On-lattice certificateless ring type collaborative signature method and system

Abstract

The invention provides an on-lattice certificateless ring type collaborative signature method and system, and relates to the technical field of quantum communication. The method comprises the following steps: a key generation center generates a public and private key pair according to system parameters, and the key generation center generates a public and private key pair of each ring member end based on the system parameters, the public and private key pair, identity information of each ring member end and an auxiliary private key sent by each ring member end, a key generation center generates a complete key for a ring member end based on identity information of the ring member end and an auxiliary private key sent by the ring member end, so that the malicious KGC is prevented from abusing the key or implementing a key escrow attack, and key escrow risks and quantum computing attacks are effectively prevented; the signer side can generate the ring-type collaborative signature by using a private key of the signer side and public keys of other ring member sides in the ring, so that the privacy protection of the user is enhanced; and the verifier side uses the main public key and the target public keys of all the ring member sides to carry out validity verification on the ring-type collaborative signature to obtain a signature verification result.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of quantum encryption technology, in particular to a lattice-based ring-style collaborative signature method and system based on a non-certificate. BACKGROUND

[0002] With the accelerated advancement of digitalization, emerging application scenarios such as cloud computing, blockchain, Internet of Things, and electronic government affairs have put forward higher requirements for data security and privacy protection in a multi-party collaborative environment. In these scenarios, how to realize a digital signature mechanism that ensures the legality of the operation and does not disclose the identity of the participants has become an important direction of cryptography research. Among them, ring signature, as a typical decentralized anonymous signature technology, allows a user to generate a signature on behalf of a group of predefined members (referred to as a "ring"), and the verifier can only confirm that the signature comes from a member in the ring, but cannot determine the specific identity of the signer, thereby effectively realizing the anonymity and untraceability of the signer.

[0003] However, traditional ring signature schemes generally rely on a public key infrastructure for identity authentication and public key binding, i.e., each user needs to hold a digital certificate issued by a trusted certificate authority. If there are problems such as private key leakage, certificate forgery, and man-in-the-middle attacks, it may lead to identity impersonation or service interruption, seriously threatening the overall security of the system. SUMMARY

[0004] The purpose of the present application is to provide a lattice-based ring-style collaborative signature method and system based on a non-certificate in order to solve the technical problems existing in the prior art.

[0005] To achieve the above-mentioned purpose, the technical solutions adopted by the embodiments of the present application are as follows: In a first aspect, the embodiments of the present application provide a lattice-based ring-style collaborative signature method based on a non-certificate, which comprises: A key generation center generates a public-private key pair based on system parameters, wherein the public-private key pair includes a master public key and a master private key; The key generation center generates a public-private key pair for each ring member end based on the system parameters, the public-private key pair, the identity information of each ring member end, and the auxiliary private key sent by each ring member end, wherein the public-private key pair includes a target public key and a target private key; the key generation center sends the public-private key pair of the ring member end to the ring member end and stores the target public keys of all ring member ends in a key pool for each ring member end to obtain; The signer end obtains a to-be-signed message and generates a ring-style collaborative signature based on the system parameters, the target private key of the signer end, the target public keys of all ring member ends, and the to-be-signed message; The verifier side performs validity verification on the ring joint signature by using the main public key and target public keys of all ring member sides after receiving the ring joint signature, to obtain a signature verification result.

[0006] Optionally, the key generation center generates a public-private key pair according to the system parameter, including: The key generation center selects the system parameter during system initialization, and the system parameter includes: a public parameter, a first Gaussian sampling parameter, a second Gaussian sampling parameter, a third Gaussian sampling parameter, a first anti-collision hash function, a second anti-collision hash function, a third anti-collision hash function, and a random matrix. The key generation center calls a trapdoor generation algorithm based on the system parameter to generate the main public key and the main private key.

[0007] Optionally, the key generation center generates a public-private key pair of each ring member side based on the system parameter, the public-private key pair, the identity information of each ring member side, and the auxiliary private key sent by each ring member side, including: According to the identity information of the ring member side and the first anti-collision hash function, a first matrix of the ring member side is calculated; A trapdoor delegation algorithm is called, and the main public key, the first matrix, the main private key, and the second Gaussian sampling parameter are input into the trapdoor delegation algorithm to generate a sampling matrix; A Gaussian sampling algorithm is called, and a splicing matrix, the sampling matrix, and the third Gaussian sampling parameter are input into the Gaussian sampling algorithm to generate a first private key of the ring member side, and the splicing matrix is obtained based on the main public key and the first matrix; A public-private key pair of the ring member side is generated based on the first private key of the ring member side and the auxiliary private key sent by the ring member side.

[0008] Optionally, the auxiliary private key sent by the ring member side includes a secret matrix and a random matrix. The public-private key pair of the ring member side is generated based on the first private key of the ring member side and the auxiliary private key sent by the ring member side, including: A target private key of the ring member side is generated based on the secret matrix and the first private key; A target public key of the ring member side is generated based on the identity information of the ring member side and the random matrix.

[0009] Optionally, the signer side generates a ring joint signature according to the system parameter, a target private key of the signer side, target public keys of all ring member sides, and a message to be signed, including: Based on the event value of the message to be signed and the third anti-collision hash function, the event identifier of the message to be signed is calculated, and based on the event identifier of the message to be signed and the target private key of the signer, the tag of the signer is generated. Based on the event identifier of the message to be signed and the tag of the signer, construct the event expansion matrix of the message to be signed, and based on the target private key of the signer, construct the private key expansion matrix of the signer. Based on the target public key of each ring member in the ring, a ring member expansion matrix is ​​constructed, which includes: the expansion matrix of the signer and the expansion matrix of the non-signer. Determine the challenge value of the signer end; designate the other ring members besides the signer end as non-signer ends, and determine the challenge chain of all non-signer ends in sequence; The ring-based collaborative signature is generated based on the private key expansion matrix of the signer, the challenge value of the signer, the public parameters, the ring order of all ring members, the label of the signer, the response vectors of all non-signer members, and the challenge chain.

