Signature key management method and device, equipment and storage medium

Abstract

The invention discloses a signature key management method and device, equipment and a storage medium, and relates to the field of information security, and the method comprises the steps: obtaining a target message, generating a primary key pair, and carrying out the signature of the target message through a primary private key in the primary key pair, so as to obtain a first signature parameter; storing a primary public key in the primary key pair by using a leaf node of the first dynamic tree so as to update the first dynamic tree; updating the second dynamic tree when the Shrubs node of the first dynamic tree changes, updating the target dynamic tree based on the new first dynamic tree and the new second dynamic tree and updating the target private key to determine a second signature parameter, and determining a target signature based on the first signature parameter, the second signature parameter and the primary public key, and determining a message signature pair based on the target message and the target signature to verify the message signature pair based on the target dynamic tree by using the target signature. According to the invention, dynamic unbounded management of the one-time signature key is realized.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a signature key management method, apparatus, device and storage medium. Background Art

[0002] A one-time signature is a special type of digital signature. Its basic concept is to sign a message using a one-way function. Compared to public key signatures based on trapdoor functions, one-time signatures are more efficient to generate and verify. However, one-time signatures expose part of the private key during the signing process. Therefore, to ensure the security of the signature, each key pair can only be used once. Generating different keys for different messages would result in an excessive key management burden.

[0003] Currently, one-time signature key management mechanisms based on Merkle trees require precalculating all one-time signature key pairs to construct a complete Merkle tree, resulting in high computational and storage overhead during initialization. If an incremental Merkle tree is used, adding leaf nodes requires updating nodes by the same depth, resulting in high update overhead. While one-time signature key management mechanisms based on chameleon authentication trees can dynamically add leaf nodes, each leaf node must also authenticate to the root node, resulting in a long authentication path, a large final signature size, and high signature verification overhead. Furthermore, when adding a leaf node, the entire path from the root to the leaf node must be traversed, and missing nodes and sibling nodes in the path must be generated. The actual leaf nodes are then used to update the node from bottom to top, ultimately reaching the chameleon hash node. This "generate first, then update" approach results in high update overhead. The authentication path length of the one-time signature key management mechanism based on the dynamic chameleon authentication tree is equal to the depth of the subtree root closest to the leaf node. Therefore, as the tree scales, the authentication path length grows rapidly, leading to a rapid increase in signature size and verification overhead. Furthermore, when adding leaf nodes, if the tree needs to be expanded, a new verification root node must be generated. The entire path from the verification root node to the leaf node must then be traversed, generating missing nodes and sibling nodes along the path. The actual leaf nodes are then used to update the node from bottom to top until the chameleon hash node is reached. This "generate first, then update" approach results in high update overhead.

[0004] In summary, how to achieve dynamic and unbounded management of one-time signature keys, reduce the impact of tree size expansion on authentication path length, and reduce tree management overhead are issues that need to be addressed urgently. Summary of the Invention

[0005] In view of this, the present invention aims to provide a signature key management method, apparatus, device, and storage medium that can achieve dynamic and unbounded management of one-time signature keys, reduce the impact of tree size expansion on authentication path length, and reduce tree management overhead. The specific solution is as follows:

[0006] In a first aspect, the present application discloses a signature key management method, comprising:

[0007] Obtaining a target message, generating a primary key pair using target security parameters, and signing the target message using a primary private key in the primary key pair to obtain a first signature parameter;

[0008] Using the leaf nodes of the current first dynamic tree to store the primary public key in the primary key pair to obtain a new first dynamic tree;

[0009] When the number of Shrubs nodes in the first dynamic tree changes, the second dynamic tree is updated to obtain a new second dynamic tree. When the number of Shrubs nodes changes, a target tree capacity flag is updated to update the target dynamic tree based on the new first dynamic tree and the new second dynamic tree. The target dynamic tree is a dynamic tree constructed based on the first dynamic tree and the second dynamic tree. The target tree capacity flag is used to determine whether the target tree capacity of the current second dynamic tree meets a target tree capacity increase condition. If so, the number of target tree layers of the second dynamic tree is increased and the target tree capacity is updated. The target tree capacity is the number of leaf nodes of the second dynamic tree.

[0010] The target private key is updated based on the current target dynamic tree and a second signature parameter is determined; a target signature is determined based on the first signature parameter, the second signature parameter, and the one-time public key; and a message signature pair is determined based on the target message and the target signature, so as to verify the message signature pair based on the target dynamic tree using the target signature; the target private key is generated based on a trapdoor key of the target dynamic tree;

[0011] Among them, the security parameters corresponding to the trapdoor key and the hash key of the target dynamic tree are consistent with the target security parameters; the first dynamic tree is a dynamic Shrubs tree, the second dynamic tree is a dynamic Shrubs node authentication tree, the leaf nodes of the second dynamic tree are chameleon hash nodes, and the messages corresponding to the leaf nodes of the second dynamic tree correspond to the hash values ​​of the Shrubs nodes of the first dynamic tree; the second signature parameters include the authentication path and index corresponding to the one-time public key in the target dynamic tree.

[0012] Optionally, the process of obtaining the initial target dynamic tree includes:

[0013] Generate a trapdoor key and a hash key of the chameleon hash function corresponding to the target dynamic tree using the target security parameter;

[0014] Performing a zeroing operation on each counter, a target tree capacity corresponding to the initial second dynamic tree, and a target tree layer number; the counters include a data counter and a Shrubs node counter; the Shrubs node counter corresponds to the target tree capacity flag;

[0015] Initializing the target database and all verification root nodes to be empty, and initializing the structure of the first dynamic tree and the structure of the second dynamic tree to be empty;

[0016] An initial target dynamic tree is constructed based on the values ​​of the counters, the target tree capacity and the number of target tree layers, the target database, the verification root node, the initial first dynamic tree and the initial second dynamic tree.

[0017] Optionally, the signature key management method further includes:

[0018] Constructing an initial target private key of the target dynamic tree based on the initial structure of the first dynamic tree, the initial structure of the dynamic second dynamic tree, and the trapdoor key;

[0019] Constructing an initial target public key of the target dynamic tree using the hash key;

[0020] Accordingly, updating the target private key based on the current target dynamic tree and determining the second signature parameter includes:

[0021] Based on the current structure of the first dynamic tree, the current structure of the second dynamic tree, and the trapdoor key, the target private key is updated and a second signature parameter is determined.

[0022] Optionally, the storing the primary public key in the primary key pair using the leaf node of the current first dynamic tree to obtain a new first dynamic tree includes:

[0023] Add the target leaf node to the current first dynamic tree;

[0024] Utilizing the target leaf node to store the primary public key in the primary key pair;

[0025] Performing a hash operation on the target leaf node to determine the target Shrubs node corresponding to the target leaf node;

[0026] Determine whether the target Shrubs node already exists;

[0027] If the target Shrubs node already exists, updating the hash value of the target Shrubs node to obtain a new first dynamic tree;

[0028] Increment the current data counter value by one.

