A periodic non-interactive ring signature method and system based on SM9 national encryption algorithm

Abstract

The application discloses a periodic non-repudiation ring signature method and system based on an SM9 national encryption algorithm, relates to the technical field of ring signature and information security, and comprises the following steps: S1, initializing public parameters and a master key pair; S2, generating a signer private key according to the identity of a signer; S3, the signer selects ring members participating in signature to form a ring group, the ring group signs a message according to the signer private key, obtains a ring signature, and sends the message and the ring signature to a verifier; S4, the verifier verifies the ring signature, and if the verification is passed, the process proceeds to S5, otherwise, the signature is stopped; S5, the verifier sends a verification message to ring members in the ring group to confirm the signer. The application introduces a time period, realizes periodic non-repudiation ring signature, modifies a confirmation and denial algorithm, and ensures that the scheme can not only complete identity privacy protection, but also track a real signer without the participation of a trusted third party.

Description

Technical Field

[0001] This invention relates to the field of ring signature and information security technology, and more specifically to a periodic repudiable ring signature method and system based on the SM9 national cryptographic algorithm. Background Technology

[0002] Ring signatures are a special digital signature mechanism that allows a signer to select multiple different users to form a user group (called a "ring"), and use their personal private keys and a list of public keys belonging to the group members to sign a message m. A verifier can verify that the signature originated from a user in the user group, but cannot confirm the signer's specific identity. Repudiable ring signatures are an extension of ring signatures, allowing ring members to confirm or deny their signatures when necessary through a specific protocol, without relying on a trusted third party. Repudiable ring signatures offer traceability, balancing privacy protection with controllable oversight. Combining repudiable ring signature technology with identity-based cryptography retains the main characteristics of repudiable ring signatures while overcoming the complexity of user public key and certificate management in traditional public key infrastructures.

[0003] While traditional ring signatures and repudiable ring signatures solve the problems of privacy protection and signature repudiation respectively, they are usually static, meaning that once a signature is generated, the relevant attributes cannot be changed.

[0004] Therefore, how to implement dynamic signatures and improve identity security is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] In view of this, the present invention provides a periodic repudiable ring signature method and system based on the SM9 national cryptographic algorithm. It introduces a time period to realize periodic repudiable ring signature, modifies the confirmation and denial algorithm, and ensures that the scheme can not only protect identity privacy, but also track the real signer without the participation of a trusted third party.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] A periodic repudiable ring signature method based on the SM9 national cryptographic algorithm includes the following steps:

[0008] S1: Initialize public parameters and master key pair;

[0009] S2: Generate the signer's private key sk based on the signer's identity. π ;

[0010] S3: The signer selects ring members to form a ring group. The ring group signs the message M according to the signer's private key to obtain the ring signature σ, and sends the message M and the ring signature σ to the verifier.

[0011] S4: The verifier verifies the ring signature. If the verification is successful, proceed to S5; otherwise, stop signing.

[0012] S5: The verifier sends a verification message to the ring members in the ring group to confirm the signer.

[0013] Preferably, the parameter generator is run to generate a set of public parameters and a master key pair from the Key Generation Center (KGC); the public parameters include elliptic curve parameters and time periods; the master key pair includes a master public key and a master private key; the specific process of S1 is as follows:

[0014] S11: Setting elliptic curve parameters includes: generating bilinear pairs e: G1×G2→G T Where G1 and G2 are additive cyclic groups of order q, and G... T Let G1 be the multiplicative cyclic group obtained by performing bilinear pairing operations on G1 and G2; the generator of the additive cyclic group G1 is P1, and the generator of the additive cyclic group G2 is P2.

[0015] S12: Set the time period T, which is the interval length between switching between the denyable and non-denyable periods;

[0016] S13: Randomly generate a master private key and receive a request message. Based on the operating mode and master private key carried in the request message, generate a master public key, secretly store the master private key, and publicly disclose the master public key and the set parameters.

[0017] Preferably, the process of generating the master private key and master public key is as follows:

[0018] S131: Use the SystemRandom function to generate a random number d as the master private key msk=d. The value range of the master private key is within the order ec.curve_order of the elliptic curve.

[0019] S132: Select the operating mode, calculate the master public key P based on the master private key. pub-s = [d]P2∈G2, where P2 represents the generator, G2 represents the additive cyclic group, and [] represents scalar multiplication;

[0020] S133: Based on the operating mode and master public key P pub-s Calculate the pairing value g; g = e(P) j ,P pub-s ), j = 1, 2, e represents a bilinear mapping;

[0021] If it's a signature scheme, then g = ate.pairing(P1, P... pub-s ), ate.pairing represents the pairing function, used to generate bilinear pairs;

[0022] If it's a key exchange or encryption scheme, g = ate.pairing(P pub-s ,P2);

[0023] S134: Public generators P1 and P2, additive cyclic groups G1 and G2, master public key P pub-s 、.

[0024] Preferably, the specific process of S2 is as follows:

[0025] Given the signer's identity ID π KGC uses the master private key to generate the signer's private key sk. π =[d(v π +d) -1 P1, where v π =H1(ID) π ||hid,N) is based on the signer's identity ID π The calculated identity parameters can be simplified as v π =H1(ID) π ); The signer specifies message M.