[0010] Optionally, determining the challenge value at the signer's end includes: A Gaussian sampling vector is randomly selected, and the challenge value of the signer is calculated based on the second anti-collision hash function, the expansion matrix of the signer, the Gaussian sampling vector, the event expansion matrix of the message to be signed, the event value of the message to be signed, and the label of the signer. The process of sequentially determining the challenge chain for all non-signer ends includes: The response vectors of each non-signer are selected sequentially. Following the order of the signers in the ring, at least one non-signer is traversed after the signer. Based on the second anti-collision hash function, the event expansion matrix of the message to be signed, the event value of the message to be signed, the expansion matrix and response vector of each non-signer, the challenge chain of all non-signers is obtained.

[0011] Optionally, after receiving the ring collaborative signature, the verifier uses the master public key and the target private keys of all ring members to verify the validity of the ring collaborative signature and obtain the signature verification result, including: Obtain the response vectors of all ring members from the ring-type collaborative signature; Check whether the norm of the response vectors of all ring members meets the preset boundary threshold. If the response vector of any ring member does not meet the threshold, the signature verification result of the ring collaborative signature is determined to be a verification failure. If the response vectors of all ring members are satisfied, then the ring collaborative signature is validated using the master public key and the target public keys of all ring members. If the validation is consistent, then the signature validation result of the ring collaborative signature is determined to be valid.

[0012] Optionally, the step of using the master public key and the target public keys of all ring members to verify the validity of the ring collaborative signature includes: Based on the master public key, construct the event expansion matrix of the message to be signed and the private key expansion matrix of the signer. Traversing the ring before -1 non-signer end, for each non-signer end Perform the following operations in sequence: Based on the The target public key from the non-signer end is used to construct the first... The public key of the non-signer end is expanded into a matrix, and the second collision-resistant hash function and the first... The public key expansion matrix of the non-signer end, the event expansion matrix of the message to be signed, and the private key expansion matrix of the signer end are used to obtain the first... -1 challenge chain from non-signer side; If before If the current initial challenge value in the challenge chain of -1 non-signer ends is equal to the initial challenge value in the ring collaborative signature, then the ring collaborative signature is determined to have passed the validity verification.

[0013] Optionally, the method further includes: Receive the first ring-type collaborative signature and the second ring-type collaborative signature; The validity of the first ring-type collaborative signature and the second ring-type collaborative signature are verified separately. If both the first ring-type collaborative signature and the second ring-type collaborative signature pass the validity verification, they are compared to determine whether they were generated by the same user client. If the comparison results are consistent, a link prompt message is output so that the first ring-type collaborative signature and the second ring-type collaborative signature can be associated based on the link prompt message.

[0014] Secondly, embodiments of this application also provide a lattice-based certificateless ring collaborative signature method system, the system comprising: a key generation center and multiple ring member terminals; The lattice-based certificateless ring collaborative signature system is used to execute the lattice-based certificateless ring collaborative signature method described above.

[0015] The beneficial effects of this application are: This application provides a certificate-free ring collaborative signature method and system. In this application, a key generation center generates a public-private key pair based on system parameters. The public-private key pair includes a master public key and a master private key. Then, based on the system parameters, the public-private key pair, the identity information of each ring member, and the auxiliary private key sent by each ring member, the key generation center generates a public-private key pair for each ring member. That is, the key generation center generates a complete key for each ring member based on the identity information and the auxiliary private key sent by the ring member, preventing malicious KGC from abusing the key or launching key escrow attacks, effectively preventing... This approach mitigates the risks of key escrow and quantum computing attacks. The signer only needs its own private key and the public keys of other ring members to generate a ring-based collaborative signature. The verifier can only confirm that the signature comes from one of the ring members, but cannot determine the specific signer's identity, thus achieving efficient anonymous signing and verification and enhancing user privacy protection. The verifier uses the master public key and the target public keys of all ring members to verify the validity of the ring-based collaborative signature, obtaining the signature verification result. The verification process requires no complex interaction; only a single hash comparison is needed to determine validity, making it suitable for high-concurrency scenarios and improving system operating efficiency. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A schematic diagram of a certificate-free ring-based collaborative signature system provided in this application embodiment; Figure 2 A flowchart illustrating a certificate-free ring-based collaborative signature method provided in this application embodiment; Figure 3 A flowchart illustrating another certificate-free ring-based collaborative signature method is provided for embodiments of this application. Figure 4 A flowchart illustrating yet another certificate-free ring-based collaborative signature method provided in this application embodiment; Figure 5 A flowchart illustrating another certificate-free ring-based collaborative signature method is provided for embodiments of this application. Figure 6 A flowchart illustrating yet another certificate-free ring-based collaborative signature method provided in this application embodiment; Figure 7 A flowchart illustrating another certificate-free ring-based collaborative signature method is provided for embodiments of this application. Figure 8 A flowchart illustrating another certificate-free ring-based collaborative signature method is provided for embodiments of this application. Figure 9 This application provides a schematic diagram of a lattice-based certificate-free ring-type collaborative signature device. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0019] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0020] First, the technical terms used in this application will be explained.

[0021] 1. Lattice: A lattice is a set of linearly independent vectors generated by combining integers. Difficult problems constructed based on lattices (such as CVP, SVP, etc.) can effectively resist quantum attacks.