[0029] Optionally, updating the second dynamic tree to obtain a new second dynamic tree when the Shrubs node of the first dynamic tree changes includes:

[0030] If the change of the Shrubs node of the first dynamic tree meets the first update condition, the random numbers corresponding to the leaf nodes of the second dynamic tree are updated based on the trapdoor key and the hash value of the new Shrubs node of the first dynamic tree to obtain a new second dynamic tree;

[0031] If the change in the Shrubs node of the first dynamic tree meets the second update condition, using the target tree capacity flag and the target tree capacity, add a corresponding chameleon hash node for the newly added Shrubs node of the first dynamic tree in the second dynamic tree, and update the random numbers corresponding to the leaf nodes of the second dynamic tree based on the trapdoor key and the new hash value of the Shrubs node of the first dynamic tree to obtain a new second dynamic tree;

[0032] The first update condition is that the Shrubs node and the corresponding hash value of the first dynamic tree change, and the number of Shrubs nodes in the first dynamic tree does not change; the second update condition is that the Shrubs node and the corresponding hash value of the first dynamic tree change, and the number of Shrubs nodes in the first dynamic tree changes.

[0033] Optionally, the target tree capacity increase condition is that a difference between the value of the target tree capacity flag and the target tree capacity is less than a preset target tree capacity difference.

[0034] Optionally, the verifying the message signature pair based on the target dynamic tree by using the target signature includes:

[0035] performing a first parameter verification on the target message in the message-signature pair and a first signature parameter in the target signature based on the primary public key in the target signature using a first verification algorithm to obtain a first verification result;

[0036] If the first verification result indicates that the target signature passes the first parameter verification, a second parameter verification is performed on the second target parameter in the target signature based on the target public key of the target dynamic tree and the one-time public key using a second verification algorithm to obtain a second verification result.

[0037] In a second aspect, the present application discloses a signature key management device, comprising:

[0038] a message signing module, configured to obtain a target message, generate a one-time key pair using target security parameters, and sign the target message using a one-time private key in the one-time key pair to obtain a first signature parameter;

[0039] A first dynamic tree updating module is configured to store the primary public key in the primary key pair using the leaf node of the current first dynamic tree to obtain a new first dynamic tree, and update the value of the data counter;

[0040] A second dynamic tree updating module is configured to update the second dynamic tree to obtain a new second dynamic tree when the number of Shrubs nodes of the first dynamic tree changes, and to update a target tree capacity flag when the number of Shrubs nodes changes, so as to update the target dynamic tree based on the new first dynamic tree and the new second dynamic tree; wherein the target dynamic tree is a dynamic tree constructed based on the first dynamic tree and the second dynamic tree, and the target tree capacity flag is used to determine whether the target tree capacity of the current second dynamic tree meets a target tree capacity increase condition; if so, increase the number of target tree layers of the second dynamic tree and update the target tree capacity; the target tree capacity is the number of leaf nodes of the second dynamic tree;

[0041] a signature verification module, configured to update a target private key based on the current target dynamic tree and determine a second signature parameter, determine a target signature based on the first signature parameter, the second signature parameter, and the one-time public key, and determine a message-signature pair based on the target message and the target signature, thereby verifying the message-signature pair based on the target dynamic tree using the target signature; the target private key being generated from a trapdoor key based on the target dynamic tree;

[0042] Among them, the security parameters corresponding to the trapdoor key and the hash key of the target dynamic tree are consistent with the target security parameters; the first dynamic tree is a dynamic Shrubs tree, the second dynamic tree is a dynamic Shrubs node authentication tree, the leaf nodes of the second dynamic tree are chameleon hash nodes, and the messages corresponding to the leaf nodes of the second dynamic tree correspond to the hash values ​​of the Shrubs nodes of the first dynamic tree; the second signature parameters include the authentication path and index corresponding to the one-time public key in the target dynamic tree.

[0043] In a third aspect, the present application discloses an electronic device, comprising:

[0044] Memory, used to store computer programs;

[0045] The processor is configured to execute the computer program to implement the aforementioned signature key management method.

[0046] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned signature key management method when executed by a processor.

[0047] In the present application, when managing the signature key, a target message is obtained, a one-time key pair is generated using the target security parameter, and the target message is signed using the one-time private key in the one-time key pair to obtain a first signature parameter; the one-time public key in the one-time key pair is stored using the leaf node of the current first dynamic tree to obtain a new first dynamic tree; when the Shrubs node of the first dynamic tree changes, the second dynamic tree is updated to obtain a new second dynamic tree, and when the number of the Shrubs nodes changes, the target tree capacity flag is updated to update the target dynamic tree based on the new first dynamic tree and the new second dynamic tree; wherein the target dynamic tree is a dynamic tree constructed based on the first dynamic tree and the second dynamic tree, and the target tree capacity flag is used to determine whether the target tree capacity of the current second dynamic tree meets the target tree capacity increase condition, and if so, the number of target tree layers of the second dynamic tree is increased and the target tree capacity is updated; the target tree capacity The quantity is the number of leaf nodes of the second dynamic tree; based on the current target dynamic tree, the target private key is updated and the second signature parameter is determined, the target signature is determined based on the first signature parameter, the second signature parameter and the one-time public key, and the message signature pair is determined based on the target message and the target signature, so as to verify the message signature pair based on the target dynamic tree using the target signature; the target private key is generated based on the trapdoor key of the target dynamic tree; wherein the security parameters corresponding to the trapdoor key and the hash key of the target dynamic tree are consistent with the target security parameters; the first dynamic tree is a dynamic Shrubs tree, the second dynamic tree is a dynamic Shrubs node authentication tree, the leaf nodes of the second dynamic tree are chameleon hash nodes, and the messages corresponding to the leaf nodes of the second dynamic tree correspond to the hash values ​​of the Shrubs nodes of the first dynamic tree; the second signature parameter includes the authentication path and index corresponding to the one-time public key in the target dynamic tree. It can be seen that the present application constructs a target dynamic tree using the first dynamic tree and the second dynamic tree, wherein the first dynamic tree is a dynamic Shrubs tree whose scale can be dynamically expanded according to demand, and the second dynamic tree is a dynamic Shrubs node authentication tree whose scale can be dynamically expanded according to demand. The leaf nodes of the first dynamic tree are used to store the one-time public key in a key pair, and the messages corresponding to the leaf nodes of the second dynamic tree correspond to the hash values ​​of the Shrubs nodes of the first dynamic tree, thereby realizing dynamic and unbounded management of the one-time signature key using the target dynamic tree.When it is necessary to verify a message signed with a one-time private key in a one-time key pair, it is only necessary to determine the one-time public key corresponding to the one-time private key and the position of the one-time public key in the target dynamic tree based on the target signature contained in the message signature pair to which the message belongs. The target dynamic tree can be used to complete the verification of the message signature pair, thereby achieving dynamic and unbounded management of the one-time signature key while weakening the impact of the expansion of the tree scale on the length of the authentication path and reducing the management overhead of the tree. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0049] Figure 1 A schematic diagram of the Shrubs tree initialization state provided by this application;