[0026] Preferably, in S3, a ring group is formed by selecting n-1 ring members who participate in the signing, concealing the signer's identity within the ring group, and calculating and processing the time parameter during signing. Finally, the ring signature is generated using the signer's private key. The specific process is as follows:

[0027] S31: The signer selects n-1 ring members to participate in the signing, forming a ring group U. n ={ID1,ID2,...,ID n}, ID i The identifier representing a member of the ring, i = 1,...,n;

[0028] S32: All ring members within the ring group randomly select a temporary secret value r. r i Let R represent the temporary secret value chosen by the i-th ring member. Calculate the curve points R for all non-signer ring members. i =[r i P1, where R i Let P1 represent the i-th member curve point of the cyclic group G1, and N represent the order of the elliptic curve. Let N be the set of all integers in the range [1, N) that are relatively prime to N.

[0029] S33: The signer defines the time parameter f(t) = e([r]P1,[t+1mod T]P2) based on the curve point R, where e represents the bilinear mapping, t represents the time t, and mod represents the modulo operation. The signer calculates f(0) and publishes it.

[0030] S34: Calculate the other parameters α, β, and ω based on the signer's private key, the master public key, and the temporary secret values ​​of the ring members, expressed as:

[0031]

[0032] α=e([r π P1,P pub-s f(0) and make it public;

[0033] ω = α·β;

[0034] sk π Indicates the signer's private key; v i The r represents the identity parameter of the i-th ring member, i = 1, ..., n; π This represents the signer's temporary secret value;

[0035] S35: Calculate the hash value h of the signed message based on the signer's message M, the identifiers of all ring members in the ring group, and other parameters ω. l The judgment parameter l is calculated based on the hash value of the signed message, and is expressed as:

[0036] h l =H2(U n ||M||ω);

[0037] l=(r π -h1)modN;

[0038] Where H2 represents the hash function; random parameters N represents a large prime number; if l = 0 is true, return to S1 and execute again; if not, proceed to S36;

[0039] S36: Calculate the signer curve point R π =[l]sk π and Output the ring signature of message M by the signer

[0040] Preferably, in S4, the verifier receives message M′ and the ring signature of message M′. Calculate h yourself using the publicly available parameters. * By judging h * The relationship between h1 and h1′ is used to determine whether the signature can pass verification. The specific process is as follows:

[0041] S41: Verify whether the parameters in the ring signature σ' are satisfied. R i ′∈G1(i∈{1,2,…,n}) and G TThis represents the multiplicative cyclic group obtained after bilinear pairing of G1 and G2;

[0042] If the conditions are met, all parameters in the received ring signature σ' are valid, and the process proceeds to S42; otherwise, a verification failure alarm (reject) is output.

[0043] S42: Calculate relevant parameters:

[0044] g=e(P1,P pub-s );

[0045]

[0046] Where g represents the paired value; e represents the bilinear mapping; P1 represents g raised to the power of h1′; P2 represents the generator in the additive cyclic group G2; v i This represents the identity parameter of the i-th signer;

[0047] S43: Calculate h * =H2(U n ||M′||ω′), verify h * Check if h1′ is true; if true, output "accept" if the validation is successful; otherwise, output "reject" if the validation fails.

[0048] Preferably, after completing the signing and verification process, the verifier V in S5 can initiate an affirmation / denial algorithm to all ring members in the ring group. In the affirmation / denial algorithm, the corresponding ring member becomes the prover P. During the repudiable time period, both parties can determine the true signer of the periodically repudiable digital signature through the following protocol, the specific process of which is as follows:

[0049] S51: Verifier V sends a verification message M to each prover P. V ;

[0050] S52: Proofreader P selects a random integer. According to verification message M V Calculate h2;

[0051] η=e([x]P1,P pub-s )·f(t)

[0052] h2=H2(M V ||η);

[0053] f(t) represents the time parameter calculated based on the current time t;

[0054] S53: Proofreader P calculates y = (x - h2) mod N and S = [y]sk based on h2. PThe response (S, h2, f(t)) is then sent to the verifier V for verification.

[0055] S54: Verifier V performs basic processing on the response sent by prover P and the published parameters.

[0056] Calculate ρ=e(R) respectively p ,[v p P2+P pub-s )·f(t),δ=e(S,[v p P2+P pub-s )and

[0057] Among them, R p v represents the point on the prover curve. p Indicates the identity parameter of the certifier; This represents g raised to the power of h².

[0058] S55: Verifier V calculates h2' based on the verification message and η′, h′2=H2(M V ||η′), determine whether h2=h2' is true; if true, proceed to S56; otherwise, this confirmation / denial agreement is invalid;

[0059] S56: Verifier V calculates μ, μ = e([h1]P1,P pub-s ), and determine whether α=ρ·μ is true; if true, output that the prover P is the actual signer of the signature; otherwise, output that the prover P is not the actual signer of the signature.

[0060] A periodic repudiable ring signature system based on the SM9 national cryptographic algorithm, comprising:

[0061] The system parameter configuration module initializes public parameters and master key pairs, updates system parameters, and sets up the signing environment.

[0062] The user identity key management module receives the signer's identity and generates identity parameters and the signer's private key;

[0063] The ring member management module is used to manage the list of legitimate and trusted users. It selects a corresponding number of legitimate users as ring members to form a ring group according to the signature requirements, and also supports the dynamic addition or removal of ring members.

[0064] The ring signature generation module signs the specified message M based on the signer's private key to obtain a ring signature;

[0065] The ring signature verification module calculates the relevant parameters of the received ring signature to verify its legality and validity.