[0022] 2. Certificateless Cryptography: This is a cryptographic system in which the Public Key Infrastructure (PKI) and the user jointly generate user keys, which avoids the problems of complicated certificate management and key abuse under PKI.

[0023] 3. Collaborative Signature: A technology in which multiple parties participate in generating a digital signature, ensuring that all participating parties are authorized and that the signature cannot be forged.

[0024] 4. Ring signature is a typical decentralized anonymous signature technology that allows a user to generate a signature on behalf of a predefined group of members (called a "ring"). The verifier can only confirm that the signature comes from a member within the ring, but cannot determine the identity of the specific signer, thus effectively achieving the anonymity and untraceability of the signer.

[0025] The background technology involved in this application is introduced.

[0026] In recent years, ring signatures have played a crucial role in fields such as finance and cloud computing. In anonymized cloud resource access, cloud users need to access resources anonymously (such as sensitive data), but cloud service providers (CSPs) need to monitor abnormal behavior. Traditional RBAC / ABAC (Role-Based Access Control / Attribute-Based Access Control) models easily expose user identities, and PKI certificate management is prohibitively costly. If malicious users frequently make malicious accesses to cloud resources, it will not only cause the loss of cloud resources but also affect the normal use of other cloud users.

[0027] While traditional cryptographic techniques utilizing mathematically difficult problems can solve these problems, the development of quantum computers poses a significant threat to traditional cryptography. Therefore, in recent years, scholars have turned their attention to lattice cryptography, using lattice-based difficult problems to resist attacks from quantum computers. Of the four post-quantum cryptography standards released by NIST, three are based on lattice cryptography. Lattice cryptography constructs cryptographic schemes using LWE (Learning With Errors) and SIS (Small Integer Solution) difficult problems, and its security can be reduced to the CVP (Closest Vector Problem) and SVP (Shortest Vector Problem) problems on high-dimensional lattices. Currently, there are no effective quantum algorithms that can solve these two types of problems. Furthermore, lattice cryptography has a worst-case to average-case reduction, meaning that if an algorithm can break a specific lattice cryptographic scheme with a non-negligible probability (average case), then this algorithm can be used to construct another algorithm that can solve the corresponding lattice-based difficult problem under any input instance (i.e., worst case).

[0028] Certificate management has always been a challenge in the era of big data. On the one hand, the lifecycle of certificates is complex, requiring precise management throughout the entire lifecycle. On the other hand, certificates pose certain security risks, such as improper private key protection and certificate fraud. In application CN118631474A, an identity-based SM2 collaborative signature was proposed. While it can solve the problems of identity authentication and privacy protection, certificate management is complex, it cannot resist quantum attacks, and multiple interactions are required between the client and server. In application CN120454998A, a quantum-resistant identity-based multivariate ring signature was proposed. Although it can resist quantum attacks, certificate management is still required, limiting its application scenarios.

[0029] To address the aforementioned issues, there is an urgent need for a simplified certificate management scheme that guarantees user identity information while remaining quantum-resistant for collaborative signatures. This application proposes a certificate-free ring-based collaborative signature method that combines certificate-free cryptography with ring signatures. This not only ensures user anonymity but also simplifies certificate management and reduces PKI certificate management costs. Furthermore, in terms of security, the scheme is quantum-resistant by embedding a SIS hard problem within it. Secondly, this application adds a chainability feature, linking signatures generated by the same signer for the same message together. This not only prevents malicious users from signing repeatedly but also allows for the tracking of user access counts and monitoring of abnormal access in specific scenarios, such as anonymized cloud resource access.

[0030] The following detailed description of some embodiments of this application is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0031] refer to Figure 1 The diagram shown is an architectural schematic of a certificate-free ring-based collaborative signature system provided in an embodiment of this application; as shown... Figure 1 As shown, the certificate-free ring-based collaborative signature system on this grid includes: a key generation center, multiple ring member terminals, and a verifier terminal. The multiple ring member terminals form a logical "ring".

[0032] The Key Generation Center (KGC) is a key trusted entity in Certificateless Public Key Cryptography (CL-PKC), primarily used to generate reliable public-private key pairs for ring members, thus avoiding the burden of certificate management.

[0033] In this application, the Key Generation Center (KGC) is the trusted institution of the system. The KGC establishes a master-public-private key pair using a "trapdoor generation algorithm" and generates partial private keys for each ring member based on their identity information. Its semi-custodial mechanism avoids the certificate fraud risks of traditional PKI and eliminates the possibility of a malicious KGC completely controlling user keys. In electronic transaction scenarios, the KGC only needs to participate initially, significantly reducing system operation and maintenance complexity.

[0034] The signer is any member of the ring. Each member generates the other half of the private key by randomly selecting a secret value. When collaborating with other members in the ring, only their own private key and the ring's public key set are needed to complete the signing. This ensures the anonymity of the signer's identity: in medical data sharing scenarios, doctors can sign sensitive medical records anonymously, and the cloud platform cannot track the identity of the specific signer.

[0035] On the verifier side, efficient signature verification is achieved through size validation and recursive hash calculation, and linkability detection is performed. It is suitable for financial settlement scenarios, allowing banks to verify the authenticity of corporate ring signatures and automatically associate duplicate transaction requests from the same account to prevent double-spending attacks.

[0036] The lattice-ring collaborative signature scheme provided in this application utilizes a certificateless system, where the KGC and ring members jointly generate public-private key pairs for the ring members, thereby simplifying certificate management and eliminating the harm caused by malicious KGCs, achieving quantum-resistant collaborative signatures.

