized in that: In the dynamic key management, the update node set is generated by traversing the revocation list and the complete binary tree path. The generation rule is: exclude the revoked nodes and all their ancestor nodes before the specified time period in the revocation list, only include the only ancestor node or itself of the unrevoked member node, or include the root node of the complete binary tree.
5. The efficient and controllable group signature method based on SM9 according to claim 1, characterized in that: The logic for generating the temporary signature key is as follows: an unrevoked member obtains the corresponding update key through its node path and the unique public node in the update node set. The temporary key is a combination of the update key, the signature private key, and the chameleon hash key pair. The temporary key of a revoked member is an invalid value.
6. The efficient and controllable group signature method based on SM9 according to claim 1, characterized in that: The chameleon hash function is a hash function with a trapdoor, and has the following characteristics: when the trapdoor key is known, different inputs including messages or random values produce the same hash result.
7. The efficient and controllable group signature method based on SM9 according to claim 1, characterized in that: The group signature includes two signature parts, a time period, an update node identifier and a random number, wherein the first signature part is generated by the signature private key and the second signature part is generated by the update key, and the two have the same structure.
8. The efficient and controllable group signature method based on SM9 according to claim 1, characterized in that: The signature verification includes: verifying whether the update node is on the member node path; verifying the matching of the signature and the public key element through a bilinear pair mapping function; and verifying the output consistency of the chameleon hash function.
9. The efficient and controllable group signature method based on SM9 according to claim 1, characterized in that: The update rule of the revocation list is: if a record with the same anonymous identifier and a revocation time period no later than the current time period already exists in the revocation list, it will not be added again; Otherwise, the correspondence between the current time period and the anonymous identifier is added to the revocation list.
10. A group signature system based on SM9 identification code, characterized in that: include: The group manager node is configured to: Execute the system initialization algorithm to generate bilinear group parameters, group public key, master private key, complete binary tree and revocation list; Respond to member requests, generate and distribute opening keys, member certificates and signature private keys; Generate an updated key set in time period t and broadcast it; Run the open algorithm to trace the identity of the signer and update the revocation list; Swarm member nodes are configured to: Generate a Chameleon hash key pair; Synthesize temporary signing key; Generate a group signature σ covering time period t; Validator nodes, configured to: Verify the validity of the group signature σ and output the verification result.