[0066] The confirmation / denial protocol module is used for the verification interaction between the verifier and the ring members. It calculates and processes relevant parameters to determine the true signer of the periodic repudiable digital signature within the repudiable time period.

[0067] Preferably, it also includes a secure communication module for generating temporary keys, sharing session keys, performing key encapsulation and data encryption / decryption operations, handling key exchange and session establishment processes between communication participants, and ensuring the security of internal and external communication within the system.

[0068] Preferably, it also includes a system auxiliary module, which is used for basic operations such as hash value calculation and parameter conversion required by the system, and provides standardized input / output formats and numerical processing capabilities for other modules.

[0069] As can be seen from the above technical solutions, compared with existing technologies, this invention discloses a periodic repudiable ring signature method and system based on the SM9 national cryptographic algorithm. By introducing a time period into the ring signature system, a dual-mode dynamic signature mechanism is proposed, achieving adaptive privacy and accountability management. It demonstrates great flexibility and innovation in multiple aspects, including privacy protection, right of denial, accountability tracking, anti-counterfeiting, verifiability, and accountability and auditing. Through in-depth analysis of the working mechanism of each functional module and its practical application scenarios, it can be found that the periodic repudiable digital signature scheme proposed in this invention has the potential to solve practical problems, especially in multiple fields such as finance, blockchain, contract management, and data sharing, providing a balance between privacy and accountability tracking. Through further technological innovation and optimization, such as combining artificial intelligence, quantum-resistant encryption, and multi-party computation technologies, periodic repudiable digital signatures can play a greater role in future practical applications. In cryptographic protocols, time is typically used for managing the expiration of encryption keys or for timestamps in blockchains. The solution of this invention introduces a time parameter into the signature mechanism, enabling dynamic alternation between repudiable and non-repudiable time periods. This allows the behavior and attributes of the signature to change dynamically over time, providing a more refined privacy protection and traceability mechanism through "timeliness." This makes the system more flexible and meets multiple requirements for privacy and responsibility. Attached Figure Description

[0070] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0071] Figure 1A schematic diagram of the periodic repudiable ring signature method based on the SM9 national cryptographic algorithm provided by the present invention;

[0072] Figure 2 This is a schematic diagram of the ring signature generation process provided by the present invention;

[0073] Figure 3 This is a schematic diagram of the ring signature verification process provided by the present invention;

[0074] Figure 4 This invention provides a schematic diagram of the data transmission process for verifying the true signer.

[0075] Figure 5 A schematic diagram of the structure of the periodic repudiable ring signature system based on the SM9 national cryptographic algorithm provided by the present invention. Detailed Implementation

[0076] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0077] This invention discloses a periodic repudiable ring signature method based on the SM9 national cryptographic algorithm, such as... Figure 1 As shown, it includes the following steps:

[0078] S1: Initialize public parameters and master key pair; Initialize (Setup(λ)→params);

[0079] S2: Generate the signer's private key sk based on the signer's identity. π ;

[0080] S3: The signer selects ring members to form a ring group. The ring group signs the message M according to the signer's private key to obtain the ring signature σ, and sends the message M and the ring signature σ to the verifier.

[0081] S4: The verifier verifies the ring signature. If the verification is successful, proceed to S5; otherwise, stop signing.

[0082] S5: The verifier sends a verification message to the ring members in the ring group to verify the acknowledgment / denial protocol and confirm the signer.

[0083] Further, initialization (Setup(λ)→params) involves inputting security parameters. First, the parameter generator is run to generate a set of public parameters and a master key pair from the Key Generation Center (KGC). The public parameters include elliptic curve parameters and a time period. The master key pair includes a master public key and a master private key. By setting the time parameter, the switching between the repudiable and non-repudiable periods is determined, and this periodic function is directly embedded into the mathematical expressions of the signature generation, verification, and confirmation / denial algorithms. This enables the algorithm to "disrupt" execution during the non-repudiable period and resume normal execution during the denial period. Through deep coupling of bilinear pairs with the time parameters, it possesses long-term security and stronger resistance to analysis. Specifically, this includes:

[0084] S11: Fundamental Groups and Pairing Operations:

[0085] Generate bilinear pairs e: G1 × G2 → G T Where e denotes a bilinear mapping, G1 and G2 are additive cyclic groups of order q, and G... T Let G1 and G2 be the multiplicative cyclic group obtained by performing bilinear pairing operations; the generator of the additive cyclic group G1 is P1, and the generator of the additive cyclic group G2 is P2; all parameters in this step are disclosed.

[0086] By calling ec.G1 and ec.G2 from the optimized_curve module as generators P1 and P2 respectively, and repeatedly performing addition operations on the generators (i.e., point addition on the elliptic curve), all elements in the group can be generated.

[0087] S12: Set the time period T, which is the interval length between switching between the denyable and non-denyable periods;

[0088] S13: Randomly generate a master private key, receive a request message, generate a master public key based on the operating mode and master private key carried in the request message, secretly store the master private key, and publicly disclose the master public key;

[0089] S131: Use the SystemRandom function to generate a random number d∈[1,N] as the master private key msk=d. The value range of the master private key is within the order ec.curve_order of the elliptic curve; the master private key msk is secretly stored.