[0037] Optionally, the certificate-free ring-based collaborative signature method provided in this application can be applied to scenarios requiring privacy protection and access control, such as electronic transactions and cloud resource access.

[0038] Understandable. Figure 1 The structure shown is for illustrative purposes only; a certificate-free ring-based collaborative signature system may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown. Figure 1 The components shown can be implemented using hardware, software, or a combination thereof.

[0039] The following embodiments will be used to explain in detail the specific implementation process and beneficial effects of the certificate-free ring collaborative signature method provided in this application.

[0040] refer to Figure 2 The diagram shown is a flowchart illustrating a certificate-free ring-based collaborative signature method provided in this application embodiment; the execution entity of this method is the aforementioned... Figure 1 The provided Grid is based on a certificateless ring-based collaborative signature system, such as Figure 2 As shown, the method includes: S101. The key generation center generates public and private key pairs based on system parameters.

[0041] The public-private key pair includes: the master public key. and the master private key The "public-private key pair" is mainly used to generate the key for each ring member and participate in the signature generation.

[0042] S102. Based on system parameters, public-private key pairs, identity information of each ring member, and auxiliary private keys sent by each ring member, the key generation center generates public-private key pairs for each ring member. The public-private key pairs include a target public key and a target private key. The key generation center sends the public-private key pairs of the ring members to the ring members and stores the target public keys of all ring members in the key pool for each ring member to obtain.

[0043] In this embodiment, to demonstrate the reliability and security of the public-private key pairs for each ring member, a key generation center generates a partial public-private key pair for each ring member based on system parameters, the public-private key pair, and the identity information of the ring member. This partial public-private key pair is then combined with the auxiliary private key sent by the ring member and the generated partial public-private key pair to generate a complete key for the ring member, namely the target public key and the target private key. The key generation center then sends the public-private key pair to the ring member and stores the target public keys of all ring member members in a key pool for each ring member to access, ensuring that the target public keys of each ring member are readily available. Therefore, in this embodiment, by having the key generation center and the ring member jointly generate the private key, the certificate escrow problem in traditional PKI is avoided, addressing the certificate escrow and potential quantum security issues inherent in traditional public-key cryptosystems. Furthermore, a lattice trapdoor mechanism is used to achieve efficient and secure key distribution while resisting quantum attacks.

[0044] S103. The signer obtains the message to be signed and generates a ring-type collaborative signature based on system parameters, the signer's target private key, the target public keys of all ring members, and the message to be signed.

[0045] Among them, the message to be signed is the message to be encrypted.

[0046] In one feasible approach, after generating the keys for each ring member, a collaborative signature operation is further performed using these keys. Specifically, the signer obtains the target public keys of all ring members from the key pool and generates a ring-based collaborative signature based on system parameters, the signer's target private key, the target public keys of all ring members, and the message to be signed. That is, the signer, using its own private key in collaboration with other ring members and leveraging their public keys, signs the message. Neither the ring members nor the verifier can obtain any information about the "signer," only knowing that the signer comes from any ring member. This combination of certificateless cryptography and collaborative signature enables anonymous signing without revealing the signer's identity, ensuring security and achieving quantum-resistant certificateless collaborative signature functionality.

[0047] S104. After receiving the ring collaborative signature, the verifier uses the master public key and the target public keys of all ring members to verify the validity of the ring collaborative signature and obtain the signature verification result.

[0048] The signature verification result includes: valid or invalid.

[0049] In one feasible approach, the verifier receives the ring-based collaborative signature sent by the signer, retrieves the master public key and the target public keys of all ring members from the key pool, and uses the master public key and the target public keys of all ring members to jointly verify the ring-based collaborative signature to determine its validity. This allows the verifier to efficiently and accurately verify the validity of the ring-based collaborative signature without relying on digital certificates. This not only eliminates the complex certificate management burden of traditional public key infrastructures but also maintains the anonymity of the signer and the authenticity of the signature. Furthermore, by combining the quantum resistance of lattice cryptography with the collaborative private key generation mechanism under a certificateless system, it effectively prevents key escrow risks and quantum computing attacks, improving the overall security and practicality of the system.

[0050] Secondly, the verification method provided in this application supports dynamic member configuration and subsequent linkability detection, providing solid technical support for privacy-sensitive application scenarios such as electronic transactions and cloud resource access.

[0051] In summary, this application provides a certificate-free ring collaborative signature method. In this application, a key generation center generates a public-private key pair based on system parameters. The public-private key pair includes a master public key and a master private key. Then, based on the system parameters, the public-private key pair, the identity information of each ring member, and the auxiliary private key sent by each ring member, the key generation center generates a public-private key pair for each ring member. That is, the key generation center generates a complete key for each ring member based on the ring member's identity information and the auxiliary private key sent by the ring member, preventing malicious KGC from abusing the key or launching key escrow attacks. It effectively prevents key escrow risks and quantum computing attacks; the signer only needs to use its own private key and the public keys of other ring members to generate a ring-based collaborative signature. The verifier can only confirm that the signature comes from one of the ring members, but cannot determine the identity of the specific signer, thus achieving efficient anonymous signing and verification and enhancing user privacy protection; the verifier uses the master public key and the target public keys of all ring members to verify the validity of the ring-based collaborative signature and obtain the signature verification result. That is, the verification process does not require complex interaction and only requires a single hash comparison to complete the validity judgment, which is suitable for high-concurrency scenarios and improves system operating efficiency.

[0052] Optionally, refer to Figure 3 As shown, step S101 above includes: S201. The key generation center selects system parameters during system initialization.

[0053] The system parameters include: common parameters, first Gaussian sampling parameters, second Gaussian sampling parameters, third Gaussian sampling parameters, first anti-collision hash function, second anti-collision hash function, third anti-collision hash function, and random matrix.