[0050] Figure 2 A schematic diagram of the state of adding leaf nodes to a Shrubs tree provided by this application;

[0051] Figure 3 A schematic diagram of the correspondence relationship of updating Shrubs nodes in a Shrubs tree provided in this application;

[0052] Figure 4 This is a flow chart of a signature key management method disclosed in this application;

[0053] Figure 5 A schematic diagram of the process of adding leaf nodes to a dynamic Shrubs tree provided by this application;

[0054] Figure 6 A schematic diagram of a dynamic Shrubs node authentication tree structure provided for this application;

[0055] Figure 7 This is a structural diagram of a dynamic Shrubs tree provided by this application before and after adding nodes;

[0056] Figure 8 A structural diagram of a dynamic Shrubs node authentication tree before and after adding a node provided by this application;

[0057] Figure 9 This is a schematic diagram of the structure of a signature key management device disclosed in this application;

[0058] Figure 10 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0059] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0060] Currently, one-time signature key management mechanisms based on Merkle trees require precalculating all one-time signature key pairs to construct a complete Merkle tree, resulting in high computational and storage overhead during initialization. If an incremental Merkle tree is used, adding leaf nodes requires updating nodes by the same depth, resulting in high update overhead. While one-time signature key management mechanisms based on chameleon authentication trees can dynamically add leaf nodes, each leaf node must also authenticate to the root node, resulting in a long authentication path, a large final signature size, and high signature verification overhead. Furthermore, when adding a leaf node, the entire path from the root to the leaf node must be traversed, and missing nodes and sibling nodes in the path must be generated. The actual leaf nodes are then used to update the node from bottom to top, ultimately reaching the chameleon hash node. This "generate first, then update" approach results in high update overhead. The authentication path length of the one-time signature key management mechanism based on the dynamic chameleon authentication tree is the depth of the subtree root closest to the leaf node. Therefore, as the tree scale expands, the authentication path length will grow too fast, which will in turn cause the signature size and verification overhead to grow too fast. In addition, when adding leaf nodes, if the tree scale needs to be expanded, a new verification root node needs to be generated, and then the entire path from the verification root node to the leaf node needs to be traversed to generate the missing nodes and sibling nodes in the path, and then the real leaf nodes are used to update from bottom to top until the chameleon hash node. This "generate first and then update" method results in a large overhead for the update operation. In order to solve the above technical problems, the present application discloses a signature key management method that can realize dynamic and unbounded management of one-time signature keys, weaken the impact of the expansion of the tree scale on the authentication path length, and reduce the management overhead of the tree.

[0061] To facilitate understanding, we first introduce the chameleon hash function and Shrubs tree involved in the key management scheme.

[0062] The Chameleon hash function family includes three algorithms , respectively, the key generation function , Chameleon hash function And the random number update function . Input security parameters for the key generation function , will output the hash key and trapdoor keys ; Input hash key for Chameleon hash function ,information and random numbers , will output a hash value with a fixed length ,in, 、 For the pre-set message range and random number range; input the trapdoor key to the random number update function ,information and random numbers Output , and satisfy .

[0063] According to the above, a secure chameleon hash function must meet collision resistance and semantic security. Among them, collision resistance means that the adversary cannot obtain the given message without knowing the trapdoor key TK. , random number , output a random number satisfy The probability of is negligible, that is, updating the message and random number can get the same hash value, that is, the hash value can be kept unchanged; semantic security means that for any message , hash value and The probability distribution of is computationally indistinguishable. In particular, for a randomly chosen , cannot be obtained from the hash value Get any information about information.

[0064] On this basis, the Shrubs tree is a variant of the Merkle tree. Unlike the Merkle tree, the Shrubs tree does not use only one root node to "represent" the entire tree. Instead, each layer selects a node (called a Shrubs node) to "represent" the entire tree. Assuming there is a Shrubs tree with a depth of D, D Shrubs nodes are required as subtree root nodes. These subtree roots can represent a complete Merkle tree (uniqueness) and can cover all the added leaf nodes. Figure 1 The figure (taking depth D=4 as an example) shows the initialization state of the Shrubs tree. There are 4 Shrubs nodes initialized with empty nodes, and the Shrub node is the root of the rightmost complete subtree of the layer. Figure 2As shown in the figure, when adding a leaf node to the Shrubs tree, the hash value is calculated upward until the subtree root closest to the leaf node, and then the subtree root node is updated to the Shrub node of the layer. In other words, every time a leaf node is added, a subtree root node (Shrubs node) closest to the leaf node is updated. Specifically, if the left leaf node is added, the added position is the subtree root and can be updated; if the right leaf node is added, it is backtracked to the left node and then updated. Figure 3 The figure shows the correspondence between updating Shrubs nodes when adding leaf nodes to the Shrubs tree. It can be seen that the left node of each layer will be updated once, and only once. Therefore, the average update path length is for:

[0065] ;

[0066] For the certification path, we only need to find the certification path of the subtree closest to the leaf node. Therefore, if the certification path of the leaf node is given immediately after it is added, the average certification path length is . Because the verification root node (Shrubs node) is not included in the authentication path, it is 1 less than the update path. In this way, each time a leaf node is added, only one Shrubs node needs to be updated, which means that the storage update when adding a leaf node is O(1). To prove whether a leaf node is on the Shrubs tree, it is only necessary to give the authentication path of the subtree closest to the leaf node. Table 1 shows the comparison between the Shrubs tree and the Merkle tree. It can be seen that the Shrubs tree has obvious advantages in terms of update overhead and authentication path. However, it should be noted that the Shrubs tree requires D subtree root nodes to represent the entire tree, while the Merkle tree only requires 1 root node.

[0067] Table 1 Comparison results between Shrubs tree and Merkle tree

[0068]

[0069] See also Figure 4 As shown, an embodiment of the present invention discloses a signature key management method, including:

[0070] Step S11: Obtain a target message, generate a one-time key pair using target security parameters, and sign the target message using a one-time private key in the one-time key pair to obtain a first signature parameter.

[0071] In this embodiment, As a one-time signature scheme, after obtaining the target message, first use the target security parameter Based on one-time key pair generation algorithm Generate a one-time signing key pair (also known as a one-time key pair) , the process can be expressed as, ,in A one-time private key. is a one-time public key. Then use The target message to be signed Sign and get the first signature parameter , the process can be expressed as .

[0072] Step S12: Using the leaf nodes of the current first dynamic tree, the primary public key in the primary key pair is stored to obtain a new first dynamic tree, and the first tree capacity flag is updated; wherein the first tree capacity flag is used to determine whether the first tree capacity of the current first dynamic tree meets the first tree capacity increase condition; if so, the number of first tree layers of the first dynamic tree is increased and the first tree capacity is updated; the first tree capacity is the number of leaf nodes of the first dynamic tree.

[0073] In this embodiment, a chameleon hash function is introduced into the Shrubs tree, constructing a new target dynamic tree to implement dynamic, unbounded management of one-time signature keys. The target dynamic tree is a Dynamic Chameleon Shrubs Authentication Tree (DCSAT), which consists of a first dynamic tree and a second dynamic tree. The first dynamic tree is a Dynamic Shrubs Tree (DST), whose first tree capacity is the number of leaf nodes in the first dynamic tree. The second dynamic tree is a Dynamic Shrubs Nodes Authentication Tree (DSNAT).