[0090] S132: Calculate the master public key P based on the master private key d. pub-s = [d]P2∈G2, where P2 represents the generator, G2 represents the additive cyclic group, and [] represents scalar multiplication;

[0091] S133: Based on the master public key P pub-s Calculate the pairing value g = e(P) j ,P pub-s ), j = 1, 2;

[0092] Based on the operating mode and the master public key P pub-s Calculate the pairing value g; if it is a signature scheme, g = ate.pairing(P1, P2, ..., P3). pub-s `ate.pairing` represents the pairing function, used to generate bilinear pairs through bilinear mapping, and can be simplified using `e`. For key negotiation or encryption schemes, `g = ate.pairing(P)`. pub-s ,P2);

[0093] S134: Connect base points P1 and P2, and the master public key P pub-s The common parameter tuple Param = {G1, G2, G...} consists of the pairing value g, the additive cyclic group, the generator, and the chosen hash function. T ,e,P1,P2,P pub-s ,g,H1,H2}, exposes all public parameters.

[0094] Furthermore, the specific process of S2 is as follows:

[0095] Given the signer's identity ID π KGC uses the master private key to generate the signer's private key sk. π =[d(v π +d) -1 ]P1, where [] scalar multiplication, v π =H1(ID) π ||hid,N) is based on the signer's identity ID π The generated identity parameters are calculated, where H1 represents the hash function, hid represents the identifier of the hash function, and N represents a large prime number. Typically, the expression of the identity parameters is simplified to v. π =H1(ID) π ); The signer specifies message M.

[0096] Furthermore, such as Figure 2 As shown, in S3, a ring group is formed by selecting ring members to participate in the signing, concealing the signer's identity within the ring group, and calculating and processing the time parameter at the time of signing. Finally, the ring signature is generated using the signer's private key. The specific process is as follows:

[0097] S31: The signer selects n-1 ring members to participate in the signing, forming a ring group U containing n ring members. n ={ID1,ID2,...,ID n}, ID i The identifier representing a member of the ring, i = 1,...,n;

[0098] S32: All ring members within the ring group randomly select a temporary secret value r. ri Let R represent the temporary secret value chosen by the i-th ring member. Calculate the curve points R for all non-signer ring members. i =[r i P1, where R i Let P1 represent the i-th member curve point of the cyclic group G1, and N represent the order of the elliptic curve. Let N be the set of all integers in the range [1, N) that are relatively prime to N.

[0099] S33: The signer defines the time parameter f(t) = e([r]P1,[t+1mod T]P2) based on the curve point R, where e represents the bilinear pairing operation, t represents the time t, and mod represents the modulo operation. The signer calculates f(0) and publishes it.

[0100] S34: Calculate the other parameters ω, α, and β based on the signer's private key, the master public key, and the temporary secret values ​​of the ring members, expressed as:

[0101]

[0102] α=e([r π P1,P pub-s )·f(0);

[0103] ω = α·β;

[0104] Among them, sk π Indicates the signer's private key; v i The identity parameters of the i-th ring member are represented, i = 1, ..., n; α and β are public; r π This represents the signer's temporary secret value;

[0105] S35: Calculate the hash value h of the signed message based on the signer's message M, the identifiers of all ring members in the ring group, and other parameters ω. l The judgment parameter l is calculated based on the hash value of the signed message, and is expressed as:

[0106] h l =H2(U n ||M||ω);

[0107] l=(r π -h1)modN;

[0108] Where H2 represents the hash function; the random parameter r′∈Z * N N represents a large prime number; if l = 0 is true, return to S1 and re-execute, recalculating almost all data except for the identity parameters corresponding to each ring member; if not true, proceed to S36.

[0109] S36: Calculate the signer curve point R π =[l]sk π and Output the ring signature of message M by the signer R all ={R1,R2,…,R n The timestamp indicates the signing time.

[0110] Furthermore, such as Figure 3 As shown, in S4, the verifier receives message M′ and the ring signature of message M′. Calculate h yourself using the publicly available parameters. * By judging h * The relationship between h1 and h1′ is used to determine whether the signature can pass verification. The specific process is as follows:

[0111] S41: Verify whether the parameters in the ring signature σ' are satisfied. R i ′∈G1(i∈{1,2,…,n}) and G T This represents the multiplicative cyclic group obtained after bilinear pairing of G1 and G2;

[0112] If the conditions are met, all parameters in the received ring signature σ' are valid, and the process proceeds to S42; otherwise, a verification failure alarm (reject) is output.

[0113] S42: Calculate relevant parameters:

[0114] g=e(P1,P pub-s );

[0115]

[0116] Where g represents the pairing value; e represents the bilinear mapping, implemented using the pairing function ate.pairing; P1 represents g raised to the power of h1′; P2 represents the generator in the additive cyclic group G2; v i This represents the identity parameter of the i-th signer;

[0117] S43: Calculate h * =H2(U n ||M′||ω′), verify h * Check if h1′ is true; if true, output "accept" if the validation is successful; otherwise, output "reject" if the validation fails.

[0118] Furthermore, such as Figure 4As shown, after completing the signing and verification process, the verifier V in S5 can initiate an affirmation / denial algorithm to all ring members in the ring group. In the affirmation / denial algorithm, the corresponding ring member becomes the prover P. During the repudiable time period, both parties can determine the true signer of the periodically repudiable digital signature through the following protocol, the specific process of which is as follows:

[0119] S51: Verifier V sends a verification message M to each prover P. V ;

[0120] S52: Proofreader P selects a random integer. According to verification message M V Calculate h2;

[0121] η=e([x]P1,P pub-s )·f(t)

[0122] h2=H2(M V ||η);

[0123] f(t) represents the time parameter calculated instantly based on the current time t;

[0124] S53: Proofreader P calculates y = (x - h2) mod N and S = [y]sk based on h2. P The response (S, h2, f(t)) is then sent to the verifier V for verification.