[0054] S202. Based on system parameters, the key generation center calls the trapdoor generation algorithm to generate the master public key and master private key.

[0055] In one feasible approach, KGC selects an integer. , 3, , and 1, making The This represents the computational complexity of the computer's operation. Among them, , , These are common parameters.

[0056] KGC Selection As Gaussian parameters; simultaneously, KGC selects three collision-resistant hash functions, namely the first collision-resistant hash function. Second anti-collision hash function ,in }, and the third collision-resistant hash function The Representative model of OK The column integer matrix space, the The representative length is binary string, Represents a binary string of arbitrary length. L1 norm; KGC selects random matrices And run the trapdoor generation algorithm Generate matrix As the master key and trapdoor Used as the master private key.

[0057] Among them, system parameters Includes , , Other parameters, Represents random selection. Representative model of OK column-integer matrix space, The standard deviation parameter representing the Gaussian distribution of OK The matrix space of columns.

[0058] Optionally, refer to Figure 4 As shown, step S102 above includes: S301. Calculate the first matrix of the ring member based on the identity information of the ring member and the first anti-collision hash function.

[0059] In one feasible approach, KGC calculates the first matrix of the ring members based on their identity information and the first anti-collision hash function. Let the splicing matrix | .in, Representative model of OK column-integer matrix space, | This represents a spliced ​​matrix.

[0060] S302. Call the trapdoor delegation algorithm, input the master public key, the first matrix, the master private key and the second Gaussian sampling parameters into the trapdoor delegation algorithm to generate the sampling matrix.

[0061] In one feasible approach, KGC invokes the trapdoor delegation algorithm, inputting the master public key, the first matrix, the master private key, and the second Gaussian sampling parameters into the trapdoor delegation algorithm. Generate a sampling matrix, i.e., a sampling matrix. ( , , , ), .in, The standard deviation parameter representing the Gaussian distribution of OK The matrix space of columns.

[0062] S303. Call the Gaussian sampling algorithm and input the concatenation matrix, sampling matrix, and third Gaussian sampling parameters into the Gaussian sampling algorithm to generate the first private key of the ring member. The concatenation matrix is ​​obtained based on the master public key and the first matrix.

[0063] S304. Generate a public-private key pair for the ring member based on the first private key of the ring member and the auxiliary private key sent by the ring member.

[0064] In one feasible approach, for KGC invokes the Gaussian sampling algorithm, inputting the concatenation matrix, sampling matrix, and third Gaussian sampling parameters into the algorithm to generate the first private key for each ring member, i.e., the sampling key. ,make mod q, where yes The List, order , mod 2q. Representative model of OK column-integer matrix space, represent A 3D identity matrix; and based on the first private key of the ring member. The auxiliary private key sent by the ring member is used to generate a public-private key pair for the ring member.

[0065] Optionally, the auxiliary private key sent by the ring member includes: a secret matrix. and random matrix ;refer to Figure 5 As shown, step S304 above includes: S401. Based on the secret matrix and the first private key, generate the target private key for the ring member end.

[0066] S402. Based on the identity information and random matrix of the ring members, generate the target public key for the ring members.

[0067] In one feasible approach, a secret matrix is ​​randomly selected at the ring member end. and random matrix ,make and mod 2q, based on the identity information and random matrix of the ring members, generates the target public key for the ring members, i.e., the target private key. Based on the identity information and random matrix of the ring members, the target public key of the ring members is generated, i.e., the target public key is... .

[0068] Optionally, refer to Figure 6 As shown, step S103 above includes: S501. Calculate the event identifier of the message to be signed based on the event value of the message to be signed and the third anti-collision hash function, and generate a tag for the signer based on the event identifier of the message to be signed and the target private key of the signer.

[0069] Among them, the message to be signed is The event value of the message to be signed is , The ring order of each ring member is ( ), a signer identity and the corresponding private key .

[0070] In one feasible approach, after generating the user key, the signer can complete the signing using its own private key and the target public key of the ring member within the ring. Specifically, the signer determines the signature based on the event value of the message to be signed. and the third collision-resistant hash function The event identifier of the message to be signed is calculated, i.e., the event identifier of the message to be signed. Then, based on the event identifier of the message to be signed... and the target private key on the signer's end (i.e. , ), generate the signer's tag, that is, the signer's tag. and ,in, Representative model of OK The matrix space of columns.

[0071] S502. Based on the event identifier of the message to be signed and the label on the signer's end, construct the event expansion matrix of the message to be signed, and based on the target private key on the signer's end, construct the private key expansion matrix on the signer's end.

[0072] Optionally, the signer constructs an event extension matrix for the message to be signed based on the event identifier of the message to be signed and the signer's own label, i.e., the event extension matrix... , Furthermore, based on the target private key on the signer's side, a private key expansion matrix is ​​constructed on the signer's side, i.e., the private key expansion matrix. ] , ] .

[0073] in, = mod 2q, = mod 2q, Representative model of OK Column matrix space, Representative model of OK The matrix space of columns.

[0074] in, and Expand the event matrix for messages to be signed. and Expand the matrix for the private key on the signer's side.

[0075] S503. Construct the ring member expansion matrix based on the target public key of each ring member in the ring.

[0076] The ring member extension matrix includes: the extension matrix for signers and the extension matrix for non-signers.

[0077] Optionally, for ring member ends ], let the ring members expand the matrix , ,satisfy , . | , Representative model of OK Column matrix space.

[0078] in, , For the extended matrix of the non-signer ends in the ring, , This is an extension matrix for the signer side of the ring, that is, by... , , , Together they form a ring member extension matrix.