[0074] In this embodiment, the way of adding leaf nodes in the first dynamic tree DST is similar to that of the Shrubs tree, except that the size of the DST can be dynamically expanded, so the Shrubs nodes are not generated (initialized) in advance, but added on demand. Figure 5 The following is a schematic diagram of the process of adding leaf nodes 0 to 7 to DST. Figure 6 The figure shows the structure of the second dynamic tree. The second dynamic tree DSNAT is a dynamic Merkle tree that can be expanded as needed. Specifically, DSNAT can dynamically expand the tree size according to the number of leaf nodes. is the number of DSNAT tree layers, The maximum number of leaves that DSNAT can accommodate. The node on the leftmost path of DSNAT is the verification root node. Corresponding to different verification root nodes. Leaf nodes For Chameleon Hash Node, for Random number , the random number corresponding to the leaf node of the second dynamic tree corresponds to the hash value of the Shrubs node of the first dynamic tree, that is:

[0075] .

[0076] In this embodiment, in order to realize dynamic and unbounded management of the one-time signature key by using the target dynamic tree, after the one-time private key in the one-time key pair is used to sign the target message, the one-time public key in the one-time key pair is saved to the empty leaf node of the first dynamic tree of the target dynamic tree. is the target dynamic tree, Used to initialize the target dynamic tree and obtain the corresponding target public key and target private key. Used to add the public key of a key pair to the target dynamic tree. It is used to verify whether the one-time public key is an element stored under the corresponding path and index of the target dynamic tree.

[0077] In this embodiment, the To describe the initialization operation, enter the security parameters You can get the target public key of the target dynamic tree and the target private key In a specific embodiment, the process of obtaining the initial target dynamic tree may specifically include: using the target security parameter to generate a trapdoor key and a hash key of the chameleon hash function corresponding to the target dynamic tree; performing a zeroing operation on each counter, the target tree capacity corresponding to the initial second dynamic tree, and the number of target tree layers; the counter includes a data counter and Shrubs node counters ; The Shrubs node counter corresponds to the target tree capacity flag; the target database and all verification root nodes are initialized to empty, and the structure of the initial first dynamic tree and the structure of the initial second dynamic tree are initialized to empty; the initial target dynamic tree is constructed based on the value of each counter, the first tree capacity and the target tree capacity, the number of target tree layers, the target database, the verification root node, the initial first dynamic tree and the initial second dynamic tree. Among them, the security parameters corresponding to the trapdoor key and the hash key of the target dynamic tree are consistent with the target security parameters, both of which are After obtaining the initial target dynamic tree, a target private key of the initial target dynamic tree is constructed based on the structure of the initial first dynamic tree, the structure of the initial dynamic second dynamic tree and the trapdoor key; and a target public key of the initial target dynamic tree is constructed using the hash key.

[0078] That is, when performing the initialization operation, the security parameters will be used first. Generate the public and private key pair of the Chameleon hash function, that is, At the same time, the database used to store data will be initialized to empty, the verification root node will be initialized to empty, the corresponding data counter, Shrubs node counter, the tree capacity and tree layer number of the second dynamic tree will be reset to zero, and the tree structure of the first dynamic tree and the tree structure of the second dynamic tree It will also be initialized to empty. At this time, the first dynamic tree and the second dynamic tree are both empty trees, and the corresponding target dynamic tree will also be empty. After completing the initialization of the target dynamic tree, the trapdoor key obtained in the above process will be used. and To construct the initial target private key , and use the hash key to construct the initial target public key , the process can be specifically described as and , thereby obtaining the target public and private key pair It is understandable that, since the tree structure of the first dynamic tree and the tree structure of the second dynamic tree are taken into consideration when constructing the target private key, the target private key will also change when the first dynamic tree and the second dynamic tree change.

[0079] In this embodiment, when the leaf node of the current first dynamic tree is used to store the primary public key in the primary key pair to obtain the new first dynamic tree, the value of the data counter will be updated accordingly. In actual use, the primary public key is generally added as data to the empty leaf node of the DST from left to right. After the primary public key is added to the DST, the index corresponding to the added data (i.e., the primary public key) will be obtained. , the index can be the value of the current data counter, and then the added public key can be added to the target database. When the first dynamic tree DST is updated, the updated content includes the leaf nodes, the intermediate hash nodes and the value of the counter.

[0080] In one specific embodiment, when adding data to the first dynamic tree, a hash operation is performed upward, following the same procedure as adding a leaf node in the Shrubs tree, until the subtree root node (Shrubs node) closest to the leaf node is reached. If the Shrubs node already exists, the corresponding hash value is updated, and the random number of the Chameleon Hash node corresponding to the Shrubs node is updated using the Chameleon Hash function's trapdoor key. Otherwise, a new Shrubs node is added and then added to the DSNAT, incrementing the Shrubs node counter.

[0081] Step S13: When the number of Shrubs nodes in the first dynamic tree changes, the second dynamic tree is updated to obtain a new second dynamic tree. When the number of Shrubs nodes changes, the target tree capacity flag is updated to update the target dynamic tree based on the new first dynamic tree and the new second dynamic tree. The target dynamic tree is a dynamic tree constructed based on the first dynamic tree and the second dynamic tree. The target tree capacity flag is used to determine whether the target tree capacity of the current second dynamic tree meets the target tree capacity increase condition. If so, the number of target tree layers of the second dynamic tree is increased and the target tree capacity is updated. The target tree capacity is the number of leaf nodes of the second dynamic tree.

[0082] In this embodiment, when the number of first tree levels in the first dynamic tree changes, the number of its Shrubs nodes also changes, and the number of first tree levels and the number of Shrubs nodes are always equal. When the number of Shrubs nodes in the first dynamic tree changes, it is necessary to add corresponding chameleon hash nodes for the newly added Shrubs nodes in DSNAT, increase the value of the Shrubs node counter, and update the target tree capacity flag. This allows the second dynamic tree to be updated when the Shrubs nodes in the first dynamic tree change. In other words, when the second dynamic tree is updated, the updated content includes the random number of the chameleon hash node.