[0125] S54: Verifier V performs basic processing on the response sent by prover P and the published parameters.

[0126] Calculate ρ=e(R) respectively p ,[v p P2+P pub-s )·f(t),δ=e(S,[v p P2+P pub-s )and

[0127] Among them, R p v represents the point on the prover curve. p Indicates the identity parameter of the certifier; This represents g raised to the power of h².

[0128] S55: Verifier V verifies the verification message M. V Calculate h2' with η′, h′2=H2(M V ||η′), determine whether h2=h2' is true; if true, proceed to S56; otherwise, this confirmation / denial agreement is invalid;

[0129] S56: Verifier V calculates μ, μ = e([h1]P1,P pub-sThe algorithm checks whether α = ρ·μ holds true. If true, it outputs that the prover P is the actual signer of the signature; otherwise, it outputs that the prover P is not the actual signer of the signature. During the repudiable period, through multiple rounds of random challenges and bilinear pairing operations between the verifier and the prover (ring members), only the true signer can satisfy the final pairing relationship judgment, while non-signers cannot pass, thus achieving traceability. During the non-repudiable period, the protocol cannot distinguish between signers and non-signers, making the interaction protocol both anonymous and controllable traceable.

[0130] On the other hand, in a specific embodiment, the implementation process of the periodic repudiable ring signature method based on the SM9 national cryptographic algorithm is as follows:

[0131] S1: Perform parameter initialization;

[0132] S11: Select elliptic curve parameters: Call ec.G1 and ec.G2 in the optimized_curve module as two generator points P1 and P2 on the elliptic curve, respectively, for different operations; once the two generator points are determined, the elliptic curve is selected; set the time period T, which is the interval length for switching between the denyable and non-denyable periods.

[0133] S12: Use the SystemRandom function to generate a random number s, which is within the order ec.curve_order of the elliptic curve, and use the random number s as the master private key;

[0134] S13: If it is a signature scheme (scheme == 'sign'), calculate the master public key P. pub =ec.multiply(P2,s), which is the scalar multiplication result of the master private key s and the generator point P2;

[0135] S14: For the signature scheme, calculate the pairing value g = ate.pairing(P1, P pub ), that is, P1 and P pub The pairing value, ate.pairing represents the pairing function;

[0136] For key negotiation or encryption schemes, calculate g = ate.pairing(P) pub P2), that is, P pub Pairing value with P2;

[0137] S15: Return the master public key and master private key, and expose public parameters P1, P2, and P3. pub ,g,G1,G2,P1,P2,H1,H2;

[0138] S2: The signer signs message M to generate a ring signature;

[0139] S21: Initialize parameters;

[0140] S211: Obtain the public parameters and the signer's private key sk π ;

[0141] S212: The signer's real identity ID π Convert to a hash value to obtain the identity hash value as the identity parameter v π =H1(ID) π );

[0142] S213: Use the read_ring_members() function to read the list of valid members and select the corresponding number of valid users ID1, ID2, ..., ID n-1 As members of the ring, they form the ring group U together with the signers. n ={ID1,ID2,...,ID n};

[0143] S214: Signer-specified message M;

[0144] S22: All ring members randomly generate temporary secret values. N represents the order of the elliptic curve. Let R be the set of all integers in [1, N) that are coprime to N, and compute the curve points R corresponding to all non-signer ring members. i =[r i ]P1, i≠π, and define the time parameter f(t)=e([r]P1,[t+1mod T]P2), e means to perform bilinear pairing operation, calculate f(0) and publish it, and r means to represent the temporary secret value of all ring members;

[0145] S23: Based on the temporary secret values ​​of all non-signature ring members Given the sum of the values ​​and the identity parameters of all ring members, calculate α = e([r π P1,P pub-s )·f(0), and ω=α·β; r π This represents the signer's temporary secret value;

[0146] S24: The signature function sign() determines whether the signing process is valid by calculation and calculates the signer's R. π And other relevant parameters:

[0147] Generate a signature message hash value h l =H2(U n ‖M‖ω) and the judgment parameter l=(r π-h1)modN, and check if l=0 is true; if true, return to the S1 system initialization process and run again; if false, use the signer's private key sk π Calculate the corresponding signer curve point R π =[l]sk π and Obtain the ring signature of message M from the signer. R all ={R1,R2,…,R n}; timestamp is a timestamp indicating the signing time;

[0148] S3: The verifier receives message M′ and the ring signature of message M′. Then perform signature verification;

[0149] S31: Verify whether the parameters meet the requirements using the verify() function. and For all i∈{1,2,…,n}, extract R i And calculate ∑R; if the parameters meet the above range requirements, then all parameters in the ring signature are valid parameters, and continue; otherwise, output verification failure;

[0150] S32: Verify whether ω matches the input message and R using the verify() function with bilinear pairing. i Combinations:

[0151] First calculate g = e(P1, P pub ), then calculate

[0152] S33: Calculate h using the verify() function * =H2(U n ||M′||ω′), verify h * Check if h1′ is true; if true, output "accept" if the validation is successful; otherwise, output "reject" if the validation fails.