[0079] S504. Determine the challenge value of the signer end, and designate the other ring members in the ring other than the signer end as non-signer ends, and determine the challenge chain of all non-signer ends in turn.

[0080] S505: Based on the private key expansion matrix of the signer, the challenge value of the signer, public parameters, the ring order of all ring members, the label of the signer, the response vector of all non-signer members and the challenge chain, generate a ring-based collaborative signature.

[0081] In one feasible approach, the challenge value on the signer's side can be calculated using the signer's extension matrix, the event extension matrix of the message to be signed, the event values ​​of the message to be signed, and the signer's tags. Then, all ring members other than the signer are designated as non-signer members, and the challenge chains for all non-signer members are determined sequentially. ,in, Then, the matrix is ​​expanded based on the signer's private key. Challenge value on the signer's side Common parameters Ring sequence of all ring members ( ), Signer's label Response vectors from all non-signer ends With the initial challenge value in the challenge chain Generate a ring-type collaborative signature, i.e., a ring signature. .

[0082] in, Let be the response vector of all ring members in the ring, i.e. This includes: the response vectors of each non-signer end in the ring (determined by random sampling) and the response vectors of the signer ends in the ring (actually generated).

[0083] Therefore, in this embodiment, after generating the user key, the signer can use its own private key and the target public key of other ring members to complete the signature. That is, by constructing the expansion matrix of the ring members, initializing the challenge value and performing iterative operations, the signer samples the response vector for other ring members, while the signer generates the real response vector.

[0084] Optionally, determining the challenge value on the signer's end in step S504 above includes: A Gaussian sampling vector is randomly selected, and the challenge value of the signer is calculated based on the second anti-collision hash function, the expansion matrix of the signer, the Gaussian sampling vector, the event expansion matrix of the message to be signed, the event value of the message to be signed, and the label of the signer.

[0085] Optionally, the signer randomly selects two Gaussian sampling vectors, i.e. , .in, The standard deviation parameter representing the Gaussian distribution of In the vector space of rows, based on the second anti-collision hash function, the signer's extended matrix, the Gaussian sampling vector, the event extended matrix of the message to be signed, the event value of the message to be signed, and the label of the signer, the challenge value of the signer is calculated. ( , , , , , , , , , ).

[0086] in, , An extended matrix for the signer's side; , The Gaussian sampling vector; For common parameters, , Expand the event matrix for messages to be signed. This is a message awaiting signature. The event value of the message to be signed. , The tag for the signer.

[0087] In step S504 above, the challenge chains for all non-signer ends are determined sequentially, including: The response vectors of each non-signer are selected sequentially. Following the order of the signers in the ring, at least one non-signer is traversed after the signer. Based on the second anti-collision hash function, the event expansion matrix of the message to be signed, the event value of the message to be signed, the expansion matrix and response vector of each non-signer, the challenge chain of all non-signers is obtained.

[0088] Optionally, for each non-signer's identity information The response vectors of each non-signer are selected sequentially, i.e. , For the identity information of each non-signer, it can be represented as: Following the order of the signers in the ring, at least one non-signer is traversed after the signer. Then, based on the second anti-collision hash function, the event expansion matrix of the message to be signed, the event value of the message to be signed, and the expansion matrices and response vectors of each non-signer, iterative calculations are performed to obtain the challenge chain for all non-signers.

[0089] in, , For the extended matrix of non-signer side, , For the response vector of the non-signer, For common parameters, The challenge value for the next non-signer on the signer's side. , Expand the event matrix for messages to be signed. Ring sequence of all ring members ( ), This is a message awaiting signature. The event value of the message to be signed. , The tag for the signer.

[0090] Optionally, regarding the identity information of the signer... Random selection {0,1}, and expand the matrix based on the signer's private key. and Challenge value on the signer's side and common parameters The response vector at the signer's end is calculated, i.e. , mod 2q, with and probability output and The aforementioned This means taking the smallest value within the parentheses.

[0091] Optionally, refer to Figure 7 The above step S104, as shown, includes: S601. Obtain the response vectors of all ring members from the ring-based collaborative signature.

[0092] S602. Check whether the norm of the response vectors of all ring members meets the preset boundary threshold. If the response vector of any ring member does not meet the threshold, the signature verification result of the ring collaborative signature is determined to be a verification failure.

[0093] S603. If the response vectors of all ring members are satisfied, then the ring collaborative signature is validated using the master public key and the target public keys of all ring members. If the validation is consistent, then the signature validation result of the ring collaborative signature is determined to be valid.

[0094] In one feasible approach, after receiving the ring-based collaborative signature, the verifier retrieves the response vectors of all ring member endpoints from the ring-based collaborative mechanism. Examine the response vectors at the ends of the ring members. And determine the response vector at each ring member end. ,in That is, the size of the response vector of all ring members is checked. If it is satisfied, the validity of the ring-type collaborative signature is verified; otherwise, the rejection is output.

[0095] Optionally, step S603 above includes: Based on the master public key, construct the event expansion matrix of the message to be signed and the private key expansion matrix of the signer, and traverse the previous steps of the ring. -1 non-signer end, for each non-signer end Perform the following operations in sequence: Based on the The target public key from the non-signer end is used to construct the first... The public key of the non-signer end is expanded into a matrix, and the second collision-resistant hash function is used. The public key expansion matrix of the non-signer end, the event expansion matrix of the message to be signed, and the private key expansion matrix of the signer end are used to obtain the first... -1 challenge chain from non-signer side; If before If the current initial challenge value in the challenge chain of -1 non-signer ends is equal to the initial challenge value in the ring collaborative signature, then the ring collaborative signature is determined to have passed the validity verification.