[0083] In this embodiment, when the Shrubs node of the first dynamic tree changes, the second dynamic tree is updated to obtain a new second dynamic tree. Specifically, the updating may include: if the change of the Shrubs node of the first dynamic tree meets the first update condition, updating the random numbers corresponding to the leaf nodes of the second dynamic tree based on the trapdoor key and the hash value of the new Shrubs node of the first dynamic tree to obtain a new second dynamic tree; if the change of the Shrubs node of the first dynamic tree meets the second update condition, adding a corresponding chameleon hash node for the newly added Shrubs node of the first dynamic tree in the second dynamic tree using the target tree capacity flag and the target tree capacity, and updating the random numbers corresponding to the leaf nodes of the second dynamic tree based on the trapdoor key and the hash value of the new Shrubs node of the first dynamic tree to obtain a new second dynamic tree; wherein the first update condition is that the Shrubs node of the first dynamic tree and the corresponding hash value have changed, and the number of Shrubs nodes of the first dynamic tree has not changed; the second update condition is that the Shrubs node of the first dynamic tree and the corresponding hash value have changed, and the number of Shrubs nodes of the first dynamic tree has changed. That is to say, since different Shrubs nodes in the first dynamic tree correspond to different leaf nodes in the second dynamic tree, based on the aforementioned content and this correspondence, it can be known that when the hash value in the Shrubs node changes, the random number of the leaf node corresponding to the Shrubs node in DSNAT will also change; when the DST is expanded, the number of its first tree layers will increase, and the number of Shrubs nodes will also increase accordingly. Therefore, it is necessary to add corresponding leaf nodes for the newly added Shrubs nodes in DSNAT to save the random number corresponding to the hash value of the newly added Shrubs node in DSNAT.

[0084] In this embodiment, in order to ensure that there are empty leaf nodes in DSNAT to cope with the change in the number of Shrubs nodes, the target tree capacity increase condition can be used to determine whether the DSNAT needs to be expanded. The target tree capacity increase condition is that the difference between the value of the target tree capacity flag and the target tree capacity is less than the preset target tree capacity difference. It can be understood that the target tree capacity is usually greater than or equal to the target tree capacity flag. The preset target tree capacity difference can be 0 or other values. In actual use, the leaf nodes of DSNAT (that is, chameleon hash nodes) are usually used in order from left to right. In other words, when adding chameleon hash nodes to DSNAT, first determine whether the number of Shrubs nodes of DST is equal to the target tree capacity of DSNAT (that is, determine whether the target tree capacity of DSNAT is full). If they are equal, the target tree capacity needs to be expanded. Specifically, when the target tree capacity is equal to the value of the target tree capacity flag, if the target tree capacity is not 0, it will be initialized first. Shrubs nodes are used as leaf nodes to construct a tree with a depth of The original tree is used as the expanded left subtree, and the root nodes of the two subtrees are used as the left and right child nodes to calculate the new root node of DCSAT. ; Then update the target tree number and target tree capacity of DSNAT. The new target tree number is 1 more than the original target tree number, and the new target tree capacity is equivalent to 2 times the original tree capacity. In other words, each time the scale of DSNAT is expanded, a right subtree with the same scale as the original tree is generated at one time (such as Figure 6 If the target tree capacity is equal to the target tree capacity flag and the target tree capacity is 0, a Shrubs node will be initialized and used as the new root node. , then update the target tree layer number of DSNAT to 1 and the target tree capacity to 1. After the expansion is successful, the hash value of the Shrubs node is used to update the random number of the corresponding Chameleon Hash node, thereby adding the Shrubs node to DSNAT.

[0085] In a specific embodiment, the target tree capacity increase condition can be adjusted to set the target tree capacity to be increased when the value of the target tree capacity flag is equal to the target tree capacity. DSNAT is initialized to empty and the number of target tree layers is initialized to 0. When Shrubs[0] is added to DST, it needs to be added to DSNAT synchronously. At this time, the capacity of DSNAT is insufficient and the scale needs to be expanded first. Increased to 1, the chameleon hash node will be initialized during the expansion process, that is:

[0086] ;

[0087] Then, use the hash value of Shrubs[0] to update The corresponding random number To get ,Right now:

[0088] ;

[0089] Shrubs[0] is added to DSNAT in the above way. When shrubs[1] and Shrubs[2] are added to DST, the operation is similar to the above one, which is to expand the scale of DSNAT first, and then use the hash value of Shrubs node to update the random number of the corresponding Chameleon hash node. Specifically, Figure 7 (a) shows the DST after adding node 1, where [1] is the Shrubs node added. At this time, Shrubs[1] needs to be converted into a chameleon hash node. Stored in DSNAT. Figure 8 As shown in (a), after adding the chameleon hash node corresponding to Shrubs[1] After that, the value of DSNAT's target tree capacity and target tree capacity are both 1, and the number of target tree layers is also 1. Therefore, it can be determined that there are no empty leaf nodes in DSNAT for storing chameleon hash nodes. , DSNAT needs to be expanded to increase the number of target tree layers After increasing from 1 to 2, the target tree capacity increases by 1. The chameleon hash node will be initialized during the expansion. ,Right now:

[0090] ;

[0091] Then use the hash value of Shrubs[1] to update The random number is:

[0092] ;

[0093] In the above way, Shrubs[1] are stored in DSNAT, such as Figure 8 (b) Figure 7 (b) is the DST after adding node 2. At this time, node 2 becomes the new , that is, the hash value of Shrubs[0] is updated, so the DSNAT needs to be updated synchronously The corresponding random number get ,Right now:

[0094] .

[0095] It is understandable that as the tree capacity and number of tree layers of DST and DSNAT increase, the frequency of DST and DSNAT expansion will gradually decrease, with other conditions remaining unchanged. Furthermore, due to the correspondence between DSNAT's leaf nodes and DST's Shrubs nodes, the frequency of DSNAT expansion will be lower than that of DST. For example, when DST has two layers, a two-layer DSNAT can handle changes in the hash values ​​of DST's Shrubs nodes. When DST has three layers, DSNAT will also be expanded to three layers to handle the increase in the number of DST's Shrubs nodes and changes in hash values. When DST has four layers, a three-layer DSNAT can still handle the increase in the number of DST's Shrubs nodes and changes in hash values. And when DSNAT has four layers, the target tree capacity is 8, so it can handle the increase in the number of DST's Shrubs nodes and changes in hash values ​​for a DST with no more than eight first tree layers. Specifically, when Shrubs[3] is added to DST (that is, when DST is expanded from two layers to three layers), there is no need to expand the scale of DSNAT, and the hash value of Shrubs[3] can be directly used to update The corresponding random number To get ,Right now:

[0096] ;

[0097] Similarly, when a Shrubs node is updated in DST, the hash value of the Shrubs node is used to update the random number of the corresponding Chameleon Hash node in DSNAT.

[0098] Step S14: Update the target private key based on the current target dynamic tree and determine the second signature parameter, determine the target signature based on the first signature parameter, the second signature parameter and the one-time public key, and determine the message signature pair based on the target message and the target signature, so as to verify the message signature pair based on the target dynamic tree using the target signature; the target private key is generated based on the trapdoor key of the target dynamic tree.

[0099] In this embodiment, since the target dynamic tree DCSAT is constructed based on the first dynamic tree DST and the second dynamic tree DSNAT, and the target private key of the target dynamic tree is constructed based on the trapdoor key, the tree structure of the first dynamic tree DST and the tree structure of the second dynamic tree DSNAT, after the public key is stored in the leaf node of the first dynamic tree, the tree structure of the first dynamic tree and the tree structure of the second dynamic tree will change. Therefore, each time a public key is added to DST, the target dynamic tree and the target private key will change. That is to say, after completing the storage of data and the update of the tree structure of the first dynamic tree and the second dynamic tree, the target dynamic tree and the target private key need to be updated based on the current structure of the first dynamic tree, the current structure of the second dynamic tree and the trapdoor key, wherein the target private key of DCSAT is updated. To get , which can be described as:

[0100] ;

[0101] in, For the updated DST tree structure, This is the updated DSNAT tree structure.