[0153] S4: All members of the ring group act as provers P, and the verifier verifies the true signer from all provers;

[0154] S41: Send a verification message M to the prover P via the verify_confirm_disavow() function. V :

[0155] Verifier V sends a verification message M to prover P via verify_confirm_disavow(). V Further verification is planned.

[0156] S42: Select relevant parameters using the confirm_disavow() function and perform calculations on the verification message:

[0157] Proofreader P selects a random integer And calculate η = e([x]P1,P pub )·f(t) and h2=H2(M V ||η); Calculate y=(x-h2)modN and S=[y]sk P And send the response (S,h2,f(t)) from the prover P to the verifier V;

[0158] S43: Further calculations and processing of the response sent by the prover P using the verify_confirm_disavow() function:

[0159] Verifier V calculates ρ = e(R) P ,[v P P2,P pub )·f(t),δ=e(S,[v P P2+P pub )·f(t) and

[0160] S44: Verify the validity of this confirmation / denial protocol using the verify_confirm_disavow() function: Specifically, the verifier V calculates h′2=H2(M V ||η′), and check if h2=h2' is true; if true, continue verification; otherwise, this confirmation / denial agreement is invalid;

[0161] S45: Determine if the prover P is the actual signer by checking the relationship between α, ρ, and μ using verify_confirm_disavow(): Specifically, the verifier V calculates μ = e([h1]P1,P pub ), and check whether α=ρ·μ is true; if true, output that the prover P is the actual signer of the signature; otherwise, output that the prover P is not the actual signer of the signature.

[0162] On the other hand, in a specific embodiment, such as Figure 5 As shown, a periodic repudiable ring signature system based on the SM9 national cryptographic algorithm includes:

[0163] The system parameter configuration module initializes public parameters and master key pairs and updates system parameters, and sets up the signature environment; it is used for the basic environment setup of the entire system and the generation of public parameters, and is also responsible for the periodic updates of system parameters to enhance long-term security.

[0164] The user identity key management module receives the signer's identity and generates identity parameters and the signer's private key; it is used for the full lifecycle identity management of users, including registration, authentication, key derivation, and access control, and also supports functions such as regular key rotation and key revocation; it realizes secure private key derivation, regular rotation and revocation based on identity parameters, further improving the maintainability and security of the system;

[0165] The ring signature generation module signs the specified message M based on the signer's private key to obtain a ring signature; it generates random parameters for all non-signer ring members and the signer in the ring group, calculates intermediate core parameters, generates the ring signature, and verifies the validity of the generated ring signature.

[0166] The ring member management module is used to manage the list of legitimate and trusted users. It selects a corresponding number of legitimate users to form a ring group according to specific signature requirements, and also supports functions such as dynamically adding or removing ring members. The ring member management module supports dynamic maintenance of the list of legitimate members and performs a second check on the validity of ring member identities before signing to prevent invalid or revoked identities from entering the ring group.

[0167] The ring signature verification module is used to verify the legality of relevant parameters and perform calculations on the relevant parameters to determine the legality and validity of the signature.

[0168] The confirmation / denial protocol module is used for the verification interaction between the verifier and the prover (i.e., ring members). It calculates and processes relevant parameters to determine the true signer of the periodic repudiable digital signature within the repudiable time period.

[0169] Furthermore, it also includes a secure communication module, which is used to generate temporary keys, share session keys, perform key encapsulation and data encryption / decryption operations, handle key exchange and session establishment processes between communication participants, and ensure the security of internal and external communication within the system.

[0170] Furthermore, it also includes system auxiliary modules for basic operations such as hash value calculation and parameter conversion required by the system, providing standardized input / output formats and numerical processing capabilities for other modules.

[0171] Furthermore, the system parameter configuration module is specifically used for:

[0172] The `setup(scheme)` function is called to set the time parameter T, determine the interval lengths of the repudiable and non-repudiable periods, select the generator P and other base points P1, P2 ∈ G1, and base them on the bilinear pair e: G1 × G1 → G T This is to prepare for the construction of the master key;

[0173] Set the signature master private key msk=d, and calculate the signature master public key P.pub-s = [d]P2∈G2, where G2 represents the additive cyclic group, its identity element is P2, and the signature master private key is securely stored; after the system parameters are generated, the public parameters are returned through the params structure for use by other modules; the system initialization module is also responsible for the periodic updating of system parameters to enhance long-term security.

[0174] Furthermore, the user identity key management module is specifically used for:

[0175] Receive the user's unique identifier ID A To verify the authenticity of the user's identity;

[0176] Call the function private_key_extract(), based on user A's unique identifier ID. A Calculate the unique identity parameter v of user A A =H1(ID) A ||hid,N), calculate user A's private key sk using the multiplicative inverse. A =[d(v A +d) -1 P1 enables secure derivation from user A's identity to their private key;

[0177] The key_rotation() function was designed to implement periodic key rotation, and the key_revocation() function was designed to implement key revocation functionality.