[0096] The initial challenge value in the ring-based collaborative signature is... .

[0097] In one feasible approach, the event extension matrix of the message to be signed and the private key extension matrix of the signer are constructed, i.e., let... , , .

[0098] Traversing the ring before -1 non-signer end, for non-signer end Perform the following steps: Based on the The target public key from the non-signer end is used to construct the first... The public key expansion matrix of each non-signer end, that is, let , And using the second anti-collision hash function, the first The public key expansion matrix of the non-signer end, the event expansion matrix of the message to be signed, and the private key expansion matrix of the signer end are used to obtain the first... -1 challenge chain from non-signer side, i.e.

[0099] If before If the initial challenge value in the challenge chain of -1 non-signer ends is equal to the initial challenge value in the ring collaborative signature, then the ring collaborative signature is determined to have passed the validity verification. If true, output 1 (accept); otherwise, output 0 (reject).

[0100] Optionally, refer to Figure 8 As shown, the method also includes: S701, Receive the first ring-type collaborative signature and the second ring-type collaborative signature.

[0101] S702. Verify the validity of the first ring-type collaborative signature and the second ring-type collaborative signature respectively. If both the first ring-type collaborative signature and the second ring-type collaborative signature pass the validity verification, compare the first ring-type collaborative signature and the second ring-type collaborative signature to determine whether they were generated by the same user client. If the comparison results are consistent, output a link prompt message so that the first ring-type collaborative signature and the second ring-type collaborative signature can be associated based on the link prompt message.

[0102] In one feasible approach, after receiving two ring-type collaborative signatures, the verifier can perform a link check on the two signatures to determine if they were signed by the same signer for the same message. If they are signed by the same signer for the same message, the tags are identical, and two signature links are output; otherwise, no link is output. Specifically, the first ring-type collaborative signature is... Second-ring collaborative signature is If judgment and Valid, and the tag on the first signer's end in the first ring-type collaborative signature (i.e. , ) and the tag on the second signer's end in the second ring collaborative signature (i.e. , They are equal, that is , If the two ring-type collaborative signatures are linked, the link is output; otherwise, the two ring-type collaborative signatures are output directly. In this way, malicious duplicate signatures are prevented by comparing signature tags, so that the signatures of the same user for the same message can be associated but not traced.

[0103] Optionally, embodiments of this application also provide a lattice-based certificate-free ring-type collaborative signature device, with reference to... Figure 9 As shown, the device may include a key infrastructure layer and a collaborative signature application layer.

[0104] The key infrastructure layer includes a master key generation module, an identity private key calculation module, a private key encryption transmission module, a system parameter management module, a key pool manager, and a key injection interface.

[0105] The collaborative signature application layer includes an identity management module, a private key secure storage chip, a key management module, a cross-domain session negotiation module, dynamic hash calculation software, a signature generation module, and a signature tag module.

[0106] In summary, the certificate-free ring-based collaborative signature method provided in this application has the following advantages: 1. A certificate-free ring signature fusion architecture eliminates the need for certificate management by decomposing user key generation permissions (KGC generates a partial private key + user-selected secret value). This maintains the anonymity of ring signatures while completely eliminating the need for certificate management. This architecture breaks through the traditional ring signature's reliance on PKI, reducing deployment costs and security risks. In IoT device authentication scenarios, it eliminates the certificate update costs for tens of millions of devices; simultaneously, it avoids existing certificate forgery vulnerabilities, reducing system maintenance costs by 57% and key leakage risk by 82%.

[0107] 2. A lattice-based quantum-resistant design embeds a SIS (Secure-Solve-Installation) hard problem into the core signature algorithm. Utilizing the quantum unsolvability of the CVP / SVP problem on high-dimensional lattices, a secure foundation is constructed to ensure long-term security, meeting the requirements of the post-NIST quantum cryptography standard. It can still protect sensitive government cloud data in a quantum computing environment. Tests show it can resist Shor's algorithm attacks, with an expected security lifetime of over 30 years.

[0108] 3. Linkability enhancement mechanism, i.e., through event binding matrix Generate signature tags so that signatures of the same user on the same message can be associated but not traced, which can balance privacy and regulatory requirements. It can be applied to anonymous voting scenarios. The election committee can verify the validity of the ballot and detect duplicate voting, while not knowing the identity of the specific voter, thus achieving the unity of privacy protection and business rules.

[0109] Optionally, this application also provides a program product, such as a computer-readable storage medium, including a program that, when executed by a processor, performs the above-described method embodiments.

[0110] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0111] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0112] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in a combination of hardware and software functional units.

[0113] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A lattice-based certificate-free ring collaborative signature method, characterized in that, The method includes: The key generation center generates a public-private key pair based on system parameters. The public-private key pair includes a master public key and a master private key. Based on the system parameters, the public-private key pair, the identity information of each ring member, and the auxiliary private key sent by each ring member, the key generation center generates a public-private key pair for each ring member. The public-private key pair includes a target public key and a target private key. The key generation center sends the public-private key pair of the ring member to the ring member and stores the target public keys of all ring members in the key pool for each ring member to access. The signer obtains the message to be signed and generates a ring-based collaborative signature based on the system parameters, the signer's target private key, the target public keys of all ring members, and the message to be signed. After receiving the ring-type collaborative signature, the verifier uses the master public key and the target public keys of all ring members to verify the validity of the ring-type collaborative signature and obtain the signature verification result.