[0102] In this embodiment, the updated tree structure and In addition to being used to update the target private key, it can also be used to determine the stored public key. The second signature parameter includes the authentication path corresponding to the primary public key in the target dynamic tree DCSAT and index Specifically, according to and , you can find the authentication path of the data , for example for Figure 7 For node 1 in (a), its authentication path for:

[0103] .

[0104] Table 2 below compares the Dynamic Chameleon Shrubs Authentication Tree (DCSAT) and the Dynamic Chameleon Authentication Tree (DCAT) proposed in this embodiment. Table 2 shows that DCSAT and DCAT are comparable in terms of the number of verification root nodes, capacity, average update path length, and the number of Chameleon hash collisions calculated during each update. Both can dynamically add leaf nodes and expand the tree size. However, DCAT uses a "generate first, then update" approach when adding leaf nodes, incurring additional update overhead, while DCSAT can directly add leaf nodes and then generate other related nodes. Furthermore, DCSAT has a shorter average authentication path length than DCAT. In contrast, DCSAT proposed in this embodiment optimizes the authentication path for leaf nodes, resulting in a shorter average authentication path length, effectively reducing signature size and verification overhead. Furthermore, adding leaf nodes does not require a "generate first, then update" approach, which does not incur additional update overhead, resulting in lower management overhead for the entire tree.

[0105] Table 2 Comparison results between DCSAT and DCAT

[0106]

[0107] In this embodiment, the second signature parameter is recorded as , and finally based on the first signature parameter , Second signature parameter and a one-time public key Determine target signature , thus based on the target message and target signature Determine the message signature pair When verifying the message signature pair based on the target dynamic tree using the target signature, the first verification algorithm in the one-time signature scheme can be used. , based on the one-time public key in the target signature, perform a first parameter verification on the target message in the message signature pair and the first signature parameter in the target signature to obtain a first verification result; if the first verification result indicates that the target signature passes the first parameter verification, then use the second verification algorithm of the target dynamic tree , performing a second parameter verification on the second target parameter in the target signature based on the target public key and the one-time public key of the target dynamic tree to obtain a second verification result.

[0108] It can be seen that the present application constructs a target dynamic tree using a first dynamic tree and a second dynamic tree, wherein the first dynamic tree is a dynamic Shrubs tree whose scale can be dynamically expanded according to demand, and the second dynamic tree is a dynamic Shrubs node authentication tree whose scale can be dynamically expanded according to demand. The leaf nodes of the first dynamic tree are used to store the one-time public key in a key pair, and the message corresponding to the leaf node of the second dynamic tree corresponds to the hash value of the Shrubs node of the first dynamic tree, thereby realizing the dynamic and boundless management of the one-time signature key using the target dynamic tree. When it is necessary to verify a message signed with a one-time private key in a key pair, it is only necessary to determine the one-time public key corresponding to the one-time private key and the position of the one-time public key in the target dynamic tree based on the target signature contained in the message signature pair to which the message belongs. The target dynamic tree can be used to complete the verification of the message signature pair, thereby realizing the dynamic and boundless management of the one-time signature key while weakening the impact of the expansion of the tree scale on the length of the authentication path and reducing the management overhead of the tree.

[0109] Based on the previous embodiment, this application discloses a signature key management method that can achieve dynamic and unbounded management of a single signature key, reduce the impact of tree size expansion on authentication path length, and reduce tree management overhead. Next, the specific signature key storage and verification process will be described.

[0110] In this embodiment, DCSAT is used to manage the key of a single signature, that is, the public key of a key pair is used as a leaf node to construct a target dynamic tree DCSAT to convert a single signature scheme into a signature scheme that can be signed countless times. Specifically, let As a one-time signature scheme, For the target dynamic tree, if set For a DCSAT-based signature scheme, the specific construction is as follows:

[0111] 1) For the key generation algorithm. Run the DCSAT key generation algorithm , output multiple signature private key and a multi-signature public key .

[0112] 2) For the signature algorithm, use the multiple signature private key Message Sign. First, generate a key pair for signing. ; Then use a private key Message Sign and get the first signature parameter ; Then the public key Added to DCSAT, that is:

[0113] ;

[0114] Let the second signature parameter be , and finally returns the signature .

[0115] 3) To verify the algorithm, use multiple signature public keys Sign the message First, use the one-time public key For the first signature parameter To verify, that is:

[0116] ;

[0117] Then run the DCSAT verification algorithm to verify the public key once Is it an element under the corresponding certification path and index in DCSAT, that is:

[0118] ;

[0119] If both steps are successful, the output is 1; if either step fails, the output is 0.

[0120] It can be seen that the present application constructs a target dynamic tree using a first dynamic tree and a second dynamic tree, wherein the first dynamic tree is a dynamic Shrubs tree whose scale can be dynamically expanded according to demand, and the second dynamic tree is a dynamic Shrubs node authentication tree whose scale can be dynamically expanded according to demand. The leaf nodes of the first dynamic tree are used to store the one-time public key in a key pair, and the message corresponding to the leaf node of the second dynamic tree corresponds to the hash value of the Shrubs node of the first dynamic tree, thereby realizing the dynamic and boundless management of the one-time signature key using the target dynamic tree. When it is necessary to verify a message signed with a one-time private key in a key pair, it is only necessary to determine the one-time public key corresponding to the one-time private key and the position of the one-time public key in the target dynamic tree based on the target signature contained in the message signature pair to which the message belongs. The target dynamic tree can be used to complete the verification of the message signature pair, thereby realizing the dynamic and boundless management of the one-time signature key while weakening the impact of the expansion of the tree scale on the length of the authentication path and reducing the management overhead of the tree.

[0121] See also Figure 9 As shown, the present application discloses a signature key management device, comprising:

[0122] A message signing module 11 is configured to obtain a target message, generate a one-time key pair using target security parameters, and sign the target message using a one-time private key in the one-time key pair to obtain a first signature parameter;

[0123] A first dynamic tree updating module 12 is configured to store the primary public key in the primary key pair using the leaf nodes of the current first dynamic tree to obtain a new first dynamic tree;

[0124] A second dynamic tree updating module 13 is configured to update the second dynamic tree to obtain a new second dynamic tree when the number of Shrubs nodes of the first dynamic tree changes, and to update a target tree capacity flag when the number of Shrubs nodes changes, so as to update the target dynamic tree based on the new first dynamic tree and the new second dynamic tree; wherein the target dynamic tree is a dynamic tree constructed based on the first dynamic tree and the second dynamic tree, and the target tree capacity flag is used to determine whether the target tree capacity of the current second dynamic tree meets a target tree capacity increase condition; if so, increase the number of target tree layers of the second dynamic tree and update the target tree capacity; the target tree capacity is the number of leaf nodes of the second dynamic tree;

[0125] a signature verification module 14, configured to update a target private key based on the current target dynamic tree and determine a second signature parameter, determine a target signature based on the first signature parameter, the second signature parameter, and the one-time public key, and determine a message-signature pair based on the target message and the target signature, thereby verifying the message-signature pair based on the target dynamic tree using the target signature; the target private key being generated from a trapdoor key based on the target dynamic tree;

[0126] Among them, the security parameters corresponding to the trapdoor key and the hash key of the target dynamic tree are consistent with the target security parameters; the first dynamic tree is a dynamic Shrubs tree, the second dynamic tree is a dynamic Shrubs node authentication tree, the leaf nodes of the second dynamic tree are chameleon hash nodes, and the messages corresponding to the leaf nodes of the second dynamic tree correspond to the hash values ​​of the Shrubs nodes of the first dynamic tree; the second signature parameters include the authentication path and index corresponding to the one-time public key in the target dynamic tree.