[0178] Furthermore, the ring signature generation module is specifically used for:

[0179] Based on the specific signature requirements, specify the number of ring members in the ring group, call the ring member management module, and form a signature ring group;

[0180] Call the function sign() to randomly generate temporary secret values ​​for the ring members who are not signers. Calculate the corresponding curve point R i =[r i P1, and call the system auxiliary module to complete the calculation of the time function f(t);

[0181] Based on the relevant parameters and identity parameters publicly disclosed after calculation by the non-signer, the calculation of the signature tuple (α,β,γ,ω) is completed;

[0182] Generate a signature message hash value h l =H2(U n ‖M‖ω) and the judgment parameter l=(rh l The validity of the signature is determined by checking if l = 0: if l = 0, the initial steps of ring signature generation need to be returned and re-executed; if not, the signer parameter R is calculated.π =[l]sk π and Output ring signature

[0183] Furthermore, the ring member management module is specifically used for:

[0184] The module manages the list of legitimate and trusted users. It updates the list of legitimate and trusted users after a user completes registration and identity verification, or after a user engages in illegal behavior.

[0185] Obtain a list of legitimate and trustworthy users, then select the corresponding number of legitimate users to form a ring group according to the specific signature requirements, and check the identity validity and registration status of each ring member again to ensure that the ring does not contain user identities that have been revoked or invalidated.

[0186] Furthermore, the ring signature verification module is specifically used for:

[0187] Call the verify() function to verify whether the signature parameters are satisfied. and Calculate R i ′ and ∑R determine whether the parameters are valid;

[0188] For g = e(P1, P pub-s Pre-compute and store the results, then verify using the bilinear pairing property. Determine if the statement is true, and calculate h. * =H2(U n ||M′||ω′), by verifying h * Check if h1′ is true to confirm the binding relationship between the signature, message, and ring group, and determine the result of signature verification.

[0189] Furthermore, the acknowledgment / denial protocol module is specifically used for:

[0190] Verification interaction is used for verifiers and provers (i.e., ring members) to calculate and process relevant parameters to determine the true signer of periodic repudiable digital signatures within the repudiable time period.

[0191] The verifier calls the function verify_confirm_disavow() to send a verification message M to the candidate prover. V Further verification is planned.

[0192] After receiving the verification message, the prover calls the function confirm_disavow() to select a random integer. And calculate η = e([x]P1,P pub-s )·f(t) and h2=H2(M V, calculate y=(x-h2)modN and S=[y]sk P Then send (S,h2,f(t)) to the verifier to respond to the verification message;

[0193] After receiving the prover's response, the verifier calls the verify_confirm_disavow() function to process the data sent by the prover and calculate ρ = e(R). P ,[v P P2+P pub-s )·f(t),δ=e(S,[v P P2+P pub-s ), and h′2=H2(M V The validity of the acknowledgment / denial protocol is determined by checking whether h2 = h2' is true; if true, verification continues; otherwise, the protocol is invalid.

[0194] After the verifier determines that the acknowledgment / denial protocol is valid, it calculates μ = e([h1]P1,P pub-s ), and check whether α=ρ·μ is true; if true, determine that the prover is the actual signer of the signature; otherwise, determine that the prover is not the actual signer of the signature.

[0195] Furthermore, the secure communication module is specifically used for:

[0196] During the session, both users call the `generate_ephemeral()` function to generate a temporary key pair for one-time key negotiation during the session. They then call the `generate_session_key()` function, which uses bilinear pairing operations combined with the identity parameters `v` of both parties. A =H1(ID) A ||hid,N), generate a shared session key;

[0197] After obtaining the shared session key, the function kem_encap() is called before data transmission to generate session key fragments and intermediate values ​​with random values, which are used to derive encryption and decryption keys. Then, the SM3 and SM9 algorithms are used to encapsulate and decapsulate the keys. During the message encryption process, the function kem_dem_enc() is called to perform mixed encryption on the message and attach a hash check value.

[0198] When decrypting a message, the function kem_decap() is called to recover the corresponding encryption / decryption key, and then kem_dem_dec() is called to decrypt the message. At the same time, the hash value is compared to ensure data integrity.

[0199] Furthermore, the system auxiliary module is specifically used for:

[0200] It provides basic operations such as hash value calculation and parameter transformation required by the system, and provides standardized input / output formats and numerical processing capabilities for other modules;

[0201] To ensure consistency across all numerical values, byte strings, and curve point data throughout the system, the auxiliary function module provides a unified data conversion and processing interface; commonly used functions include:

[0202] Call the bitLen() function and use the formula Calculate the binary length of the integer n to determine the length of the random number or hash output;

[0203] Calling the i2sp(m,l) function first converts the integer m to a hexadecimal string using %x, then pads it with zeros using zfill to ensure the length meets the requirements, and finally uses fe2sp(fe) to convert it to a byte representation to achieve a standardized representation of messages and curve points;

[0204] The h2rf function is called to first derive a long hash value using sm3_kdf, and then map it to the range of curve parameters using modulo operation to ensure that the generated random number is consistent with the system curve parameters.

[0205] Call the function f(t), use the formula f(t)=e([r]P1,[t+1mod T]P2) to calculate the value of f(t), and store the intermediate values ​​generated by the pre-calculation.