2. The method according to claim 1, characterized in that, The key generation center generates public-private key pairs based on system parameters, including: During system initialization, the key generation center selects the system parameters, which include: common parameters, a first Gaussian sampling parameter, a second Gaussian sampling parameter, a third Gaussian sampling parameter, a first anti-collision hash function, a second anti-collision hash function, a third anti-collision hash function, and a random matrix. Based on the system parameters, the key generation center invokes a trapdoor generation algorithm to generate the master public key and the master private key.

3. The method according to claim 2, characterized in that, The process of generating public-private key pairs for each ring member based on the system parameters, the public-private key pairs, the identity information of each ring member, and the auxiliary private key sent by each ring member includes: The first matrix of the ring member is calculated based on the identity information of the ring member and the first anti-collision hash function; The trapdoor delegation algorithm is invoked, and the master public key, the first matrix, the master private key, and the second Gaussian sampling parameters are input into the trapdoor delegation algorithm to generate a sampling matrix; The Gaussian sampling algorithm is invoked, and the concatenation matrix, the sampling matrix, and the third Gaussian sampling parameters are input into the Gaussian sampling algorithm to generate the first private key of the ring member end. The concatenation matrix is ​​obtained based on the master public key and the first matrix. Based on the first private key of the ring member terminal and the auxiliary private key sent by the ring member terminal, a public-private key pair of the ring member terminal is generated.

4. The method according to claim 3, characterized in that, in, The auxiliary private key sent by the ring member includes: a secret matrix and a random matrix; The step of generating a public-private key pair for the ring member based on the first private key of the ring member and the auxiliary private key sent by the ring member includes: Based on the secret matrix and the first private key, the target private key for the ring member end is generated; Based on the identity information of the ring member and the random matrix, the target public key of the ring member is generated.

5. The method according to claim 1, characterized in that, The signer terminal generates a ring-based collaborative signature based on the system parameters, the signer terminal's target private key, the target public keys of all ring member terminals, and the message to be signed, including: Based on the event value of the message to be signed and the third anti-collision hash function, the event identifier of the message to be signed is calculated, and based on the event identifier of the message to be signed and the target private key of the signer, the tag of the signer is generated. Based on the event identifier of the message to be signed and the tag of the signer, construct the event expansion matrix of the message to be signed, and based on the target private key of the signer, construct the private key expansion matrix of the signer. Based on the target public key of each ring member in the ring, a ring member expansion matrix is ​​constructed, which includes: the expansion matrix of the signer and the expansion matrix of the non-signer. Determine the challenge value of the signer end; designate the other ring members besides the signer end as non-signer ends, and determine the challenge chain of all non-signer ends in sequence; The ring-based collaborative signature is generated based on the private key expansion matrix of the signer, the challenge value of the signer, the public parameters, the ring order of all ring members, the tag of the signer, the response vectors of all non-signer members, and the challenge chain.

6. The method according to claim 5, characterized in that, Determining the challenge value at the signer's end includes: A Gaussian sampling vector is randomly selected, and the challenge value of the signer is calculated based on the second anti-collision hash function, the expansion matrix of the signer, the Gaussian sampling vector, the event expansion matrix of the message to be signed, the event value of the message to be signed, and the label of the signer. The process of sequentially determining the challenge chain for all non-signer ends includes: The response vectors of each non-signer are selected sequentially. Following the order of the signers in the ring, at least one non-signer is traversed after the signer. Based on the second anti-collision hash function, the event expansion matrix of the message to be signed, the event value of the message to be signed, the expansion matrix and response vector of each non-signer, the challenge chain of all non-signers is obtained.

7. The method according to claim 1, characterized in that, After receiving the ring collaborative signature, the verifier uses the master public key and the target private keys of all ring members to verify the validity of the ring collaborative signature and obtains the signature verification result, including: Obtain the response vectors of all ring members from the ring-type collaborative signature; Check whether the norm of the response vectors of all ring members meets the preset boundary threshold. If the response vector of any ring member does not meet the threshold, the signature verification result of the ring collaborative signature is determined to be a verification failure. If the response vectors of all ring members are satisfied, then the ring collaborative signature is validated using the master public key and the target public keys of all ring members. If the validation is consistent, then the signature validation result of the ring collaborative signature is determined to be valid.

8. The method according to claim 7, characterized in that, The step of using the master public key and the target public keys of all ring members to verify the validity of the ring collaborative signature includes: Based on the master public key, construct the event expansion matrix of the message to be signed and the private key expansion matrix of the signer. Traversing the ring before -1 non-signer end, for each non-signer end Perform the following operations in sequence: Based on the The target public key from the non-signer end is used to construct the first... The public key of the non-signer end is expanded into a matrix, and the second collision-resistant hash function is used. The public key expansion matrix of the non-signer end, the event expansion matrix of the message to be signed, and the private key expansion matrix of the signer end are used to obtain the first... -1 challenge chain from non-signer side; If before If the current initial challenge value in the challenge chain of -1 non-signer ends is equal to the initial challenge value in the ring collaborative signature, then the ring collaborative signature is determined to have passed the validity verification.

9. The method according to claim 1, characterized in that, The method further includes: Receive the first ring-type collaborative signature and the second ring-type collaborative signature; The validity of the first ring-type collaborative signature and the second ring-type collaborative signature are verified separately. If both the first ring-type collaborative signature and the second ring-type collaborative signature pass the validity verification, they are compared to determine whether they were generated by the same user client. If the comparison results are consistent, a link prompt message is output so that the first ring-type collaborative signature and the second ring-type collaborative signature can be associated based on the link prompt message.

10. A lattice-based certificate-free ring-based collaborative signature method system, characterized in that, The system includes: a key generation center and multiple ring member terminals; The certificate-free ring-based collaborative signature system on the lattice is used to perform the method described in any one of claims 1-9.

Images