[0127] It can be seen that the present application constructs a target dynamic tree using a first dynamic tree and a second dynamic tree, wherein the first dynamic tree is a dynamic Shrubs tree whose scale can be dynamically expanded according to demand, and the second dynamic tree is a dynamic Shrubs node authentication tree whose scale can be dynamically expanded according to demand. The leaf nodes of the first dynamic tree are used to store the one-time public key in a key pair, and the message corresponding to the leaf node of the second dynamic tree corresponds to the hash value of the Shrubs node of the first dynamic tree, thereby realizing the dynamic and boundless management of the one-time signature key using the target dynamic tree. When it is necessary to verify a message signed with a one-time private key in a key pair, it is only necessary to determine the one-time public key corresponding to the one-time private key and the position of the one-time public key in the target dynamic tree based on the target signature contained in the message signature pair to which the message belongs. The target dynamic tree can be used to complete the verification of the message signature pair, thereby realizing the dynamic and boundless management of the one-time signature key while weakening the impact of the expansion of the tree scale on the length of the authentication path and reducing the management overhead of the tree.

[0128] In a specific embodiment, the device may include:

[0129] A key generation module, configured to generate a trapdoor key and a hash key of a chameleon hash function corresponding to a target dynamic tree using target security parameters;

[0130] a zeroing module, configured to perform a zeroing operation on each counter, a target tree capacity corresponding to the initial second dynamic tree, and a target tree layer number; the counters include a data counter and a Shrubs node counter; the Shrubs node counter corresponds to the target tree capacity flag;

[0131] An initialization module, configured to initialize the target database and all verification root nodes to be empty, and to initialize the initial structure of the first dynamic tree and the initial structure of the second dynamic tree to be empty;

[0132] The dynamic tree construction module is used to construct an initial target dynamic tree based on the values ​​of each counter, the target tree capacity and the number of target tree layers, the target database, the verification root node, the initial first dynamic tree and the initial second dynamic tree.

[0133] In a specific embodiment, the device may further include:

[0134] a target private key construction module, configured to construct an initial target private key of the target dynamic tree based on the initial structure of the first dynamic tree, the initial structure of the dynamic second dynamic tree, and the trapdoor key;

[0135] A target public key construction module, configured to construct an initial target public key of the target dynamic tree using the hash key;

[0136] Accordingly, the signature verification module 14 may specifically include:

[0137] A parameter determination unit is configured to update a target private key and determine a second signature parameter based on a current structure of the first dynamic tree, a current structure of the second dynamic tree, and the trapdoor key.

[0138] In a specific implementation, the first dynamic tree updating module 12 may specifically include:

[0139] A leaf node adding unit, used for adding a target leaf node to the current first dynamic tree;

[0140] A data storage unit, configured to store the primary public key in the primary key pair using the target leaf node;

[0141] A target node determination unit, configured to perform a hash operation on the target leaf node to determine a target Shrubs node corresponding to the target leaf node;

[0142] A judging unit, configured to judge whether the target Shrubs node already exists;

[0143] a first dynamic tree updating unit, configured to update the hash value of the target Shrubs node to obtain a new first dynamic tree if the target Shrubs node already exists;

[0144] The data counter updating unit performs an increment operation on the current value of the data counter.

[0145] In a specific implementation, the second dynamic tree updating module 13 may specifically include:

[0146] a first updating unit, configured to update the random numbers corresponding to the leaf nodes of the second dynamic tree based on the trapdoor key and the hash value of the new Shrubs node of the first dynamic tree, if a change in the Shrubs node of the first dynamic tree meets a first update condition, to obtain a new second dynamic tree;

[0147] a second updating unit, configured to, if a change in the Shrubs node of the first dynamic tree meets a second update condition, add a corresponding chameleon hash node for the newly added Shrubs node of the first dynamic tree in the second dynamic tree using the target tree capacity flag and the target tree capacity, and update the random numbers corresponding to the leaf nodes of the second dynamic tree based on the trapdoor key and the new hash value of the Shrubs node of the first dynamic tree, so as to obtain a new second dynamic tree;

[0148] The first update condition is that the Shrubs node and the corresponding hash value of the first dynamic tree change, and the number of Shrubs nodes in the first dynamic tree does not change; the second update condition is that the Shrubs node and the corresponding hash value of the first dynamic tree change, and the number of Shrubs nodes in the first dynamic tree changes.

[0149] In a specific implementation, the signature verification module 14 may specifically include:

[0150] a first verification unit, configured to perform a first parameter verification on the target message in the message-signature pair and a first signature parameter in the target signature based on the primary public key in the target signature using a first verification algorithm to obtain a first verification result;

[0151] The second verification unit is configured to, if the first verification result indicates that the target signature passes the first parameter verification, use a second verification algorithm to perform a second parameter verification on the second target parameter in the target signature based on the target public key of the target dynamic tree and the one-time public key to obtain a second verification result.

[0152] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 10 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0153] Figure 10 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the signature key management method disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0154] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0155] In addition, the memory 22 as a carrier for resource storage can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0156] The operating system 221 is used to manage and control the hardware devices on the electronic device 20 and the computer program 222, and can be Windows Server, NetWare, Unix, Linux, etc. In addition to including computer programs capable of implementing the signature key management method disclosed in any of the aforementioned embodiments and executed by the electronic device 20, the computer program 222 can further include computer programs capable of performing other specific tasks.

[0157] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned signature key management method. The specific steps of this method can be found in the corresponding content disclosed in the aforementioned embodiments and will not be repeated here.