[0206] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0207] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A periodic repudiable ring signature method based on the SM9 national cryptographic algorithm, characterized in that, Includes the following steps: S1: Initialize public parameters and master key pair; Run the parameter generator to generate a set of public parameters and a master key pair from the key generation center; the public parameters include elliptic curve parameters and time period; the master key pair includes the master public key and the master private key. The specific process of S1 is as follows: S11: Setting elliptic curve parameters includes: generating bilinear pairs. ,in, and These are additive cyclic groups of order 1. , express and The multiplicative cyclic group obtained after bilinear pairing; the additive cyclic group. The generator in is Additive cyclic group The generator in is ; S12: Set time period ; S13: Randomly generate a master private key, receive request information, generate a master public key based on the operating mode and master private key carried in the request information, secretly store the master private key, and publicly disclose the master public key and the set parameters. The process of generating the master private key and master public key is as follows: S131: Generate a random number d as the master private key msk=d; S132: Calculate the master public key based on the master private key. ,in Represents generator, [] denotes an additive cyclic group, and [] denotes scalar multiplication; S133: Based on the master public key Calculate the pairing value g = e(P) j ,P pub-s ), j=1,2, e represents a bilinear mapping; S134: Public Generator and Addition Cyclic Group and Master key Pairing value g; S2: Generate the signer's private key based on the signer's identity; The specific process of S2 is as follows: Given the identity of the signer The key generation center uses the master private key to generate the signer's private key. ,in, Based on the signer's identity The generated identity parameters are calculated, where H1 represents the hash function; the signer specifies the message M. S3: The signer selects ring members to participate in the signing to form a ring group. The ring group signs the message according to the signer's private key to obtain the ring signature, and sends the message and the ring signature to the verifier. The specific process of S3 is as follows: S31: The signer selects n-1 ring members to participate in the signing, forming a ring group. , The identifier representing a member of the ring, i=1,...,n; S32: All ring members within the ring group randomly select a temporary secret value r. , Let R represent the temporary secret value chosen by the i-th ring member, and calculate the curve points R for all ring members who are not signers. ,in, Let P1 represent the i-th member curve point of the cycle, and P1 represent the additive cyclic group. In the generator, N represents the order of the elliptic curve. Let N be the set of all integers in the range [1, N) that are relatively prime to N. S33: The signer defines the time parameter based on curve point R. e represents a bilinear mapping, t represents time t, and mod represents the modulo operation. The calculation... And make it public; S34: Calculate other parameters based on the signer's private key, the master public key, and the ring member's temporary secret value. α , and and publicly α The expression is: ； ； ； Indicates the signer's private key; v i This represents the identity parameter of the i-th ring member, i=1,…,n; This represents the signer's temporary secret value; S35: Based on the signer's message M, the identifiers of all ring members in the ring group, and other parameters. Calculate the hash value of the signed message Calculate the judgment parameters based on the hash value of the signed message. , represented as: ； ； Where H2 represents the hash function; random parameters N represents a large prime number; if If the condition is met, return to S1 and execute again; if the condition is not met, proceed to S36. S36: Calculate the signer curve point and Output the signer's signature on the message ring signature ; S4: The verifier verifies the ring signature. If the verification is successful, proceed to S5; otherwise, stop signing. In S4, the verifier receives the message. And the message ring signature The ring signature is verified, and the specific process is as follows: S41: Verify Ring Signature Do the parameters in the middle satisfy the requirements? and , express and The multiplicative cyclic group obtained after bilinear pairing; if satisfied, then the received ring signature. If all parameters are valid, proceed to S42; otherwise, output a verification failure alarm. S42: Calculate relevant parameters and , represented as: ； ； Where g represents the paired value; e represents the bilinear mapping; Represents g Power; Represents the addition cyclic group Generators in; This represents the identity parameter of the i-th signer; S43: Calculation ,verify Check if the validation is successful; if successful, output "Validation passed". Otherwise, output a verification failure alarm; S5: The verifier sends a verification message to the ring members in the ring group to confirm the signer; After completing the signing and verification process, the verifier in S5 You can initiate a verification process for the true signer to all ring members in the ring group, and the corresponding ring member becomes the prover. The process of determining the true signer of a periodically repudiable digital signature within a repudiable time period is as follows: S51: Verifier To each witness Send verification message ; S52: The Witness Select a random integer According to the verification message calculate ; ； This represents the time parameter calculated based on the current time t; S53: The Witness according to calculate and and form a response Send to the verifier Verification is required; S54: Verifier For the witness The sent response and the published parameters are processed and calculated separately. , and ; in, Indicates the curve point of the prover. Indicates the identity parameter of the certifier; Represents g Power; S55: Validator According to the verification message and calculate , ,judge Is the signature valid? If valid, proceed to S56; otherwise, the signature is invalid. S56: Verifier calculate , and judge Determine if the statement is true; if true, output the proof. Output the actual signer of the signature; otherwise, output the proof-maker. The actual signer who did not sign.

2. A periodic repudiable ring signature system based on the SM9 national cryptographic algorithm, characterized in that, The periodic repudiable ring signature method based on the SM9 national cryptographic algorithm as described in claim 1 includes: The system parameter configuration module initializes public parameters and master key pairs, updates system parameters, and sets up the signature environment. The user identity key management module receives the signer's identity and generates identity parameters and the signer's private key; The ring member management module is used to manage the list of legitimate and trusted users. It selects a corresponding number of legitimate users as ring members to form a ring group according to the signature requirements, and also supports the dynamic addition or removal of ring members. The ring signature generation module signs the specified message M based on the signer's private key to obtain a ring signature; The ring signature verification module calculates the relevant parameters of the received ring signature to verify its legality and validity. The confirmation / denial protocol module is used for the verification interaction between the verifier and the ring members. It calculates and processes relevant parameters to determine the true signer of the periodic repudiable digital signature within the repudiable time period.

Images