[0158] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0159] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0160] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0161] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0162] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A signature key management method, characterized in that: include: Obtaining a target message, generating a primary key pair using target security parameters, and signing the target message using a primary private key in the primary key pair to obtain a first signature parameter; Using the leaf nodes of the current first dynamic tree to store the primary public key in the primary key pair to obtain a new first dynamic tree; When the number of Shrubs nodes in the first dynamic tree changes, the second dynamic tree is updated to obtain a new second dynamic tree. When the number of Shrubs nodes changes, a target tree capacity flag is updated to update the target dynamic tree based on the new first dynamic tree and the new second dynamic tree. The target dynamic tree is a dynamic tree constructed based on the first dynamic tree and the second dynamic tree. The target tree capacity flag is used to determine whether the target tree capacity of the current second dynamic tree meets a target tree capacity increase condition. If so, the number of target tree layers of the second dynamic tree is increased and the target tree capacity is updated. The target tree capacity is the number of leaf nodes of the second dynamic tree. The target private key is updated based on the current target dynamic tree and a second signature parameter is determined; a target signature is determined based on the first signature parameter, the second signature parameter, and the one-time public key; and a message signature pair is determined based on the target message and the target signature, so as to verify the message signature pair based on the target dynamic tree using the target signature; the target private key is generated based on a trapdoor key of the target dynamic tree; Among them, the security parameters corresponding to the trapdoor key and the hash key of the target dynamic tree are consistent with the target security parameters; the first dynamic tree is a dynamic Shrubs tree, the second dynamic tree is a dynamic Shrubs node authentication tree, the leaf nodes of the second dynamic tree are chameleon hash nodes, and the messages corresponding to the leaf nodes of the second dynamic tree correspond to the hash values ​​of the Shrubs nodes of the first dynamic tree; the second signature parameters include the authentication path and index corresponding to the one-time public key in the target dynamic tree.

2. The signature key management method according to claim 1, characterized in that: The process of obtaining the initial target dynamic tree includes: Generate a trapdoor key and a hash key of the chameleon hash function corresponding to the target dynamic tree using the target security parameter; Performing a zeroing operation on each counter, a target tree capacity corresponding to the initial second dynamic tree, and a target tree layer number; the counters include a data counter and a Shrubs node counter; the Shrubs node counter corresponds to the target tree capacity flag; Initializing the target database and all verification root nodes to be empty, and initializing the structure of the first dynamic tree and the structure of the second dynamic tree to be empty; An initial target dynamic tree is constructed based on the values ​​of the counters, the target tree capacity and the number of target tree layers, the target database, the verification root node, the initial first dynamic tree and the initial second dynamic tree.

3. The signature key management method according to claim 1, characterized in that: Also includes: Constructing an initial target private key of the target dynamic tree based on the initial structure of the first dynamic tree, the initial structure of the dynamic second dynamic tree, and the trapdoor key; Constructing an initial target public key of the target dynamic tree using the hash key; Accordingly, updating the target private key based on the current target dynamic tree and determining the second signature parameter includes: Based on the current structure of the first dynamic tree, the current structure of the second dynamic tree, and the trapdoor key, the target private key is updated and a second signature parameter is determined.

4. The signature key management method according to claim 1, characterized in that: The storing of the primary public key in the primary key pair by using the leaf node of the current first dynamic tree to obtain a new first dynamic tree includes: Add the target leaf node to the current first dynamic tree; Utilizing the target leaf node to store the primary public key in the primary key pair; Performing a hash operation on the target leaf node to determine the target Shrubs node corresponding to the target leaf node; Determine whether the target Shrubs node already exists; If the target Shrubs node already exists, updating the hash value of the target Shrubs node to obtain a new first dynamic tree; Increment the current data counter value by one.

5. The signature key management method according to claim 1, characterized in that: The updating of the second dynamic tree to obtain a new second dynamic tree when the Shrubs node of the first dynamic tree changes includes: If the change of the Shrubs node of the first dynamic tree meets the first update condition, the random numbers corresponding to the leaf nodes of the second dynamic tree are updated based on the trapdoor key and the hash value of the new Shrubs node of the first dynamic tree to obtain a new second dynamic tree; If the change in the Shrubs node of the first dynamic tree meets the second update condition, using the target tree capacity flag and the target tree capacity, add a corresponding chameleon hash node for the newly added Shrubs node of the first dynamic tree in the second dynamic tree, and update the random numbers corresponding to the leaf nodes of the second dynamic tree based on the trapdoor key and the new hash value of the Shrubs node of the first dynamic tree to obtain a new second dynamic tree; The first update condition is that the Shrubs node and the corresponding hash value of the first dynamic tree change, and the number of Shrubs nodes in the first dynamic tree does not change; the second update condition is that the Shrubs node and the corresponding hash value of the first dynamic tree change, and the number of Shrubs nodes in the first dynamic tree changes.

6. The signature key management method according to claim 1, characterized in that: The target tree capacity increase condition is that a difference between the value of the target tree capacity flag and the target tree capacity is less than a preset target tree capacity difference.

7. The signature key management method according to any one of claims 1 to 6, characterized in that: The verifying the message signature pair using the target signature based on the target dynamic tree includes: performing a first parameter verification on the target message in the message-signature pair and a first signature parameter in the target signature based on the primary public key in the target signature using a first verification algorithm to obtain a first verification result; If the first verification result indicates that the target signature passes the first parameter verification, a second parameter verification is performed on the second target parameter in the target signature based on the target public key of the target dynamic tree and the one-time public key using a second verification algorithm to obtain a second verification result.

8. A signature key management device, characterized in that: include: a message signing module, configured to obtain a target message, generate a one-time key pair using target security parameters, and sign the target message using a one-time private key in the one-time key pair to obtain a first signature parameter; A first dynamic tree updating module is configured to store the primary public key in the primary key pair using the leaf node of the current first dynamic tree to obtain a new first dynamic tree, and update the value of the data counter; A second dynamic tree updating module is configured to update the second dynamic tree to obtain a new second dynamic tree when the number of Shrubs nodes of the first dynamic tree changes, and to update a target tree capacity flag when the number of Shrubs nodes changes, so as to update the target dynamic tree based on the new first dynamic tree and the new second dynamic tree; wherein the target dynamic tree is a dynamic tree constructed based on the first dynamic tree and the second dynamic tree, and the target tree capacity flag is used to determine whether the target tree capacity of the current second dynamic tree meets a target tree capacity increase condition; if so, increase the number of target tree layers of the second dynamic tree and update the target tree capacity; the target tree capacity is the number of leaf nodes of the second dynamic tree; a signature verification module, configured to update a target private key based on the current target dynamic tree and determine a second signature parameter, determine a target signature based on the first signature parameter, the second signature parameter, and the one-time public key, and determine a message-signature pair based on the target message and the target signature, thereby verifying the message-signature pair based on the target dynamic tree using the target signature; the target private key being generated from a trapdoor key based on the target dynamic tree; Among them, the security parameters corresponding to the trapdoor key and the hash key of the target dynamic tree are consistent with the target security parameters; the first dynamic tree is a dynamic Shrubs tree, the second dynamic tree is a dynamic Shrubs node authentication tree, the leaf nodes of the second dynamic tree are chameleon hash nodes, and the messages corresponding to the leaf nodes of the second dynamic tree correspond to the hash values ​​of the Shrubs nodes of the first dynamic tree; the second signature parameters include the authentication path and index corresponding to the one-time public key in the target dynamic tree.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the signature key management method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store a computer program, wherein when the computer program is executed by a processor, the signature key management method according to any one of claims 1 to 7 is implemented.

Images